A Collection of Random Thoughts

My blog will be moving

2006-10-23T14:41:00.000-05:00

With the recent issues I've encountered here at Blogger since moving to the Beta service (the inability to publish from Live Writer or Word is a big one), and since my joining Microsoft, I've decided to move my blog over to Technet blogs. There may be occassional posts here in the future, but most of my content will be published to my new blog. You can find my new blog at:

http://blogs.technet.com/benw/

Make sure to update your bookmarks and your RSS subscriptions.

I've already got one post up there - let me know what you think of it, and also if you have any ideas for future topics.

Three items of note in the Sports world

2006-10-17T08:21:00.000-05:00

First, the Bears offense didn't deserve to win last night against the Arizona Cardinals. Rex Grossman was terrible. 4 interceptions, and 2 lost fumbles. That's almost unheard of. However, give credit to the Bears defense. After being down 20-0 at the half, they came back to life, and literally got their team back in the game. They forced 2 fumbles that were returned for touchdowns, and with a punt return for a touchdown and a lone field goal earlier in the game, that's all Chicago needed. We'll see how they rebound from this dismal performance, but they certainly didn't look like a potential 16-0 team last night.

Second, I am absolutely disgusted at the brawl that occurred during the Miami - Florida International game this past Saturday. It was a debacle. It was an embarrassment to both schools. At least one of them seems to be taking it somewhat seriously. Unfortunately, it isn't Miami. Florida International dismissed 2 players, and extended the suspensions of 16 others to indefinite suspensions. Miami, on the other hand, has suspended one player indefinitely (the one that was swinging his helmet at other players), but 13 other players only received a 1-game suspension (including a player that was visually observed to be "stomping" on other players legs. You gotta be kidding me. Mike and Mike (on ESPN radio) are spot-on when they said that the players involved (or at least those that committed the more serious acts) should be kicked off their respective teams, and should then be banned from football for life (including the NFL). The piddly 1-game suspensions dished out by the conference (ACC and Sunbelt) and by Miami are nothing more than token penalties. ACC commissioner John Swofford says "These suspensions send a clear and definitive message that this type of behavior will not be tolerated," - yeah right. Gimme a break. At least FIU had the guts to make a strong statement by indefinitely suspending many of the players involved.

Third, I Believe! Actually, I guess I should say I'm a fair weather fan. Let me explain. I grew up near Ann Arbor, MI. We'd usually go to a few Detroit Tigers games per year, though I don't remember going to any games until after they won the 1984 World Series. I remember players like Chet Lemon, Alan Trammel, and Jack Morris. I remember the old Tiger Stadium. I remember that most years, the Tigers stunk, and didn't make it to the playoffs. In fact, they haven't been in the playoffs since 1987. I suppose it's no wonder, then, that I never declared myself a true fan. So when they squeaked into the playoffs this year (after blowing a rather large lead towards the end of the season) and were matched up against the New York Yankees, I didn't give them much chance of advancing. But they did! Then, they swept (yes, swept) the Oakland A's by winning 4 games in a row, and advanced to the World Series, where they await the winner of the NY Mets and St. Louis Cardinals. Could this be their year? I mentioned to my wife the other day that I hadn't heard of the names of any of the players, and her comment was that meant that they were a true team, with no real standout players. I think that's pretty accurate. Go Tigers!

Outlook Delegates issues

2006-10-04T15:34:00.000-05:00

If you aren't familiar with the Outlook Delegates functionality, it provides you with the ability to specify a Delegate for your Mailbox. Delegates can perform items such as sending items on your behalf, and responding the meeting requests, etc. When you add a delegate, you can specify that they receive copies of your meeting requests, which is quite typical.

Now, say you have a few delegates, and one of them leaves the company. Your IT staff diligently deletes the account (and mailbox). However, all of a sudden, meeting requests to you now generate an NDR. The cause? Delegates. For whatever reason, Outlook stores delegates separately (they are actually stored as a hidden rule on your mailbox), so that if you delete a user account that was set as a delegate, Outlook doesn't automatically remove that delegate. Ok - this is easily fixed. You need to go into Outlook, Tools, Options, Delegates, and remove the non-existent user.

What if you've already done that, and nothing shows up in the Delegates tab?
http://support.microsoft.com/kb/253557/en-us comes to the rescue. The KB article talks about a little different situation, but one that applies nonetheless. The problem is that this "hidden" rule has become stranded. You can't see it (with Outlook), but it's still there, and still functioning. The solution is to use the Mdbview utility to log on to your mailbox. If you've never used mdbview before, a word of caution is that the output is pretty ugly! Anyways, after logging on to your mailbox, the instructions have you go to your inbox and find the message that has Schedule + EMS Interface in the description, and then delete that message. Normally, this should remove the delegation, but you still want to go back into your Outlook settings and check. In some cases, you may now see an Unknown account in the delegation, at which point you can remove it.

SBS Migration hell

2006-10-04T11:00:00.000-05:00

I recently helped a friend with a swing migration from one (really old) SBS 2003 server to another (new) SBS 2003 server. As there is currently NO process provided by Microsoft to migrate SBS servers (at least none that I am aware of), my friend had purchased the SBS Swing It Kit, provided by Jeff Middleton (SBS MVP) to assist us in this project.

SBS (Small Business Server), if you haven't worked with it before, is designed for small businesses and is also designed to run on 1 server. As such, your 1 SBS server is set up to host many roles on the same box - we're talking Active Directory, Exchange, SQL, Sharepoint, and optionally, ISA and some others. There are license limits in place that only allow you to have a certain number of clients (I want to say 75?), which is why it should only be used for small businesses.

On to our experience. The SBS box in question was just running SBS Standard, which probably made it a "little" bit easier, but not much. A brief overview of the swing migration process is that you have to bring up a temporary DC, transfer everything to that, remove all references to the existing DC, then add your new server (which has the same name as the old server) back in. This by no means details all of the steps involved (which are quite numerous), so I'd encourage you to check out the Swing It kit previously mentioned if you have to go through this process. Anyways - adding the new server didn't pose any problems. AD and DNS replicated with no issues and we were able to do the things we needed. The problems began when we tried to add the new server (with the same name as the old one). We couldn't get AD to replicate. After a few hours of mucking around, we found the issue. Ready? It was the Windows Firewall service! Why on earth the Windows Firewall would decide to prevent Active Directory replication is beyond me, but it did. Once the service was disabled, replication took place within a few minutes and we could then proceed.

Probably the most difficult part about a migration like this is getting the Exchange data transferred. Luckily, as long as the server name (along with a few other things) is the same, you should be able to mount the database from the old server with no issues. I've done this several times for regular Exchange servers, and it's the method that you used to have to follow with Exchange 2000 (build recovery Exchange server in a new forest that has same name, same admin group, same database name, etc.). However, another catch was that there hadn't been a successful full backup in a few weeks, so there were LOTS of log files. To be on the safe side, we brought those over as well, even though the stores were in a clean shutdown state. The biggest nightmare for us was actually getting the stores to mount, though. Let me state for the record here that at 4am in the morning, patience is not my strong suit.

I had applied Exchange 2003 SP2 while I was still copying the databases and log files from the old server to the new one (hooked up old drive via USB 2.0 enclosure), and even though the stores were dismounted when I ran the SP, after it was done, it tried to mount the stores, and replay all the log files. This *obviously* wasn't going to work, as the databases didn't even exist yet! Anyways, to make a long story short, I killed the store.exe process so the SP install would finish. Once that was done, and the stores and logs were transferred, I tried to mount the stores, only to have it fail with some comical error about files not being in the right state, or some such nonsense. I re-transferred the databases and logs again, and verified the databases were still in a clean shutdown state (eseutil /mh), but no dice. Running out of time, I thought I'd try to re-run SP2 and see if something had gotten mucked up the last time. This time, like the last, it replayed all the log files, then it purged them (I don't think I've ever seen an SP purge log files - hehe). With that done, all I had to do was mark the databases as being able to be overwritten, then I was able to mount them successfully.

The other problem we encountered was with the migration of the shares. Because there was a lot of data in the user shares, we decided we didn't have enough time to move the data, so we hooked up the old hard drive into the new server, and re-created the shares. Though I could have sworn that we checked, apparently the new share for the User Shared Files (where My Documents gets redirected to) was set to share perms of Read only. Remember that Windows uses the most restrictive set of permissions when you are accessing a share, so even if you have full control at the NTFS level, if your share permissions are read-only, you aren't going to be writing anything to that share, bucko. That was easy enough to clear up.

Sooo - 12 hours, and a severe case of sleep-deprivation later, migration is done. A few minor problems cropped up later on, but my friend was able to take care of those.

My observations:
1. Why in the world does an SBS migration have to be this difficult?
2. Has anyone at Microsoft tried to migrate SBS servers? If so, do they expect small businesses to ever do this without hiring an sbs expert?
3. I don't like SBS. I really don't. Some people love it. I'm not one of them. It felt like a very dummified [1] version of Windows Server 2003, with wizards galore, and progress bars that leave no indication of what exactly it is doing.

I've promised myself to never touch another SBS server, and above all to never do another SBS migration. I'll leave those to the SBS experts, something which I don't claim to be.

[1] I think I just made up a word.

Status Change for me

2006-10-04T10:56:00.000-05:00

As of Monday, Oct. 2nd, I have now joined Microsoft as an Exchange Support Engineer. I'm not sure yet what that means for this blog, so for the time being, I will continue to post new content here. If the location of my blog changes in the future, I'll be sure to post an update.

UM Kit offer from the Exchange team

2006-09-26T08:23:00.000-05:00

Are you part of the Exchange 2007 Beta, but haven't deployed the Unified Messaging bit because you don't have a VOIP gateway that you can integrate it with? Have no fear. Thanks to the effors of the folks on the Exchange team, for a limited time you can purchase a trial kit for $1000 that includes not only an analog IP Gateway, it also includes a full 2 hours of support to help get it set up and working with Exchange 2007.

One thing to note - the actual hardware costs far less than $1000. You can pick up the same piece of hardware (Audiocodes MediaPack 114 FXO) for ~$450, which means that the phone consultation bit is rather expensive. If you haven't had any experience with VOIP or setting up a VOIP gateway, this still might be a good deal, but if you have experience, I'd recommend just getting the hardware yourself and setting it up. The Exchange help file (and online documentation) is very good when it comes to information about UM. There are lots of places where you can get the VOIP gateway (note that currently, there are only 2 such gateways that are supported as being compatible for testing). Here are some links where you can get the VOIP gateway.
http://voipstore.atacomm.com/Shops/ViewItem.aspx/27934028032-52860297728.htm
http://var.abptech.com/s.nl;jsessionid=ac112b1d1f4359efdc791061472482498084a4762294.e3iKaNePch4Re38LaNuRa38Ka3f0n6jAmljGr5XDqQLvpAe?sc=2&category=5
http://www.voiplink.com/Audiocodes_MP_114_FXO_p/audiocodes-mp-114-fxo.htm
http://www.thevoipconnection.com/store/catalog/product_16313_AudioCodes_MP1144_FXO_4_Line_Gateway.html

Office 2007 Beta2 Tech Refresh is out

2006-09-15T11:25:00.000-05:00

Yesterday, Microsoft released the Beta2 Technical Refresh of Office 2007, and indicated that it would be free to download from the Microsoft Download Center. The main difference is that you must already have Beta2 installed (vs. removing the previous version).

I installed it yesterday afternoon (directly after downloading). Following completion of the install, I was required to reboot my computer. The first thing I noticed? There is a new theme available. Silver. Woohoo! I was sick of using the Slate Gray theme (it makes everything look darker), and couldn't stand the sky blue theme, so this was a welcome change. Also, since I use the Silver theme in XP, it blends right in.

Second, some of the UI has been changed. It seems like the Office button has been resized (smaller - about half the size it used to be). I still have a problem with my Word in that every time I open a new document, it starts with the zoom level at 10%, but I suspect that is more an issue with my computer, as I can't reproduce it on other computers. I'm also bummed that I apparently still have a problem with Outlook unable to act on mailto: links, but again, I think that's a problem with my computer, because it's not reproducible.

Third, icons (and splash screens) have been changed. They now feature a more updated, modern look, though so far I'm not extremely fond of the splash screen (it appears to be the same basic splash screen for ALL products, with just the name of the product being different

I'll be testing this out for the next while, but so far, I like the other UI changes. I haven't noticed much in the way of change in how the product works, but that could be simply because I am dense... :-)

Which gaming console is the best?

2006-09-14T10:07:00.000-05:00

There are lots of varying opinions out there, and each manufacturer states their console is the best (ok, with probably the exception of Nintendo, whom I haven't heard a lot of "smack" from).

The obvious players in the gaming console are the following:

Microsoft Xbox 360
Sony PS3
Nintendo Wii

let's do a quick comparison of the 3 and some of their basic features.

	Xbox 360	PS3	Wii
Price	$299 Core/$399 Premium	$499/$599	$250
CD player	Standard DVD-Rom/HD-DVD optional accessory	Blu-Ray DVD Standard	Standard DVD player
Hard drive?	None/20GB	20GB/60GB	None

At first glance, the PS3 wins out in the features category, but does it justify the $200 premium over the 360, and even more over the Wii? That's for you to decide.

Also, note that I left out the processor/video specs. While there is much hype about the Cell processor in the PS3, I have to date seen nothing that indicates it will soundly trounce everything out there. In fact, it seems like each time there is an update, revised specs are released that show lower capabilities.

As far as availability, the XBox360 has the obvious advantage here. It's already been out for a year, and will have the most games available.

All 3 systems claim to be backwards-compatible with previous games, though the XBox 360 requires the hard drive (or a memory module) in order work with Xbox games, as they store information on the hard drive on the original XBox.

Nintendo clearly has the most innovative design for their controller, but it really remains to be seen if it will be accepted or not. Sony and Microsoft have stayed the conventional route with their controllers.

All 3 systems will be touting online gaming capability, but I'd give the edge to the 360 here as well. XBox Live is a well-established service, and has been around for several years. There is a subscription cost, but at ~$50/year, it's a relative bargain. Last I'd heard, the online gaming from both Sony and Nintendo will be free, but I don't think they really have much choice here. In order to get an online gaming forum up and running, you can't really start charging at the onset, or you won't get near as many people to join.

So - which one would I buy? I certainly won't put out $500 or $600 for the PS3. I paid $150 for my original XBox, and I'm not willing to quadruple the cost of that to satisfy my gaming craves. That leaves the Xbox 360 and the Wii. The 360 has been out longer, and is likely to drop in price sooner (at least I think it will), and since I've already got an XBox, my likely choice will be the 360, though I won't be rushing out tomorrow to get one. Which console others will choose may depend on the current gaming console they own. If you have a PS2, my guess is that you'd be more likely to get a PS3 and be able to play all games from it instead of having 2 separate consoles. However, Sony is going to have a distribution problem with the PS3. The launch date here in the US (and in Japan) is supposed to be mid-November, but reports I've heard indicate they are going to have limited numbers of units available for the US and Japan (Europe's launch date has even been postponed until Spring of 2007). This means the mark-up by retailers could be quite a bit.

Time will tell how this next generation of gaming console wars turns out.

550 relaying denied for local domains

2006-09-08T14:34:00.000-05:00

Have you ever experienced your Exchange server suddenly (or not) rejecting all messages destined for local domains (i.e. the ones listed in your recipient policies)? Here are a couple of things you can check to see what is going on.

First, manually telnet to your Exchange server on port 25, and attempt to send a message. I won't go through all of the commands, but the Rcpt to: command is the most important here. If you are seeing this problem, as soon as you enter the rcpt to: command and enter the e-mail address of a user in that domain, you will see the 550 relaying denied message. A little trick here is that with Exchange 2000 and 2003, you can actually get away with just typing the username. For example, instead of typing

rcpt to: user@domain.com

you would type

rcpt to: user

When you do this, Exchange 2000 and 2003 will automatically append the smtp domain information and convert it to user@domain.com. In this case, performing this action resulted in Exchange returning user@sub.domain.com, which was not a part of recipient policies.

This gave me a clue as to what the problem might be, and leads to the next part.

Open Internet Information Services Manager, and expand your server name and check for the existance of an SMTP Virtual server in there. See, when you install Exchange, it requires SMTP to be installed, but during the installation, it takes over ownership (and managing) of the SMTP bit. In other words, SMTP should not show up in IIS Manager. If it does, then you know that Exchange isn't managing SMTP as it should. Fortunately, the solution to this problem is fairly easy.

If you have uninstalled/reinstalled IIS, then you have to reinstall Exchange. This is done simply by re-running Exchange setup and choosing Reinstall from the drop-down box for the install options. Don't worry - this doesn't touch the databases, it just reinstalls the Exchange binaries (\Exchsrvr\bin). Upon completion of this step, you would then need to reinstall any Exchange service packs and hotfixes.

If you have only uninstalled/reinstalled the SMTP component, then it's even easier. By following the instructions in http://support.microsoft.com/kb/290290/EN-US/, you can run smtpreinstall.exe and fix the relationship between Exchange and SMTP.

As also mentioned in the article, the other clue that will guide you to this conclusion is if there are missing SMTP verbs. When you type the EHLO command into your telnet session, all of the supported SMTP verbs will be listed.

If you don't see the following, then the Exchange verbs are not present, and you need to follow the above instructions to repair it.
250-X-EXPS GSSAPI NTLM LOGIN
250-X-EXPS=LOGIN
250-AUTH GSSAPI NTLM LOGIN
250-AUTH=LOGIN
250-XEXCH50
250-X-LINK2STATE

Fixing Suspect SQL databases

2006-09-07T22:13:00.000-05:00

Disclaimer: This probably should not be done on a production system! I have several SQL servers for use by our Developers, and none of them have any critical data on them. If you have a database that has been marked suspect by SQL, the best course of action that I am aware of is always to restore your data from backup.

I used the instructions provided byPaul Randal, who is a Lead Program Manager for SQL, at http://blogs.msdn.com/sqlserverstorageengine/archive/2006/06/06/619304.aspx

In my case, the problem database was the msdb database. With this db marked as suspect, the SQL Agent service would not start. Checking the SQL Agent log indicated this was the reason. As Paul mentions, since msdb is a system database, you can't repair it like you would others. In order to fix this problem, I had to start SQL by using:

start sqlservr.exe -c -T3608

This starts up SQL in a special mode where it only attaches to the master database. You can then run the instmsdb sql script to reinstall the msdb database. Running this script will first detach, then remove the msdb database files, then re-create and re-populate them. The proceure for doing this is quite simple. From the \sql\install directory, run the following command.

osql -E -S servername -i instmsdb.sql

Note: when you start SQL with this flag, the SQL service itself does not appear started. Instead, a separate cmd window will pop up with the SQL information. When you are ready to exit, you can simply hit Ctrl-C. You will then see a prompt asking you if you want to shut down the SQL server.

Wait a while (it took approx. 5 minutes for mine) and once it completes, stop and restart the SQL service so that it is no longer running in this special mode, and you should be all set. With this procedure completed, we were able to start the SQL agent without problems.

Fixing a cluster that is offline

2006-09-07T20:01:00.000-05:00

What do you do when you have a cluster that is completely offline? Have you ever encountered this problem? If so, you will know that you cannot manage your cluster using Cluster Administrator. In order to do so, Cluster Administrator must make a connection to the cluster - kind of hard if it's offline :-)

So, what to do? Well, you pull out your trusty cluster.exe command-line tool. Using cluster.exe, you can query for the status of the resources in your cluster by simply typing the command:

cluster.exe res

This will enumerate and list all resources as well as their status. From here you can bring an individual resource online (or fail it). For example, if your Cluster Network Name is offline, you can type

cluster.exe res "Cluster Network Name" /online

or

cluster.exe res "Cluster Network Name" /fail

Once the Network Name and IP address resources are online, you can continue by using the Cluster Administrator tool.

A 4 yr old's harcut!

2006-08-22T14:11:00.000-05:00

And now for a post on the Family front.

We don't need to guess where she learned this from - her older sister has attempted to cut her own hair twice now. Pictures posted in order are:

1. Before the cut. Her hair went *almost* down to her waist.

2. The cut

The second picture doesn't really do justice - she also did a hack job on her bangs. After this, my wife had to take her to a real hair stylist to have it fixed. The "After" pictures:

Of course, she's still CUTE! I'm not sure what possessed her to want to cut her hair, but what's done is done. If you're wondering where they get the scissors from, we do have them put away up in a cupboard, but as you know, 4 yr olds and 6 yr olds are resourceful little buggers! :-)

Microsoft UK: Office Clips

2006-08-22T11:16:00.000-05:00

ROFL!

Link to Microsoft UK: Office Clips

I just viewed these, and they are hilarious. Make sure that you watch all the way until the end - there are some funny outtakes included.

Creating a new mailbox using Powershell and specifying the password

2006-08-22T10:57:00.000-05:00

So you want to create a new mailbox with Exchange 2007. No biggie - you can create it either using the Management Console (GUI), or via the Management Shell (Powershell). That's boring, though. What if you want to create it via the Shell AND specify the password? Ok - let's do it.

First, let's take a look at the Help for the new-mailbox command usage.

New-Mailbox -Name <String> -Database <DatabaseIdParameter> -OrganizationalUnit <OrganizationalUnitIdParameter> -Password <SecureString> -UserPrincipalName <String> [-Alias <String>] [-DisplayName <String>] [-DomainController <String>] [-FirstName <String>] [-Initials <String>] [-LastName <String>] [-ManagedFolderMailboxPolicy <MailboxPolicyIdParameter>] [-MobileMailboxPolicy <MailboxPolicyIdParameter>] [-ResetPasswordOnNextLogon <$true | $false>] [-SamAccountName <String>] [-TemplateInstance <MshObject>]

Notice that the -Password option needs to be entered as a Secure String. That means that you cannot enter it as plain text during the command. Now, let's take a look at one of the examples provided in the help.

EXAMPLE

$password = Read-Host "Enter password" -AsSecureString

New-mailbox -UserPrincipalName chris@contoso.com -alias chris -database "Storage Group 1\Mailbox Database 1" -Name ChrisAshton -OrganizationalUnit Users -password $password -FirstName Chris -LastName Ashton -DisplayName "Chris Ashton"

This example shows how to create a new mailbox using the -password option. Note that the password is not actually set to $password. Rather, $password is a variable that has been set by the first command. As I mentioned, when you enter the password, it cannot be in plain text. If you try to, you'll receive the following error.

New-Mailbox : Cannot bind parameter 'Password'. Cannot convert value "password" to type "System.Security.SecureString". Error: "Invalid cast from 'System.String' to 'System.Security.SecureString'."
At line:1 char:70

As indicated in the example, you need to define the $password variable. This is done by using the first string from the example. When you run the command

$password = Read-Host "Enter password" -AsSecureString

you will be presented with a prompt stating

Enter password: ********** (note that the password I entered is entered as a secure string - the text is hidden with asterisks)

Once you've entered this password, it's stored as a secure string. You now just need to specify the password using the $password variable you've defined. The downside to this method is that you would have to use the same password for each user that you created using this variable. Note that the following fields are required when creating a new user account. Also note that if you are creating a linked mailbox, a shared mailbox, or a resource mailbox, a password is not required as the account will be disabled.

Password
Database
UserPrincipalName
Name
OrganizationalUnit

Everything else is optional.

More on Windows Mobile, Certificate Checking and the continual password prompt

2006-08-21T14:01:00.000-05:00

It seems that my post on "Hacking your Windows Mobile 5.0 Registry" gets read a lot. In fact, about 50% of the traffic to my blog comes from visits to that page (most of it from search engine referrals). Based on some comments, though, I feel like I need to clarify something.

The main reason that I blogged about the ability to disable certificate checking in Windows Mobile 5.0 is because I use a Wildcard certificate (*.company.com) at my current company. Unfortunately, wildcard certs are NOT supported in Windows Mobile 5.0. This means that even if the certificate is installed properly, Windows Mobile 5.0 will not properly use it and will instead display an error stating that an invalid certificate is installed. In order to get synchronization working with MY environment, I had to disable certificate checking. This still allows me to use SSL, but it tells Windows Mobile not to check if the certificate is valid (basically, the hostname doesn't have to match).

However, if you are using a self-signed certificate (generated by an internal Certificate Authority), there is NO need to add this registry key. Windows Mobile 5.0 fully supports self-signed certs, and has made it MUCH easier to install your own certificate. An abundance of posts provide helpful information on how to install a certificate on Windows Mobile 5.0 in many different ways, from copying and clicking a .cer file, to installing as a .cab file, to installing using a signed version of the spaddcert.exe tool (Sprint and Verizon). Think of it this way. If you are using a self-signed cert for, say, OWA access, what happens when an external client tries to log in to OWA? Internet Explorer indicates there is a problem with the certificate. How do you get around that certificate error popping up each time you visit the page? You install your certificate into IE's certificate store as a Trusted Root Certificate Authority. The same action is required with Windows Mobile, with the exception that if you want to synchronize at ALL using SSL, you have to install the cert (or disable SSL - not recommended).

What prompted this post? I've had some questions about the original post that indicated folks had disabled certificate checking, only to be continually prompted for a password. That's annoying! (the continual password prompt, not the questions!). The common thread I've seen in each case so far, though, was that the issue was one with the certificate. In at least one case, disabling SSL (as a test) allowed sychronization to work (a sure sign that the issue is with the cert).

What do you do if you are continually being prompted for a password? Here is a list of things to check.

1. Are you sure that you have installed your certificate as a root certificate on your Windows Mobile device? Windows Mobile devices also have a certificate store, which is viewable by the user. Check your device for the exact location (I believe it may display in a different location depending on if you have a PocketPC-based device, or a Smartphone-based device), and make sure that your certificate shows up there.

2. Have you made sure that the server name in the ActiveSync settings *exactly* matches the one that's on the cert? This is what disabling certificate checking is supposed to fix (a wildcard cert won't match exactly), but since disabling cert checking does decrease security, it shouldn't be done unless absolutely necessary.

3. If you disable SSL on your Windows Mobile device, does synchronization work and your password get accepted?

4. Does the name of the server you are entering in ActiveSync exist in external and internal DNS?

5. Have you made sure that your cert is indeed valid, and not expired? IE should show you any issues from this side of things.

If I can think of anything else, I'll edit this post. I've also asked the folks on the Windows Mobile blog to comment on what might cause the looping password.

Accessing another mailbox via OWA – Exchange 2003 vs. Exchange 2007

2006-08-11T10:45:00.000-05:00

No doubt many of you know how to access another user's mailbox via OWA when using Exchange 2003 (or prior).

To refresh your memory, the format that is used in Exchange 2003 is

http(s)://server.domain.com/exchange/aliasofusertoopen

This will result in you being prompted for your credentials, and as long as you have full mailbox rights, you'll be able to open that mailbox. You can also specify to only open a specific folder, for example:

http(s)://server.domain.com/exchange/aliasofusertoopen/calendar

In Exchange 2007, this method of access no longer works. Exchange 2007 changed the OWA interface yet again (but for the better, I promise!), so the method for accessing another mailbox has also changed. The main change here is that you no longer use the /exchange vdir. Instead, there is a new /owa vdir that gives you the new interface. I had previously though that you could still use the old /exchange directory (it still exists!), but it appears that /exchange simply redirects you to the /owa directory. With these changes, you now have 2 options.

First, you can use the slick new interface within OWA to open another mailbox (I've briefly mentioned this in the past. The attached picture shows how you open another mailbox. Note that in OWA, your mailbox name will be displayed in the upper right-hand corner, with a drop-down menu. Clicking on your name will bring up the dialog box as shown in the picture. You simply type in the name of the mailbox you want to open, and then click the Open button. As long as you have rights to the other mailbox (I've already covered how to grant rights to other mailboxes in previous posts), the other mailbox will then open up in another window.

If you don't want to open the entire mailbox, it is still possible to open just a single folder, but the URL structure is different. Thanks to KC Lemson, and Tim McMichael for taking the time to look up this information.

The URL format you would use to open another user's calendar is as follows:

http://server.domain.com/owa/user1@domain.com/?cmd=contents&module=calendar

where user1@domain.com is the other mailbox that you want to open, and module=calendar indicates that you want to open the calendar. Other modules you could specify include inbox, contacts, etc.

After you hit go/enter, you will be prompted for your credentials to log on to user1's calendar. Worth noting here is that in the beta2 build at least, even though I've enabled Forms-based authentication with the ability to log on with only the username, in order to make the above work, I had to either log on using domain\username, or user@domain.com.

Changing DSN and other Quota messages with Exchange 2007

2006-08-01T22:06:00.000-05:00

Many an admin has wondered if DSN (Delivery Status Notifications – Message Delays and NDRs) messages, or Over-the-limit quota messages could be modified. In versions of Exchange prior to Exchange 2007, the answer has always been no, or at least there was no official supported way to do this. I've seen a few utilities to modify the quota messages, but definitely nothing to modify the DSN messages. Thankfully, with Exchange 2007, you now have the ability to add/modify TONS of this information. A few examples.

Modify DSN messages.

Exchange allows you to modify two type of DSN messages. Those associated with 4.x.x error codes (400-level errors codes are transient, retry-able error codes – something like 421 service not available), and those associated with 5.x.x error codes (500-level error codes are permanent fatal errors – like 550 relay denied)

The usage of the MSH command to modify a System DSN is as follows. We'll change the relaying denied message (that's my favorite).

The format of this command is:

New-SystemMessage -DsnCode <EnhancedStatusCode>-Internal <$true | $false> -Language <CultureInfo>-Text String> [-DomainController <String>] [-TemplateInstance <MshObject>]

Following that format, we input the following:

New-SystemMessage -DsnCode 5.7.1 -Language En -Internal $false -Text "Whatever text you want to put in here"

Once you hit Enter, it will now save it as a Custom DSN message for the DSN code that you specified.

If you later want to remove your custom DSN message, you can either issue the command

Set-SystemMessage –identity –original $true, where an example of the identity would be En\External\5.7.1

Modify Quota Messages

Ok – there are several different quota messages that can be configured, including:

* WarningMailboxUnlimitedSize Issued when a mailbox that has no prohibit send quota or prohibit receive quota exceeds the specified mailbox warning limit.* WarningPublicFolderUnlimitedSizeIssued when a public folder that has no prohibit send quota or prohibit receive quota exceeds the specified public folder warning limit.* WarningMailboxIssued when a mailbox that has a prohibit send quota or prohibit receive quota exceeds the specified mailbox warning limit.* WarningPublicFolderIssued when a public folder that has a prohibit send quota or prohibit receive quota exceeds the specified public folder warning limit.* ProhibitSendMailboxIssued when a mailbox that has a prohibit send quota exceeds the specified mailbox size limit.* ProhibitPostPublicFolderIssued when a public folder that has a prohibit send quota exceeds the specified public folder size limit.* ProhibitSendReceiveMailBoxIssued when a mailbox that has prohibit send quota and prohibit receive quota exceeds the specified mailbox send and receive size limit.

The format of the command is:

New-SystemMessage -QuotaMessageType <QuotaMessage> -Language En -Text "Text string"

As an example, if you want to change the quota message that applies to mailboxes that have a limit that prohibits both sending and receiving mail, you would use the following command.

New-SystemMessage –QuotaMessageType ProhibitSendReceiveMailbox –Language En –Text "Put your text in here"

Have fun with these! I for one am glad that this capability will now be present in Exchange.

Replying to posts or messages in Public Folders from OWA

2006-07-31T10:45:00.000-05:00

Do you remember Exchange 5.5? Where messages that were delivered to Public Folders had the same message class (IPM.Note) as messages delivered to mailboxes? Ahhh – that was nice.

How about how Exchange 2000 changed it so that messages from the Internet to mail-enabled Public Folders defaulted to a message class of IPM.Post? I thought I'd blogged about this before, but apparently not. For those not aware of this, a quick overview is that Public Folder functionality changed with Exchange 2000. Messages sent internally to a mail-enabled public folder retained the message class of IPM.Note (standard message class), but any messages sent from an outside source were converted to a message class of IPM.Post (Message Post class), which causes some issues for clients attempting to reply to those messages, especially from OWA (there is no reply functionality). Outlook seems to handle it better (or at least Outlook 2007 does) and still gives you the ability to reply to a post within a public folder.

Microsoft released a KB article that addressed this issue (I think a lot of people complained about it…) in KB 817809, which allows you to basically set a registry value on your server, and change the behavior back to what many people would consider "normal" behavior, by modifying the PR_MESSAGE_CLASS field and changing it back to IPM.Note. This helps Outlook clients (and OWA clients for that matter) in that items now appear as messages instead of posts, but OWA still has a major problem in that you still can't reply or forward those items. The jist of it is that in order to reply or forward items in public folders in Exchange 2003, you need to have a Front-end server deployed. See http://support.microsoft.com/kb/822178 for details on the requirements to use different features in Exchange 2003.

Bottom line here is that if you require the functionality of being able to reply or forward messages (ipm.post or ipm.note) other than "Post reply to this folder", then you unfortunately have to deploy a Front-end server. At least one bit of good news is that with Exchange 2003, you can use Exchange 2003 Standard edition for that Front-end server, instead of having to use Enterprise edition (as Exchange 2000 Front-end servers required).

How to save your cluster from a failed quorum drive

2006-07-25T16:46:00.000-05:00

I first have to add a disclaimer that this cluster was a development system, so the data on it was of relatively little use. I also have to add that the configuration of this system in no way shape or form would mirror anything I would allow to be put into production.

Tip 1: Make sure that your Quorum drive (assuming it is not a local quorum) is on a RAID volume. This particular cluster uses iSCSI as its SAN. When the iSCSI server was initially set up (not by me), no RAID was used. I knew that it would eventually have to be changed, but due to the setup, I just kept pushing it off because, well, I didn't want to have to redo the entire cluster. Of course, one of the hard drives in the system failed. After letting the cluster sit for a while (offline, of course), I decided to tackle it and get it fixed. The first priority was getting the iSCSI server fixed. It was set up properly, with a RAID5 array for the hosts to use.

Tip 2: Make sure that you have the Windows (2003) Resource Kit downloaded and installed. There are some awesome utilities included in the Resource Kit. If you've worked with Windows long enough, you'd remember that there used to be actual Books and CD's for resource kit materials, and they weren't free! Thankfully, the Windows 2003 Resource Kit tools are freely downloadable. They came in VERY handy!

Armed with my knowledge, and my l337 searching skills, I began to search for how to fix my problem. In this case, I couldn't even start the cluster service. Attempting to do so generated an error indicating that the drive signature that was expected for the quorum couldn't be found. Duh. It wasn't coming back, either! Anyway, I came across several articles (Thanks to EventID.net) that helped me with this. The error I was seeing was event 1034 with a source of ClusSvc. Here are some of the resources I consulted.

http://technet2.microsoft.com/WindowsServer/en/Library/b410b421-78a5-4b3f-9247-e4f248f878fc1033.mspx?mfr=true http://technet2.microsoft.com/WindowsServer/en/Library/e2e5674c-0625-4aba-afee-0c7057f8ac2e1033.mspx?mfr=true http://technet2.microsoft.com/WindowsServer/en/library/3974d0c5-1c3f-4dce-921c-2859a8abd8ae1033.mspx?mfr=true

With the help of these articles, I was able to start up the cluster service with the /fixquorum switch (to do this, from a command prompt, use net start clussvc.exe /fixquorum), which allows the cluster service to be started. As anyone who works with clusters understands, until that cluster service is started, there really isn't much that can be done. With the cluster service started, I was then able to create a new physical disk resource, and then use the clusterrecovery tool, which is available in the aforementioned Windows 2003 Resource Kit utilities (Free download). The clusterrecovery tool allows you to replace a failed quorum drive by choosing another physical disk resource to replace it with. Once it does it's magic, it appends (lost) to the old Quorum resource and instructs you to delete it.

Of note is that once you are done with this maintenance, you need to restart the cluster service, otherwise it will continue running in the fixquorum state. Also of note here is that when replacing the quorum disk using clusterrecovery, ALL resources must be in an offline state (or failed, as it was in my case – hehe). Because of this, when you try to connect to the cluster, you must specify the physical node name as the cluster name, not the actual cluster virtual name (the Network Name resource is offline, so the cluster virtual name won't respond).

All done with this, I tested failing over to the other node to make sure that the resources all came online – they did. I then went about fixing the Exchange Virtual server, which was much easier. I'm pretty sure that I've blogged about that in the past, so I'll skip it this time, other than to say that the physical disk the Exchange virtual server was using had also failed (NEVER use RAID0 on a production server!), so I went through the process of creating a new physical disk resource for that, then deleting/re-creating the Exchange System Attendant Resource to fix the MS Search problems. I lost all the databases for that virtual server, but again, since it was a dev system, the data really didn't matter.

Remember to sign up for Exchange 2007 Beta2!

2006-07-18T10:29:00.000-05:00

The Exchange 2007 Beta2 program is going to be a Public Beta. Everyone who signs up will be accepted into the program and given access to the media, so if you have any interest at all in Exchange 2007 and the changes that will be coming, make sure that you remember to sign up. Indications are that Beta2 will be available at the end of July.

http://www.microsoft.com/exchange/preview/default.mspx

In addition, you can now find all the most up-to-date technical documentation for Exchange 2007 online, and there are also other great resources such as sample Monad (PowerShell) scripts.

How does Dell do it?

2006-07-18T09:57:00.000-05:00

I suppose the bigger question is how much money they are losing on each laptop purchase, and will prices go up once they've garnered a larger market share?

Currently, Dell is running a special on their Inspiron 6400 line of laptops (expires tomorrow) for Small Businesses. Their 6400 with a DuoCore processor (1.6Ghz), 1GB ram, 80GB hard drive and DVD+/-RW (Dual layer even) is starting at ~~$604~~ $699. I ask again, how can they do that without taking a loss on each sale? Or compromising quality? That's a pretty darn low price for a laptop, and though the Inspiron's are really geared more towards home users, I like them and like the way they look. They are a little bigger and heavier than their Latitude counterparts, but Dell has been touting these as desktop replacement systems, so probably the thinking is that you won't have to lug it around as much. Even if you do, at ~6lbs, it really isn't that bad.

My Father-in-law recently experienced a problem with his Inspiron 6000 where the network card was having issues. That escalated into more severe problems that seemed to point to a faulty mainboard. It's finally getting fixed, but it does sort of highlight the above question, though I know several other people that own Inspiron 6000's (my mother being one), and haven't heard of any widespread issues with them.

One thing to note is that the default warranty that comes with these laptops is a 1 year economy on-site warranty, so perhaps that is part of why the low cost. However, I'm a firm believer that if there are going to be serious problems, they will usually crop up fairly early.

Bottom line here is that if you are in the market for a mid-level laptop, it looks like Dell wants your business pretty bad.

Update: The price has been changed and is now $699, not $604. Possibly it was a pricing mistake.

Registry Settings for Windows Mobile devices

2006-07-17T10:50:00.000-05:00

Here's another post in my series about Windows Mobile devices. My last post talked about frustrations with the Q. Those issues never got fully resolved, but I'm not as concerned about them, because I don't own the device, and I haven't been asked to get it working.

I did find some interesting information, though. I feel rather fortunate that my device is completely unlocked, so I can muck with all the settings I want. For those that don't have unlocked devices, there may be *some* hope.

MSDN contains information on the Default Security Policy settings for both Windows Mobile Pocket PC's and Windows Mobile-based Smartphones. Check them out! Of interest is the section referring to the Grant Manager settings. I had seen several comments on the Windows Mobile team blog that referred to changing the registry key value in HKLM\Security\Policies\Policies\00001017 from the default of 128 to 144 and that this would aid in being able to install certificates, but didn't quite understand why that would make a difference until I read the MSDN documentation. The MSDN article indicates that the registry key 00001017 is the setting for the Grant Manager Policy, which basically defines which roles are granted system administrative authority. To understand these settings, let's look first at what the different roles are (there are actually a few more which are listed in the link below, but I don't think they are particularly relevant):

Security Role	Registry Key Value (Decimal)
SECROLE_OPERATOR_TPS	128
SECROLE_PPG_TRUSTED	2048
SECROLE_PPG_AUTH	1024
SECROLE_TRUSTED_PPG	512
SECROLE_USER_AUTH	16
SECROLE_MANAGER	8
SECROLE_OPERATOR	4

The thing to understand about registry settings such as these is that they can be used singularly, or in combination. When you look at the value of the key, it represents all settings that are enabled. By default, on non-phone based devices (Pocket PC only), the default setting (outlined in the MSDN article) is actually set to Decimal 16 (Hex of 0x000010), which equates to SECROLE_USER_AUTH. On phone-based devices (Pocket PC Phone edition and Smartphones), however, it defaults to Decimal 128 (Hex 0x000080), which is SECROLE_OPERATOR_TPS. By changing the value to Decimal 144 (Hex 0x000090), what you are actually doing is enabling both SECROLE_OPERATOR_TPS and SECROLE_USER_AUTH (128+16 = 144). In the same section of the MSDN site, another page describes the various security roles.

The only bit of advice I feel compelled to share here is to make sure that you document any settings when you make changes. There is nothing worse than knowing you changed something, but forgetting where it was you made the change, and what the default value was, especially when it is causing problems.

Verizon, what have you done with the Q?

2006-07-13T14:42:00.000-05:00

I now understand what the comments were talking about in my earlier blog about being continually prompted for the password when attempting to get Exchange ActiveSync up and working.

I tried to get a Motorola Q working via Exchange ActiveSync today, and could not get it working. I tried everything I had done with my device, including adding the registry key (remember, we use a wildcard cert), and attempting to install our cert. Verizon has apparently locked down being able to just add certs the normal way with Windows Mobile 5 (BOOOOOO!!!), and requires you to use the old spaddcert.exe tool, which apparently won't let you add just any cert. When I tried adding ours, it kept telling me that it wasn't a valid root certificate.

Anyways, modifying the registry key (HKEY_CURRENT_USER\Software\Microsoft\ActiveSync\Partners\Partnership for Exchange server) and adding the key of secure=0 got rid of the invalid certificate prompt, so perhaps the certificate issue has been resolved. Even so, I'm not quite sure how to get past the password prompt.

In summary, I've got a few issues with what Verizon has done to the Q.

Why on earth does the Q not ship with MSFP/AKU 2.0? That is INSANE! We're talking about an update that was released to manufacturers in November of LAST YEAR, for goodness sakes. Verizon needs to get off it's rear end and get an MSFP/AKU 2.0 update pushed out.
What is really the rationale behind locking down devices, such as preventing the installation of certain certificates? I can completely understand a carrier wanting to lock down a device so that it will only work with their network, but I don't understand this nonsense of locking down other portions of the device so that it makes life harder for IT folks.

I will, however, give kudos to Motorola. The form factor on the Q is pretty nice, and even with the extended battery installed, it still seems smaller than any Blackberry I've seen. The screen (even though it is only 320x240) appears bright and sharp. The screen, however, isn't a touchscreen, so don't expect to use it as such (no stylus included).

Are you experiencing similar issues with your Q, or another Windows Mobile 5 device? Have you gotten the dreaded continual password prompt? If so, what did you do to get around it?

Windows Mobile tidbit

2006-07-11T09:03:00.000-05:00

If your Windows Mobile device isn't automatically syncing with Exchange, make sure you check the Date and Time on your device. If it isn't correct, then you won't be getting updates.

I recently was without my Windows Mobile device for 3 weeks, and when I got it back, it was *completely* out of juice. Luckily, with Windows Mobile 5.0, I didn't have to worry about losing any data (Yay!). Once I charged my device, I did a sync to get everything working, and it pulled in a bunch of e-mail, so I figured everything was ok. Then I noticed that it wasn't receiving updates. I'd see new messages on my Outlook client, then I'd see that they weren't there on my Jasjar. I thought that was a bit odd, because with Direct Push, I'd usually end up seeing the messages on my device before they would show up in Outlook (cached mode). Performing a manual sync on the device would pull over all mail, but nothing was getting synced automatically. I was hoping that I wouldn't have to delete and re-create the Exchange server partnership, but was almost ready to do just that.

What finally caught my attention was looking at the day that was displayed on the home screen. It said it was Sunday, when in fact it was Monday. Turns out it was a whole year off. Anyways, once the time issue was corrected, Direct Push started working again just like normal. So this is a note to remind you that if you aren't getting automatic syncs, check your date and time.

Extreme Case Mods

2006-07-07T09:37:00.000-05:00

I subscribe to ExtremeTech's blog. Lately, what's been going on over there is a Case Mod contest. I just saw their latest winner, and all I can say is - Wow! Check it out for yourself.
http://www.extremetech.com/article2/0,1558,1985709,00.asp?kc=ETRSS02129TX1K0000532
That is one amazing case, and I can only imagine how much time it must have taken to complete. I wish I had extra time like that, but a wife and 4 kids tend to take up most of my free time :-)

Final update on MSH/Powershell History command

2006-07-03T09:40:00.000-05:00

Thanks again to Jeffrey Snover, I've finally gotten the history to be preserved between MSH sessions. It took a little tweaking in order to get it right (for me), but here are the steps I followed.

Create a profile.msh file. Within the Command Shell, if you run $profile, it will tell you where your profile is. At first, I was struggling with this part because I haven't been doing a lot of work with Powershell. A few web searches yielded the information I needed, which indicated that within my 'My Documents' folder, I needed to create a directory named 'msh', and then create a file within that msh directory called profile.msh. Of note here is that (at least on my system) you can't directly edit .msh files. So each time I wanted to edit the contents, I had to first rename it to a .txt extension. No biggie.
Add the code to the profile.msh file. I had to make some changes to the code that Jeffrey posted. I'm not sure if this was due to me using the Exchange Management Shell instead of Windows Powershell (though they really are the same thing), but I'll first post the initial code that Jeffrey posted, and then show you what changes I had to make.

$MaximumHistoryCount = 1KB

if (!(Test-Path ~\PowerShell -PathType Container))
{ New-Item ~\PowerShell -ItemType Directory
}

function bye
{ Get-History -Count 1KB Export-CSV ~\PowerShell\history.csv
exit
}

if (Test-path ~\PowerShell\History.csv)
{ Import-CSV ~\PowerShell\History.csv Add-History
}

OK – the first problem I ran into was that with the above code, each time I launched the Exchange Management Shell, it would throw an error stating that 1KB was an invalid integer. Once I finally got it through my thick head that I indeed needed to supply an actual integer, that was easy enough to fix :-)

The second problem I ran into was the first if statement. It was complaining that it couldn't find a parameter that matches the parameter '-PathType'. I'm not sure what that was all about (it appears to be having a problem creating the 'Powershell' directory), but I wanted to get this working, so I removed those lines. I ended up with the following code that works. All you have to do is type 'Bye' instead of Exit (this also means you can't click the 'X' to close the Shell window), and your history will be preserved. If you'd like to use this, feel free. If you'd rather, you can also change the export function to export-clixml, which will export it to an XML file instead of a CSV file. You would then also need to change the import function to import-clixml. The below code will save the history.csv to the root of your user profile.

$MaximumHistoryCount = 10000
function bye
{ Get-History -Count $MaximumHistoryCount Export-CSV ~\history.csv
exit
}

if (Test-path ~\History.csv)
{ Import-CSV ~\History.csv Add-History
}

update: had to edit this post as the code didn't come across right from Word. It should be good now.

MSH/Powershell Followup

2006-07-01T22:32:00.000-05:00

Yesterday, I posted about the History command, or more accurately, how I felt it was a bit lacking in how it functioned.

Since then, I've received 2 suggestions for enhancing the history (or get-history) command.

The first suggestion came from Ross Smith IV on the Exchange team. He indicated that you can record your entire shell session simply by entering the command

Start-transcript

This will literally record every action that takes place within your command shell. The only downside (if there is one) is that it is very verbose, so it *really* records everything. The information is recorded to a text file in your My Documents folder by default. Recording ends automatically when the MSH session is exited, or by typing Stop-transcript.

The second suggestion comes from Jeffrey Snover, who is part of the Windows Powershell Team. He left a comment on the original post, but I thought I'd include it here as well. He blogged about a way to preserve history across sessions.http://blogs.msdn.com/powershell/archive/2006/07/01/653194.aspx

Thanks for both of these suggestions. While they are quite different, both are great options.

Cool MSH/Powershell tidbit

2006-06-30T16:25:00.000-05:00

I end up doing some work on Linux, and one of the commands I use sometimes is the History command. This command, as many undoubtedly know, lists the past commands that have been issued. I wasn't sure if this had been implemented in Powershell, but thought I'd give it a try. Much to my surprise, sure enough it was there.

Why is this useful? There will undoubtedly be commands that get used more often than others. For those, it's easy enough to remember. However, there are (currently) just under 370 Exchange commands and (currently) just under 500 Powershell commands. I'm not going to remember or even attempt to memorize them all, not to mention all of the different parameters that can be used with each one! Due to the complexity of certain commands, seeing how it was used in the past would be very useful.

Update: I just noticed that it appears the History gets purged once you close the MSH window. Boooooo! Hopefully this behavior will change prior to RTM.

Edit: Thought it would be good to include the links to the 2 other posts related to this. The first is the initial followup after the comment I received from Jeffrey Snover.

http://winzenz.blogspot.com/2006/07/mshpowershell-followup.html

The second includes the end-result that is working for me.

http://winzenz.blogspot.com/2006/07/final-update-on-mshpowershell-history.html

Exchange 2007 Calendar Concierge

2006-06-30T16:23:00.000-05:00

I did an internal presentation a little while ago for some of the folks at our company, and I also presented at the last User Group meeting we had in May. The topic was Exchange 2007 general features (added, removed, deprecated features, etc.). One of the new features that I highlighted (and demo'd) was on the Calendar Concierge features. The main focus was on the new Auto-Accept feature that can now be easily administered. Since I've now implemented this on a few servers, I thought I would outline the steps I took to set this up.

1. Create a new mailbox. This can be done either from MSH (Powershell/Exchange Management Shell) or from within the GUI. From MSH, the command I used is as follows:

[MSH manually create new mailbox]

[MSH] C:\>new-Mailbox -alias somealias -database "Mailbox Database" -name "Conference Room" -resourcetype room –userPrincipalName alias@domain.com –OU Users

This will create a new *disabled* user account that is set up as a Meeting room. Created from within the GUI, the end result is the same, and at the end, it actually shows you the MSH command that it uses (see below this paragraph). Strikingly similar, aren't they? It's nice that when doing it manually, you don't always have to use the proper syntax. For example, in the example below, note the long distinguished name of the Database vs. just the database name in my example. Obviously, the more complex the environment, the more information you would have to provide, but MSH will tell you if it can't find the database.

[GUI create new Resource mailbox]

New-Mailbox -Name:'Name of User' -Alias:'somealias' -OrganizationalUnit:'OU' -Database:'CN=Mailbox Database,CN=First Storage Group,CN=InformationStore,CN=SERVERNAME,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Org Name,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com' -UserPrincipalName:'alias@domain.com' -DisplayName:'Display Name' -FirstName:'First Name' -Initials:'' -LastName:'Last Name' -ResourceType:'Equipment'

Note: either via MSH or GUI, it is important that the mailbox be marked as a Resource by setting the ResourceType parameter. This is what identifies it as a Resource mailbox. This is also what allows you to configure the Resource Settings in OWA (see below)

2. Set permissions for another user to log on and configure the Auto Accept parameters.

Currently, this can only be done via MSH, though I expect that this will change by the time Exchange 2007 RTM's, or possibly prior to that in Beta 2 perhaps. The command to set mailbox permissions via MSH is:

[MSH] C:\>Add-MailboxPermission "Conference Room" -user username_to_grant_access_to -AccessRights FullAccess

3. Finally, the AutoAccept settings can be configured. To do this, log on to OWA, then click the drop-down next to your name and Log on to the Resource mailbox. This is a NEW feature, and is WAY cool! Oh – it also will autopopulate names for you…

Another Oh – if you are using a popup blocker, you'll need to configure it to allow popups (the other mailbox will open in a new window).

With the new mailbox open, go to the Options, and scroll down until you get to Resource Settings. Note that the Resource Settings are not available on your mailbox, only on resource mailboxes. Configure the options how you would like them and save and exit. Note that there is WAY more flexibility with this than with the current AutoAccept Agent.

That's it!

Windows Live Search

2006-06-29T09:09:00.000-05:00

I recently changed my Internet Explorer search engine to Windows Live search. Previously, I had been using MSN Search. One of things that I *really* like about Windows Live Search is that it does Continuous scroll of results. I can’t tell you how welcome this feature is. ALL other search engines that I have seen will only return a set number of results “per-page”. It’s somewhat annoying to keep clicking the next page if you don’t find the results you wanted on the first page. Yes, I know that search engines are typically designed so that the best results will show up on the first page, but it doesn’t always work, thus you are left to check the results from other pages “just in case” the desired result is there. Continuous scrolling of results means there is no more clicking on the next page. As you scroll down, more results appear. It’s a WAAYYY cool feature. Kudos goes to the Windows Live team for coming up with this feature – I LOVE it!

Windows Desktop Search woes

2006-06-29T09:00:00.000-05:00

I’m kinda bummed out. I tend to run many of the latest versions of products on my laptop, so I have Office 2007 Beta2 (which is much better than the Beta1 release), MSN Live Messenger Beta (in the process of being upgraded to the RTM product), Yahoo’s new Messenger Beta, IE7 Beta2, etc. etc.

The problem I’m facing is that all of a sudden, I can no longer use the Desktop Search bar to search contents on my computer. It appears to be a problem with the Windows Desktop Search and explorer.exe, and no, uninstalling/reinstalling Windows Desktop Search doesn’t appear to help.

I could, of course, break down and simply download the Google Desktop Search, but I am again unhappy with some of the decisions they have made. Their new version of the Google Desktop Search, as I understand it, is by default set up to send data about indexed contents back to the Mother Ship (Google’s Datacenter, that is). Living in a corporate environment, that is a BIG no-no, so even though the feature can be disabled, my choice is to not use it period. Plus, being a techo geek and all that, I want to figure out what the problem is and fix it if possible!

Anyways, if anyone out there has experienced the same or similar problem and has found a fix, let me know.

Following is the error I receive when I try and search using the Desktop Search Bar.

Next, here is the error I receive if I right-click the WDS Search Icon, and choose “Search Now”

EventType : wdsindexfailure

P1 : d__wds_source_enduser_wds_localsearch_application_msnlocal_msnladmin_msnladminwnd.cpp

P2 : 2846 P3 : 80004004

Finally, I have the option set to let WDS replace the regular Explorer search (Start, Search). When I click Search from the Start menu, the Windows Desktop Search interface comes up, and I can type in a search query, but after returning a few results, I get the below error.

AppName: explorer.exe AppVer: 6.0.2900.2180 ModName: mshtml.dll
ModVer: 7.0.5346.5 Offset: 0019f6dd

The only change that has been made recently is that the memory on my laptop was upgraded from 1GB to 2GB. I’m hesitant to blame the memory though, as there have been no other notable problems.

Update: looks like pictures don't get uploaded automatically when using Word 2007 to publish. Edited the post to include that picture...

Blogging with Office 2007

2006-06-20T08:29:00.000-05:00

Another feature that has been previously mentioned by the Office team is that Word 2007 now has the capability to publish content to blogs. In fact, both my post yesterday and this one today are being published via Word’s new blog publishing capability. I like this feature. Why? There are at least 2 reasons that I can think of.

The online editor I am used to using is often quirky (it didn’t like to work with IE7 Beta, for example) and doesn’t include many features.
The “publish via e-mail” capability that Blogger includes doesn’t seem to work well. Whenever I would e-mail a post, some of the content (especially links) would get lost, and I’d have to go in and edit the post.
Ah – I came up with a 3^rd reason. If you have multiple blogs, Word gives you a way to centrally manage publishing to all of them.

Though the options of blog providers right now are limited, I’d expect the list to grow, and you do have the option of selecting “Other” as your blog provider, though I’d expect that if you do this, the format of the content (or if it works period) can’t be absolutely guaranteed.

Nice job, Office team!

I haven’t posted in a while

2006-06-19T16:20:00.000-05:00

I suppose I have a good reason – I’ve been on vacation for the last 2 weeks. It was nice to get away from everything and hang out with family for a while. Where did we go?

Well, first, we spent a week in Newport Beach, CA. Yes, the ocean is cold right now, but you do get used to it. I still have a hard time getting used to the ocean though. Growing up in southern Michigan, we were surrounded by *freshwater* lakes, and would often visit my grandparents in South Haven, which is on the eastern shore of Lake Michigan (Lake Michigan is the one between Michigan and Illinois/Wisconsin for the geographically challenged). I’m honestly not sure how people get used to the salt in the ocean – I swear that I’ve never spit so much in my life! :-)

Whilst in Newport Beach, we spent a day at Disney Land (it’s too close not to go – especially for our kids!), and then spent a day at Magic Mountain. The remainder of the days were spent either at the beach, at the mall, or doing various other things. Not surprisingly, going on vacation with kids isn’t so much about R&R as it is making sure the kids have fun, which I think they did.

After Newport Beach, we then spent a week at Snowbird (the Cliff Lodge) in Snowbird, UT. Snowbird is located in Little Cottonwood Canyon just SE of Salt Lake City, and boasts some of the best skiing around. My parents own a timeshare up there, which makes it much more affordable for us to vacation!

Salt Lake Valley is a beautiful area. If you know anything about the history of that area, it was first settled by Mormon pioneers in the mid-1800’s when the area was largely just a big desert. The landscape of the valley now is so dramatically different, it is simply amazing. Trees, grass, flowers everywhere, and the backdrop of the mountains is breathtaking. Yes – it’s a bit different from Texas. This was the scenery I enjoyed during my college years at BYU, and I’m glad that I have the chance to go back and visit every so often.

To continue, there are a myriad of things to do in Salt Lake City, from visiting Temple Square, to Hogle Zoo (I got some absolutely amazing pictures from the zoo – I’ll post a link if/when I get a chance to upload some of them), and we spent several days visiting with friends (and letting our kids play together). All in all, a good time was spent by everyone.

Office 2007 Beta 2 Thoughts

2006-05-26T08:41:00.000-05:00

Er - actually, this probably focuses more on Outlook 2007 Beta 2, because that is the program by FAR that I use the most, but since Outlook is still part of Office, I suppose it fits. Anyway, here are some of my thoughts (good and bad) about Office 2007 Beta 2.

1. THANK YOU for including the subject of an RSS feed in the preview pane. I can't tell you how frustrating that was to not have it present in the previous version, and have the message list window cut off the subject if it was longer than a certain number of characters.

2. On the same subject of RSS feeds, why is it that there is still no option to be able to pull down the entire article? Isn't the whole point behind RSS to have an easy place to read things? If I'm subscribed to an RSS feed, the LAST thing I want to do is "Click here to read the FULL article", especially when the ONLY thing that the feed includes is a short one-line preview of the article. This makes me want to go back to using intraVnews. I may still go back to that. It's free (for personal use), and actually has an option to pull down the entire feed. If the feed is an actual web page? I can tell it to download pictures and all kinds of stuff. Why isn't this an option here? Oh, and DON'T tell me that the option to "download article and any enclosures" is the solution. All that does is download the content and place an html page link in the feed. Oh, BTW, if I click on that IE icon? I get a nice "This file cannot be previewed because there is no previewer installed for it". Thanks. Just another reason to switch back to intraVnews.

3. Why are there STILL no other Theme choices than the UGLY Sky Blue and Slate Gray? Oh, sorry, you call it Windows XP (Blue), and Windows Vista (Gray), as if that identifies them any better, or makes them look any better. Both of them stick out like a sore thumb. I've got the Silver theme for XP, so why can't Office use the same OS theme that I am using? Who in their right mind would want to use a Baby blue interface for Outlook (and the rest of Office)? I certainly hope that there will be more choices for RTM.

4. Thank you for fixing the text color on the status bar. I use the Slate Gray theme, and prior to Beta 2, the text was black. Black text against a slate gray theme, well, doesn't work too well! It's now white text. I'm still not happy with the theme choices, but at least this makes things visible.

Whew! I have a point about another program besides Outlook! That makes the title valid! Woohoo!
5. OneNote 2007 gives you an option to install OneNote Mobile 2007. I like that there is a OneNote Mobile, but I HATE how horribly ineffective it is as a notation application. The built-in Notes feature of Windows Mobile 5 does MUCH better. Why is there no option to ink/draw in OneNote Mobile? At least the fuzzy text was fixed. In the previous version, typing text resulted in fuzzy text until you went to the next line, or did something else. That was annoying.

OK, that's all for now. Post your comments of your thoughts of Office 2007! Don't have the beta? Get it from the Office 2007 Preview site. As far as I know, this is an Open beta, so anyone can get it.
http://www.microsoft.com/office/preview/beta/getthebeta.mspx

Microsoft slips out 2 beta product updates today

2006-05-23T16:29:00.000-05:00

This one seems to have sort of slipped out. I don’t recall seeing any big announcements. Beta 2 of BOTH Vista (build 5384) and Office 2007 were released today. The funny thing is that Microsoft didn’t put the Office 2007 beta2 bits on their beta site in hopes of staving off the huge mess that the last beta build created in terms of the download servers not keeping up with the load. Instead, they put links to the Beta 2 bits on the Office 2007 preview site. Of course, what happens a few hours after everyone found out it was up there? LOL.

Due to high demand the site is temporarily unavailable. Please try it again later.

It also seems that the new method of downloading the files (SmartSource) is miserably failing as well. I had to shut down my computer to put more memory in it, and ever since then, it can’t connect and retrieve my profile, so I can’t download the software. Oh well – at least they are trying to fix problems…

Vista Beta 2 appears to be both on the MSDN site (for those who are subscribers) and on the Connect site (for those that are part of the actual Beta). At least that one is downloading, though it’s gonna take a while, being 3.2GB in size!

Thoughts on Windows Vista

2006-05-22T10:58:00.000-05:00

Brad Wardell over on WinCustomize wrote an excellent article detailing what we have to look forward to with Vista, and also what some of the current concerns are. For the record, I've been using Vista betas since the early builds of Beta 1, and I will say that it has improved immensely as it has progressed. I only expect it to get better as it transitions to Beta 2.

If the link to the article doesn't show up in the title for you, you can get to it here:
http://www.wincustomize.com/articles.aspx?aid=117896&c=1

On a personal note

2006-05-11T11:45:00.000-05:00

I've been working on losing weight as of late. It wasn't like I really needed to lose ton - I was right around 200-205lbs, which isn't heavy by any means, but I wasn't exactly happy with the way I looked, and playing sports (which I love, especially Basketball) often resulted in soreness in my knees. This told me that I was just putting too much stress on my knee joints. In other words, I needed to lose some weight.

In the past, I have followed the Atkins diet with quite a bit of success, so I decided to give it a go again. I started my "diet" about 3 months ago. As of this morning, I have dropped down to 169, and have lost at least 4 pants sizes (down to waist 34), though even then, some of my size 34 shorts are too big!

As with any "diet" program, there are a few things one must consider.

1. Willpower. You need to stick to the program. The Atkins diet is a low-carb diet. In my case, I had to be willing to temporarily give up a lot of things such as pasta, breads (there are low-carb breads available now), sugars, most fruits (at least to start) and the like. Thankfully, I didn't have to give up meat! Dieting with friends can be helpful and may mean success when going it alone would result in failure. My wife has been incredibly supportive in helping prepare alternative dishes, while also preparing regular dishes for the rest of the family. I've begun the gradual transition to eating more regularly, but I likely still won't eat regular bread or pasta very often.

2. Exercise. Almost any diet that doesn't include exercise is doomed to fail. If you've ever watched the show "The Biggest Loser", you'd know that a large part of the weight-loss program for those folks included exercise. When you are regularly exercising, your body burns more calories. In my case, I got a Nordic Track (cross country ski machine) which I try and use at least once a week, I started running at least once a week, and I play basketball once a week for around 2-2.5 hours.

I post this information not in order to laud my accomplishments, rather to share the information that I have used in order to achieve this. It's also worth noting that I have also decreased my portion sizes, and no longer drink any non-diet sodas. Have you ever looked at how much sugar is in a regular soda anyways? Many of them have more than 50 grams of sugar, which is a LOT. While the jury is still out on the long-term effects of sugar substitutes such as aspartame or saccharine (or splenda for that matter too), drinking diet sodas (and LOTS of water) has helped me achieve this goal.

Finally, different diets work for different people. I've found something that works well for me, but that doesn't mean it will work for everyone. If you are trying to lose weight, you need to find the program that works best for your body.

Now back to regularly scheduled programs...

Reminder to install MS06-019 on your Exchange Boxen

2006-05-11T11:21:00.000-05:00

Please remember to install this patch on your Exchange servers. It applies to pretty much ALL versions of Exchange. Microsoft has rated this security patch as *critical*. Most other security firms have given it a similar rating, with Symantec rating it a 10 on their scale of 1 to 10 in terms of severity.

To make matters worse, Information Week is reporting that it expects hackers to actively target this vulnerability in Exchange. The full article can be found here. Folks - don't wait on this one. Yes, test it in your lab, but don't put off testing. This vulnerability is one that can result in hackers gaining complete control of your Exchange Server. Complete control by a hacker = a server that must be flattened and rebuilt :-(

Austin Exchange User Group Official Meeting Information!

2006-05-01T10:56:00.000-05:00

It's official! The Austin Exchange User Group meeting has been scheduled for the 4th Tuesday of each month at 7pm. The first meeting will take place on Tuesday, May 23rd at 7pm.

The location of the meetings will be the local Austin Microsoft Office/Technology Center.

Directions to the Microsoft Office can be found at the following link:
http://www.microsoft.com/mscorp/info/usaoffices/gulfcoast/mtc_austin.mspx

Refreshments will be provided, so come and enjoy meeting others that work with Exchange Server. Information on Exchange Server 2007 (formerly known as Exchange "12", or E12) will be presented at either the May user group meeting, or the June user group meeting.

If there are topics that you'd like discussed in the May meeting, please send me an e-mail with that information. I look forward to meeting those who will be attending!

New E12 build available

2006-04-24T11:24:00.000-05:00

For those of you that are part of the Exchange “12” beta, a new build was posted to Connect earlier last week. It seems that there is quite a bit of confusion surrounding how to obtain this build, as the downloads section doesn’t list this new build under the correct date. However, if you look at the original download date, then look at the build number, it is definitely higher. I’m DL’ing it now, and have heard that there are quite a few improvements in both Monad and the GUI. I’m not sure if this will make it to Technet or MSDN subscribers or not like the initial one did.

More Windows Mobile follies

2006-04-20T10:23:00.000-05:00

Yesterday, all of a sudden my Windows Mobile device stopped automatically syncing my e-mail. In fact, when I tried to sync, it would pop up with a box asking me to confirm my password. At first, when I saw this, I thought that my password had expired (I do have to change it every so often), as entering my current password resulted in the password prompt coming right back. I checked network access on my computer and found that my password had not expired yet, so I wondered what was going on.

Then, I found out that our certificate had expired and been renewed, but the CA that we use had for some reason used a cert from a different chained trusted CA. This chained CA was, of course, NOT in the short list of trusted CA's included with Windows Mobile. Now, how to go about getting this corrected.

Oh - BTW, this error also prevented ActiveSync (Exchange portions only) from working when directly attached to my computer as well.

Fortunately, installing a cert on Windows Mobile is fairly easy. Of note is that I do have an unlocked device, so I can pretty much do whatever I want with it. Installing a cert may not be this easy (or possible at all) on locked devices. For me, this is what I did.

1. Obtained ALL certificates in the chain. This was completed by accessing our OWA website and exporting all certificates in the chain to DER encoded binary files (.cer).
2. Copy .cer files to WM device.
3. Open File Explorer on WM device and simply click on the certificate. It will ask you if you want to install the certificate. Simply choose "yes" and you are done.

Once I had the certs installed, everything worked fine again. I won't discuss my disappointment with so few root certificates being installed by default with Windows Mobile. I'm just happy I was able to install the other certs.

I must be important or something...

2006-04-14T08:53:00.000-05:00

I just got some German Spam! LOL. Good thing I can understand German...

Actually, all I needed to see were a few key words for it to register that this was a variation of the original Nigerian scam where a person was notified that large sums of money were available to be transferred to them for holding...

Here's the original text of the e-mail for your pleasure. Note the bank location in Johannesburg, South Africa (why would someone from South Africa be writing in German anyways?) and the sum (23.5 Million US). Ah, and of course, the situation being "streng VERTRAULICH" (VERY Confidential). HeHeHe.

It gave me a good chuckle, anyways. The lengths that spammers and scammers will go to...hopefully no one falls for these scams any more.

Too bad the message header information identifies foreged information, though the rDNS for 216.85.122.67 does correctly resolve back to mail.einsteinsystems.com.
Received: from fsmail.net (mail.einsteinsystems.com [216.85.122.67] (may be forged))

Looks like someone on einsteinsystems.com has an open relay mail server. Bummer.

Anyways, the text:

Sehr geehrter

Zuerst muß ich um Ihre Zuversicht in dieser Angelegenheit bitten,da dies aufgrund der Situation als streng VERTRAULICH anzusehen ist.
Ich erwaehne jedoch im Vorfeld, daß eine Offerte diesen Ausmaßes selbstverstaendlich abschrecken kann.
Ich hoffe,dass dies keine Besorgnis bei ihnen erregen wird, aber ich versichere Ihnen, daß alles seine Richtigkeit hat.
Wir haben wegen der Dringlichkeit,entschieden Sie auf dem Postwege zu informieren.
Als Erstes moechte ich mich bei ihnen vorstellen. Mein Name ist Dr.Shema.P.Modeka, ein Manager bei der Standard Bank South-Africa PLC, Johannesburg. Ich kam an ihren Namen durch meine Suche nach einer entsprechenden Person,um eine sehr vertrauliche Angelegenheit abzuwickeln, die die Übertragung von einer betraechtlichen Summe Geld ,welches aus einer Erbschaft stammt,zur Folge haette.
Hier nun mein Vorschlag: Ein Ausländer,der verstorbene Ingenieur ULLMANN, ein Ölhaendler aus Suedafrika, kam 1999 bei einem Flugzeugunglueck ums Leben.Seither sind keine Erben ermittelt worden.
Er war bis vor seinem Tode als Unternehmer taetig. Herr ULLMANN war unser Kunde hier bei der Standard Bank PLC.,Johannesburg, und hatte ein Kontoguthaben von US $23.5 Mio. (Dreiundzwanzig Millionen, Fünfhundert Tausend, US Dollar).
Diese Summe liegt jetzt bei der Bank und wartet auf eine Person,die berechtigten Anspruch darauf hat.Sollte kein Anspruchsteller gefunden werden,geht die komplette Summe an die Regierung von Suedafrika.
Daher haben meine Kollegen und ich beschlossen,vor Ablauf der Frist,eine entsprechende Person zu benennen.
Da Sie den selben Namen tragen,sind Sie in unsere engere Auswahl gefallen.
Mit Ihrer Erlaubnis wuerden wir Sie als Verwandten des verstorbenen ULLMANN deklarieren ,damit Sie den Anspruch in Hoehe von USD$23.5M erhalten wuerden.
Infolge dessen koennten Sie als der Nutznießer (Verwandte der ULLMANN) dieser Summe gelten.Die Urkunden und die Beweise zu diesem Vorgang werde ich Ihnen selbstverstaendlich erbringen und zu Ihrer Verfuegung stellen. Wir versichern Ihnen eine 100% risikofreie Abwicklung.
Ihr Anteil wäre dann in einem persoenlichen Gespraech zu eroertern,da wir natuerlich auch in eigenem Interesse handeln . Falls dies fuer Sie von Interesse sein sollte,wuerde ich Sie bitten mit uns in Kontakt zu treten. Zu diesem Zwecke senden Sie mir bitte Ihre Persönliichen Daten wie Voll Namen, Adresse Telefon-,und Fax nummer und Bank verbindung ihre vertrauliche E-mail Adresse, damit ich Ihnen die relevanten Details dieser Offerte zukommen lassen kann modekas1@fsmail.net

Mit freundlichen Grüßen,
Dr.Shema.P.Modeka
Standard Bank

I'm noticing a trend

2006-04-07T09:49:00.000-05:00

I was looking over my blog statistics, and I’ve noticed that the posts I’ve made about Windows Mobile are getting MUCH more traffic than any other posts. I thought this was most interesting, as the majority of my posts thus far have dealt with Exchange server. I’m also seeing a lot of referrals from Google, which is cool, but it shows me one thing. MSN Search still isn’t getting the traffic that Google is.

Microsoft, if you want people to use MSN Search (I do), you are going to have to change something, because whatever you are doing now clearly isn’t working.

Those of you that read my blog – what search engine do you use? Why?

Added IMF functionality with hotfix for Exchange 2003

2006-04-06T09:03:00.000-05:00

It looks like this KB article has been out for a few weeks, but I was just informed of the functionality it provides today (er - late last night as it were). For those of you that use the Intelligent Message Filter (IMF), you can now add the feature of building custom exclude lists and custom include lists. The Exclude lists will allow you to create a list of addresses that IMF should not perform scanning on, while the include lists would seem to be a sort of ~~blacklist where messages are filtered~~ whitelist where messages that include those specific e-mail addresses are not filtered.

UPDATE: It seems I was a little off in how this works. The Exclude list is a list of addresses that IMF will exclude from scanning, but the way it works is that ALL recipients of a message must be in the exclude list in order to bypass being filtered (I think I mentioned that in part below, but it isn't detailed enough). If even *one* of the recipients is NOT on the list, then the message will be filtered. Regarding the Inclusion list, the way this works is that if ANY of the smtp addresses are on the RecipList, it will bypass filtering. Obviously, from a control standpoint, the Exclude list is far more restrictive.

A couple of limitations I noticed. With the exclude list, it will only exclude scanning if ALL of the recipients are on the exclude list, otherwise it will be scanned as normal (and potentially filtered/marked as junk). Also, all changes must currently be made in the registry - there is no GUI tool to manage this yet. It remains to be seen if some 3rd party tool will pick up on this, or if it might be added into the next service pack for Exchange 2003. The KB article currently does not indicate any prerequisites, but I've asked for clarification if this works with both IMF v1 and v2, so I'll update this once I know for sure.

UPDATE: This is a Post-SP2 Hotfix ONLY! It will not work with IMF v1.

Remember, as with all hotfixes, you MUST call in to PSS to get the hotfix. Thankfully, calling in for hotfixes has been made MUCH easier. I've called in many times, and have never been asked for a credit card for a hotfix. The automated phone attendant at Microsoft even has an option to specify you are calling for a hotifx. When you choose that option, you won't get to a PSS engineer, instead you will be routed to a Customer Support rep who will process the hotfix request (you simply provide the article number) and send you a link to the download.

ExBPA 2.6 released!

2006-04-06T08:51:00.000-05:00

Paul Bowden posted on the Exchange team blog this morning indicating that ExBPA 2.6 had just been released. Indeed, you can get it by going to the direct download link http://www.microsoft.com/downloads/details.aspx?familyid=dbab201f-4bee-4943-ac22-e2ddbd258df3&displaylang=en, but you won't find it yet if you just go to www.exbpa.com. I expect that will be corrected/updated very shortly. In the meantime, use the link provided above to get directly to the download page. From what Paul has said, it looks like there will be some great improvements in 2.6, so check it out!

Update: Along with releasing a new version of ExBPA, it also appears that new versions of ExPTA and the Exchange Profile Analyzer Web Release (EPA WR) have been released as well. Check them out!

Wireless Security revisited

2006-04-05T08:02:00.000-05:00

Ok, I *finally* got off my duff and decided to increase my wireless security at home. Not that I was too worried, mind you. I had already implemented WEP, which is admittedly better than nothing, but it has already been shown that WEP can be cracked fairly easily. I had also thought about implementing MAC filtering, but decided against it for the time being.

Anyway, the wireless router I use (Linksys WRT-54G with DD-WRT firmware) fully supports implementing additional wireless security levels, including WPA and WPA2. I figured what the heck - let's try and see if I can get WPA2 working. I enabled it on the router (WPA2 passphrase using AES as the encryption method - I could choose between AES and TKIP, but admittedly don't know if there is an advantage to choosing one over the other) and applied the changes, then made the change on my laptop running Vista. I was happy to see that the wireless drivers Vista has provide built-in support for WPA2 out of the box using either WPA2 Personal or Enterprise (Enterprise requires RADIUS authentication), but for some reason, I couldn't connect right away. It ended up taking about 5-10 minutes before I could connect with that laptop. In fact, while I was waiting for Vista to be able to connect, I tried getting my Work laptop (running XP Pro) on. Turns out the wireless drivers I was using were quite old, and they only supported WPA. No worries, as I checked Dell's website and found new drivers. I loaded the new drivers, rebooted, and enabled WPA2 and was able to connect right away. By the time I went back in and checked my Vista laptop, it was connected.

Do I feel like my wireless network is more secure? Sure. Was it harder to set up than WEP? Absolutely NOT. HOWEVER, one big current gotcha is that not all wireless cards support WPA2. I'd suspect that virtually all new wireless hardware supports it, but if you are using an older wireless card, you may find that it doesn't support WPA2. If this is the case, you may have to revert back to WPA instead, which is better than WEP, but not as secure as WPA2.

Also remember that if you are running Windows XP (Service Pack 2 required!), in order to enable WPA2 support, you must download and install an update that enables support for WPA2 in XP. You can find that update here:
http://support.microsoft.com/kb/893357

Microsoft to provide Virtual Server 2005 R2 for free

2006-04-03T15:56:00.000-05:00

I suppose this is following on the footsteps of VMWare, who earlier this year announced a free version of VMWare Server (albeit currently Beta), available to anyone who registered.

Microsoft has announced, of all places, at LinuxWorld, that they will provide Virtual Server 2005 R2 (I didn't see whether it was only Standard or also Enterprise)for free. In addition, they will provide more support for running Linux as a guest by providing virtual server additions for several mainstream linux distros.

It seems as if it's a virtual battle out there between Microsoft an VMWare. I haven't tried VMWare's product yet (it's time bombed, which I don't like), but I've used Virtual Server quite a bit, and it works very well. Along with the Virtual Server Migration Toolpack, which helps migrate machines from both "phsyical-to-virtual" and "virtual-to-virtual", this announcement is great news for IT professionals.

To read the entire press release, click the link in the title, or here:
http://www.microsoft.com/presspass/features/2006/apr06/04-03virtualizationqa.mspx

Exchange Direct Push

2006-04-03T12:43:00.000-05:00

Vanitha Prabhakaran on the Exchange team discusses how to deploy Activesync using Direct Push. This is a great article and includes such things as FAQ's and Troubleshooting steps. I'd even go so far as to say this should be a must read for anyone that wants to deploy Activesync using Direct Push.

Austin Exchange User Group

2006-03-31T10:09:00.000-06:00

Fellow MVP Chris Scharff and I are working on setting up an Austin Exchange User Group. Before we finalize plans on when and where we can meet, we need to be able to gauge interest in who can be there. I suspect we'll be able to harangue some of the other local MVP's from the Austin area to be there as well, so take this opportunity to let me know if you'd be interested in attending!

Please e-mail me at ben_winzenz@NOSPAMmessageone.com (remove the NOSPAM portion) to indicate your interest. We will likely be holding meetings on Tuesday evenings at 7pm (unless that works out to be a bad time) roughly once a month.

Please feel free to pass this on to any others you know. We'd like to have a good showing. The format of the first meeting will likely be open, with some discussion (perhaps a short presentation or demo) on new features in Exchange "12" along with an open-panel discussion on issues you are facing or questions you have about Exchange.

If you have any suggestions for topics you'd like covered, please include those in your e-mail to me.

Disappointing news from Microsoft

2006-03-31T09:19:00.000-06:00

Yeah, I know. I usually write good things about Microsoft. I'm fairly entrenched in Microsoft technology, and on the whole, it's pretty good. I get along with it pretty well, at any rate. This, however, is one thing I just don't understand.

First, I have previously written about Stringbean Software's iscsi Target server software labeled WinTarget. It provided iscsi server functionality, allowing one to define new targets (viewed as LUN's) both using file-based targets, or volume-based targets. It has worked very well for us and has allowed us to achieve SAN functionality (shared storage being the key aspect here) at a much lower cost than a traditional SAN with fiber connectivity.

I recently found out that WinTarget had been acquired by Microsoft, and that Microsoft was integrating the WinTarget functionality into Windows Storage Server 2003 R2. That, I thought, was GREAT news. Now for the bad news. As with the original release of Windows Storage Server, WSS R2 will ONLY be available through OEM's. This means that in order to get WSS R2, you will have to buy a new server. Oh, and not just any server. There are only certain models of servers that OEM's will bundle with WSS R2, so you can't just get it with any server. This to me means that you can no longer use it as you previously could. Reducing availability is usually NOT a good thing.

Why is this so disappointing to me? For one, since WinTarget has been acquired by Microsoft, although it may not be impossible to acquire new licenses of the standalone WinTarget software (Stringbean's website says to contact a Solution Provider or OEM solution partner), it's certainly going to be harder. Having looked at most if not all of the partners they list, none of them list the WinTarget software as a separate SKU. Just about all of the partners are storage partners that sell SAN's.

I had really looked forward to seeing how WSS R2 worked with iscsi target functionality built-in. It doesn't look like I'll get to try it out any time soon. Those of you that get to play with this - please let me know how you like it.

Oh, Shola Aluko blogged about this yesterday here, but my comment hasn't shown up yet, which is making me wonder if they moderated the comment and refused to post it. Note: It wasn't an obscene comment - I don't do those. I'll check back later to see if it ever shows up.

Update: Yes, my comment finally showed up. Now you can see it really wasn't too inflammatory. BTW - it seems some of the other iScsi software vendors are viewing this news about WinTarget as an extremely rare present that has just been dropped in their laps. That seems to cement for me that WinTarget was likely the leading software-based iscsi server solution. That just makes this more disappointing to me, as the end-user who doesn't wish to buy a new server will now have to settle for second-best.

Outlook 2007 and Exchange 12 autodiscovery

2006-03-29T09:39:00.000-06:00

Let me say just one thing. It's very cool. I've got an E12 Mailbox server deployed that also hosts the Bridgehead and Client Access roles. I've also got a machine running Vista build 5342 with Office 2007 Technical Refresh on it. Office 2007 now supports automatically detecting your server settings. I have seen this before, but since Exchange 2003 doesn't support it, I haven't had a chance to use it.

So I'm setting up my Outlook profile and you have a choice of whether to manually configure server settings, or whether to have them automatically detected (automatic detection is the default). Wonder of wonders, since I was logged on with the account that had the mailbox, and since Exchange 12 supports autodiscovery, Outlook automatically configured itself without me having to do anything at all. I started to type in my name, and before I had finished typing more than a few letters, my full name and my e-mail address had automatically been filled in. See, the way that autodiscovery works is that Outlook contacts the Client Access server (which has a special http virtual directory) and presents the username and e-mail address. With that information, the Client Access server then sends back an xml file with the configuration settings and Outlook automatically configures itself.

The autodiscovery feature should make it possible for folks to using RPC/HTTPS to set up their profile from wherever they want without going through the fuss of manually entering all the information (which can be a pain) as long as a Client Access server is available for them to talk to. I'll be testing the RPC/HTTPS functionality as soon as I can. Of course, as noted above, autodiscovery works greate for regular mailbox users as well. It should reduce support time involved with assisting users in setting up Outlook profiles. Kudos to both the Exchange and Office teams for implementing this feature.

Exchange Activesync and SBS

2006-03-23T08:22:00.000-06:00

I don't work with Small Business Server a lot, but I found some interesting information this morning that I thought I would share. For many, configuring Server Activesync can result in a lot of frustration. This does not just apply to SBS. There are a lot of settings that have to be configured in order for this to work.

One common scenario where Activesync can be problematic is where you have enabled Forms-based authentication for Exchange, and have only one server. The problems this causes are actually quite well documented here. The main issue here is that the Activesync virtual directory expects to talk to the Exchange virtual directory via http, not https. If you have forms-based authentication enabled, and are requiring ssl, activesync (and oma) will not work. The solution is to create another virtual directory according to the instructions in the KB article above. The nice thing about SBS is that this is done automatically as part of the SBS customization. Here's where it gets tricky. In addition to wanting to talk over http, Activesync also expects to use Kerberos authentication. If Integrated authentication has been disabled on the Exchange virtual directory OR the new exchange-oma virtual directory, then you will see the same HTTP_500 error indicating there was a server error and activesync will fail.

Great news for Exchange Administrators!

2006-03-22T10:59:00.000-06:00

I just saw this today posted on Gerod Serafin's blog. The Exchange team has posted a new KB article detailing a hot fix (yes, you still have to call in and get it, no you won't be charged for the call) that is now available to deal with disabled user accounts.

Prior to this hotfix, the default behavior was that as *soon* as you disable a user account, ALL mail will immediately begin to NDR. This is because disabled user accounts do not have a valid msExchMasterAccountSid attribute.

There used to be 2 methods to fix this (both arrived at the same solution, but one was automated). The first was to manually edit the ACL's on the account (Mailbox Rights) and grant the SELF account Full Mailbox Access and Associate External Account. This would fix the missing msExchMasterAccountSid attribute and allow the mailbox to again receive mail. The second method was to obtain a tool called NoMAS (No Master Account Sid) and run it. It would then automatically fix any and all accounts in the domain with this missing attribute.

I have always disagreed with this default behavior, so I am quite happy to see this hotfix available. It will change the behavior of Exchange so that it automatically uses the SELF sid as the msExchMasterAccountSid for disabled accounts. Read more about this hotfix from the following KB article.
KB 903158

Update: It has also been posted on the Exchange Team's blog, courtesy of Nino Bilic and Alex Seigler (Alex was the original developer of the NoMAS tool). Thanks go out to all those involved in publishing this hotfix.

Disaster Recovery Preparation

2006-03-16T08:15:00.000-06:00

If you are still running Exchange 2000, you probably know that disaster recovery preparation has changed quite a bit in Exchange 2003. For instance, the introduction of the Recovery Storage Group now makes it much easier to recover mailbox data for individual users, and no longer requires you to build a recovery Exchange server (in a separate forest, or segmented network).

Let's go back and take a look at building a recovery server for Exchange 2000, though. There are really two choices when you implement a recovery server. First, you can take an existing GC offline and move it to a segmented network that has no access to your production server. Once you have done this, you will need to seize all the FSMO roles. Then you can install Exchange on another server (using the /disasterrecovery switch if you want) that has the same name as the original Exchange server. If you choose this method, you won't have to worry about legacyExchangeDN issues, as the /disasterrecovery switch simply pulls all the Exchange info out of Active Directory and doesn't prompt you for any information. HOWEVER, one key warning here. If you have deployed an empty forest root domain, and all your accounts are set up in a child domain (as well as Exchange), you also have to put a forest root GC in your recovery network. See, one of the FSMO roles is the Schema Master. That specific role can only be assigned to one server in the entire forest. In order to seize the Schema Master role, you have to be logged on with an account that is a member of the Schema Admins and/or Enterprise Admins Groups. Guess what? Those groups do not exist in a child domain :-) If you forget to put a forest root GC into your recovery network, you will not be able to reinstall Exchange because you will not be able to seize the Schema Master role. Which brings you to the second choice (and the one actually outlined in Microsoft's Mailbox Recovery white paper - found here).

The second method is to build a completely new forest (the AD domain name simply doesn't matter here as it relates to Exchange). For this, you can even use a single server to do everything. This also gives you the added benefit that you can leave it attached to your production network if you choose (certainly makes restoring from tape easier) Build your forest (new forest, new tree, new domain), then install Exchange using the same Organization name as your production org (and SP's to same level as production server). Once you have done that, you'll need to make sure that the legacyExchangeDN's match those of production (this information is detailed in the white paper) and then create the Admin groups and Mailbox stores so that they match production as well. Now you are ready to restore. You can either restore using your backup software (if this is a possibility), or you can also simply restore the flat files (.edb and .stm files). Either way works fine. Now you are ready to mount the store. If everything was done correctly, the store will mount without any problems. IF there are any errors, consult event viewer (Application log) for more details. The most common reasons that the store wouldn't mount would be if a legacyExchangeDN value does not match somewhere. There is a great tool on the Sp3 CD to help with this - it is called LegacyDN.exe. It basically allows you to change the LegacyExchangeDN value for your Administrative Group (and all objects underneath it if I understand the tool correctly). It can come in quite handy if your production environment had been migrated from Exchange 5.5.

With either the first or second method, once the mailbox store is mounted, you are ready to use Exmerge. A couple of notes on using Exmerge.

1. There is some conflicting information out there regarding whether or not Outlook is required. I do not recall ever needing Outlook on a recovery Exchange server, but there are other KB articles that mention Outlook should be installed. I'll leave it up to you.
2. If you run Exmerge, remember that it requires RECEIVE AS permissions on the mailbox store object in order to be able to extract.
3. The user account you are logged in with MUST have a mailbox on a store that is mounted. If the user account has a mailbox, but that mailbox store is not mounted, Exmerge will be unable to log in and see the other mailboxes on other stores.

As you can see, recovery prospects for a single mailbox for Exchange 2000 can be quite difficult. If you are looking to recover a single mailbox and don't do mailbox-level backups (which I don't recommend anyways), you might consider deploying an Exchange 2003 server and working with the Recovery Storage Group. Remember that as long as your Exchange 2000 database is SP3 or greater, you can still mount that database to the Recovery Storage Group in Exchange 2003.

I'm sorry that I have to say this

2006-03-10T09:28:00.000-06:00

Let me start by saying that I usually shy away from discussing political issues in my blog. This topic, however, I felt was too important to keep quiet about.

I am extremely disappointed in our country’s politicians, but really, should I have expected less? I was very disappointed to hear that Dubai Ports World, the Dubai shipping company based out of the UAE that was set to take over management (key word there is management) of some of our ports, was in essence forced to pull out of the deal and will no longer manage operations for those ports. Instead, they will turn over all management functions to an American company. They claimed that the relationship between our two countries was too important, but I fear that the relationship between our two countries has already been damaged by this fiasco.

After all that our country has been through, I submit that we are just as bigoted as the extremist Muslims. After all, we are now punishing ALL Arabs (or at least it appears that way) for the crimes of a few. We are saying that, even though these same ports had been (gasp!) managed by another country for years, that having them managed (not operated) by a country full of Arabs just wouldn’t do. This is racial profiling of the worst kind – the very thing that we fight so hard to prevent inside our country. After all, that would give an upstanding company that, might I add, manages operations for ports ALL OVER THE WORLD, access to allow terrorists to exploit this as a “weakness” in our nation’s security. Yes, a weakness, even though day-to-day operations, and security, would still be performed by Americans

No, instead, this round goes to the terrorists. Why, you say? Oh, this is exactly what they wanted. They want Everyone to see that America doesn’t want to do business with Arabian nations. They want Everyone to see just how intolerant we are (yet we can call Muslim extremists intolerant, and that’s ok). Unfortunately, we’ve played right into their hands. I just hope that this doesn’t damage our relations with other Arab nations too much. I also hope there isn’t much international backlash because of this, but if there is, I can hardly say that we don’t deserve it

I respect your right to disagree with me (if you do). This is my opinion, and I stand by it until such time that it can be proved this isn’t what happened.

Hacking your Windows Mobile 5.0 Registry

2006-03-08T13:24:00.000-06:00

Sounds like a great start to a post, huh? OK, here's the deal. I've blogged a few times about my Jasjar (yes, I still love it and use it almost every day).

Devin Ganger at 3Sharp blogged about the inability to add Root SSL certificates on some WM 5.0 devices, which is true. What isn't mentioned much of anywhere (you have to look around pretty hard) is that you actually can still disable Certificate Checking - you just can't use the old DisableCertChk tool from Windows Mobile 2003. Microsoft doesn't recommend this, but it's a necessary evil in some situations. Two that I can think of are:

1. Your company uses a Wildcard SSL Certificate. (i.e. *.company.com). Windows Mobile 5.0 (or any other version for that matter) does NOT support wildcard certs. Why, I'm not sure, but it doesn't.
2. You have a manufacturer locked device that prevents you from adding additional Root Certificates. Again, WHY a manufacturer would prevent folks from adding additional root certificates is beyond me, but it happens.

So, on to the registry hacking.
First, you download my new favorite freeware Windows Mobile Registry editor, PHM registry editor, which I blogged about earlier. The ONLY catch with this program is that it may not install correctly on newer devices. What I ended up having to do was install the program on my desktop (which just extracts a bunch of cab files), then go to the install directory, grab the cab files and copy them to my device. The one that ended up working for me was the cab file named regedit_Mrln_ARM.cab. Simply click on the file from your windows mobile device, and it will install it. Once it is installed, you can delete all the cab files from the device.

Surprisingly (or not), the registry on Windows Mobile devices is very familiar if you have ever looked at the registry on a regular PC. Anyways, to disable Cert Checking, you navigate to the following location:

Hkey_Current_User\Software\Microsoft\ActiveSync\Partners

Here you should notice 2 sub-keys, both with a unique UID. One is set up for the ActiveSync Partnership with your PC, the other is set up for the partnership with your Exchange server. Fortunately, it is fairly easy to distinguish between the two. Simply highlight one of them, and look at the different values. You'll see pretty quickly which one is for your Exchange server. While the partner key for your Exchange server is highlighted, create a new value with the following parameters

Type: DWORD
Name: secure
Value: 0

That's all there is to it. You have now successfully disabled certificate checking on your device and can now have ActiveSync use SSL with wildcard certs and self-signed certs.

I Want This!

2006-03-08T09:45:00.000-06:00

LG Philips has developed a 100-inch LCD Television. Yikes!

While it is most certainly overkill for virtually any home, it would still be fun to have...

Do you have an MSDN or TechNet Subscription?

2006-03-01T14:39:00.000-06:00

If so, Microsoft announced today that they will make Beta 1 of Exchange "12" available as a CTP to MSDN and TechNet subscribers. I don't have all the details or know if it is being made available to ALL levels of subscriptions, but if you have one and are interested in trying Exchange 12, make sure to sign in to your Technet/MSDN account and see if it is available in your downloads. According to Paul's blog, MSDN subscribers will see it available starting today, while Technet subscribers will see it available as part of their March bits.

You can find more information about Exchange "12" on Microsoft's site

Get yer USB key from Microsoft

2006-03-01T10:07:00.000-06:00

While supplies last.

Go to http://www.microsoft.com//windowsxp/mysterysolved/corp/default.mspx and click on the "Get Yours" link. You have to have a Passport account, and you have to fill out a brief survey. Allow 6-8 weeks for shipping.

I don't know how big this USB drive is, but hey, can't hurt to have another USB drive laying around, right?

Windows Mobile Issue after removing Skype

2006-02-28T11:46:00.000-06:00

I've been trying to tune my PocketPC (iMate Jasjar) a little bit recently, and one of the things I decided to get rid of was Pocket Skype. Oh, I might put it back on at some point, and I do have a Skype account (though I've never used it that I can recall), but at this time, it hardly seems necessary to run it on my Pocket PC.

Anyway, so I uninstalled Pocket Skype. It appeared to uninstall cleanly, and all icons/folders were removed. However, each time I turned on my device, I was getting the following notification message:

Notification Error
Cannot execute \Program Files\Skype for Pocket PC\Skype.exe

I thought this was odd and was determined to find the cause. I thought for sure that something had been left over in the registry. So, a-looking I went. Of course, that required a registry editor for Pocket PC. After looking (and trying) a few, I settled on PHM Registry Editor. It's freeware (Yay!) and has the ability to perform searches. You can download it here. The only trick was that it didn't install correctly. It includes a bunch of different cab files, and I had to fiddle around and figure out the right one that would work on my device, but once I figured out which one to use, it worked great. Ran it, but to my dismay, it didn't find anything with skype. Off to Google/MSN Search.

Searching for the error found many occurrences of this problem. The end result was that there appeared to be a notification event that was left over and wasn't removed properly. In order to clear out notification events, you need to have an application that can access them. Others have used Pocket Mechanic to do this, but it costs money, and I am notoriously cheap. So, I found Check Notifications that does the same thing, and is free for personal use. Opened up the notifications queue and found and deleted the offending Skype entry (and deleted a whole bunch of duplicate sddaemon entries as well) and all is well. No more notification event after turning on my device.

Reason #25443

2006-02-24T15:38:00.000-06:00

Why I refuse to install the add-on components that come on a DSL installation CD.

My Mom e-mailed me today and said that when she clicked on a link in Outlook, it was prompting her to sign on to her old DSL provider (name withheld), which they had recently cancelled. That was a problem, as they couldn't sign on any more.

As most of you know, when you order DSL, they send you the hardware (DSL modem, filters, etc.) and they also send you an installation CD. Now, in all actuality, NONE of the programs on the CD are needed in order to connect to your DSL. Granted, there may be some worthwhile applications on the CD, but I can do without installing any of them just fine thankyouverymuch.

So, on to troubleshooting. I check Internet Explorer settings and find that the DSL provider is set as the default mail application, so I change that to Outlook, then quit IE and Outlook, but the same thing happens. OK, this is weird. Now, I check Add/Remove programs, and find a whole slew of applications that are from the old DSL company. So, I remove them. There ended up being I think 7-8 total applications varying from troubleshooting tools to browser toolbars to parental controls. None of them needed any longer (but they really didn't need to be installed in the first place either). After uninstalling, it wanted a reboot (which I didn't want to do at that time). I tried a link in Outlook now, and all was good. It simply opened Internet Explorer and went to the website that the link pointed to. Happy Happy Joy Joy.

I don't fault my parents for installing those applications. The DSL providers try to make it as easy as possible to get set up (plug in hardware, insert CD, follow instructions). For those that are not computer literate, or don't work in IT, this method actually works well. Until the service is cancelled, that is. As it was with my parents, I think the tendency is to forget that you installed the programs and then you are left wondering how to fix what is going on. Luckily, my parents have 2 sons that both work in IT, who can fix any problems that they run across. Others may not be so lucky though.

Do you use the Microsoft Terminal Services MMC Snap-in?

2006-02-24T11:08:00.000-06:00

Are you tired of how inadequate it seems to be like I am? Do you want to be able to re-order your list of computers? Create "Groups" of computers? Define global settings for all connections? Save logins/passwords? Did you know there are alternatives available??? One of my co-workers recently turned me on to an application that is basically a "wrapper" for the MS Terminal Services MMC snap-in, much like Maxthon is a wrapper for IE. The app is called Royal TS, and it comes complete with an icon that looks like a Royal Cheeseburger (LOL!). Once you load up this app though, it's benefits are immediately apparent.

In addition to the benefits mentioned above, it also doesn't prompt me to save it *every single time I exit*!!! It only prompts you to save when the list of computers has changed. Don't get me wrong, here. I was an immediate fan of the Microsoft TS MMC snap-in when it was first released. It was a huge improvement for those that needed to manage multiple servers. It would be nice if it was refreshed - perhaps it will be when Longhorn/Vista Server is released. Then again, I expect quite a few things will change in that timeframe.

Great post on booking resources on Exchange team blog

2006-02-23T11:01:00.000-06:00

Nagesh Mahadev with the Exchange team posts a Great article discussing the 2 native resource booking options available for Exchange 2003 users.

I *always* recommend using the Autoaccept agent if native tools must be used. There are also many good 3rd party tools available that extend the capability of the resource booking. One such tool is ERM from Swinc.

Anyways, back to the topic. From the article, the limitations associated with Outlook direct booking are pretty severe. I don't think I've ever recommended using that method, and whenever I see it mentioned in the newsgroups, I always recommend that the Autoaccept agent be looked at as well.

For those that aren't running Exchange 2003, remember, there are still options available. The AutoAccept Sink was developed by Dave Mills at Microsoft as an open source project and works quite well. Of course, for those of you still running Exchange 5.5 (Shame on you), you can also get resource booking by downloading the Autoaccept Tools. They are no longer supported, but you can still download them from
http://www.exchangecode.com/autoaccept/index.html

Understanding NDR's

2006-01-20T09:48:00.000-06:00

I see requests for help on NDR's all the time on the newsgroups.

What many people don't understand is that when you get an NDR, there is a difference between the server that issued the error, and the server that generated the NDR.

Often, your server will be the one that generated the NDR. By that, it simply means that your server was the one that ultimately delivered the NDR to you. It doesn't mean it was the one that issued the error, though your server certainly can do both.

Understanding NDR's fully means that one needs to have an understanding of how SMTP works. Per the RFC's, a 500-level error is a permanent fatal error message.

Often, when you receive an NDR back, it's because the remote server issued a 500-level response at some point during the SMTP conversation itself.

When will the remote server generate the NDR? When the message has been accepted by that server (indicated by 250 Message Queued for Delivery, or similar message). This is a problem that Exchange has when dealing with Spam, that to my knowledge is still a problem (although not a vulnerability for relaying mail).

Back on topic. Once a server has accepted a message, it then becomes responsible for delivering it, and if it can't, it is then responsible for generating and delivering the NDR. When might you see a remote server issue an NDR (not just the error message)?

1. Mailbox over the limit.
2. Invalid address where the server isn't checking the address against a directory during the conversation.

How about from your server?

1. Above example where you ARE doing address checking (filter recipients not in the directory, for Exchange)
2. Attempting to relay a message to a non-local domain.
3. Message size too large (if enhanced SMTP commands are enabled).

Obviously, this doesn't cover every reason that can cause NDR's or who generates them - they are just a few examples.

I'll try to post some real NDR's and decipher them in the coming days. If you've got any samples you'd like posted (you can take out any sensitive info), feel free to send them to me, otherwise I'll probably use some generic ones on the internet.

In recent news...Google promotes children's access to pornography

2006-01-20T08:42:00.000-06:00

I know - inflammatory title. My apologies for that.

Of the 4 major Internet companies that were subpoenaed to provide data by the Justice Department, only Google has been unwilling to provide the data requested in any fashion.

At stake? The Government is attempting to defend the Child Online Protection act, aimed at shielding children from pornography online. The Child Online Protection Act was passed in 1998 and attempts to protect children from harmful sexual content on the Internet, though the law has never taken effect as it was blocked by courts. The Supreme Court recently upheld rulings of the lower courts that the law is unconstitutional as defined. The government is now scrambling to save this law and defend its assertion that it is constitutionally sound, hence the subpoenas.

Why is Google resisting this request? The other 3 Internet companies, which were MSN, Yahoo and AOL, have all apparently supplied at least some information to the DOJ. The request, in and of itself, doesn't appear at first glance to violate any privacy, as the DOJ has not requested any personal information, just search queries, so why the fight?

Google, do you not want to protect children from pornography? Look, I'll be the first to admit that I'm not sure a law like this would do a lot, but then again, you never know. We ought to be doing everything we can to protect children from online smut like pornography. YES, parents ought to be more involved in the activities of children online. The sad truth is that there are WAY too many parents who aren't involved. IF parents would be involved, then no laws like this would be required.

See, I'm lucky. I use and understand technology every day as it relates to computers. For a lot of parents, that isn't the case. Their kids know more about computers and the Internet than they do! I know that I can protect my kids. DAMN straight I am going to do everything in my power to protect them. What I can't figure out is why Google won't. Their excuse? It would potentially divulge trade secrets. Gimme a freaking break. Thanks, Google, for all your work to protect our children. I'll switch my search engine back to MSN now.

Have you ever wanted to create a one-node standalone cluster?

2006-01-18T14:56:00.000-06:00

I had to do this very thing recently, with the catch that there was no shared storage. But a one-node cluster isn't a cluster at all, you say? I suppose it isn't in the normal sense of the word, but it was configured using Cluster Administrator, and there is an Exchange Virtual Server object created in Exchange System Manager.

The biggest catch to configuring this was that there was no shared storage available, so everything was configured locally. Thankfully, Windows 2003 is smart enough to see when there is no shared quorum resource available, and it creates a Local quorum drive.

The problem with this approach is that in order to install Exchange on a clustered system, a Distributed Transaction Coordinator resource must exist. No problem, you say - I'll just create one. Oops - it won't start. Turns out that there is a hotfix available that allows the DTC resource to see a local quorum drive. KB 897667 details a COM+ hotfix that must be applied. The problem is detailed in KB 899426. Once you apply this hotfix, the DTC resource will successfully come online, and then you can install Exchange.

Why go to all this trouble, you ask? Clusters behave differently. In this case, I needed to bring up 3 clustered Exchange servers to reproduce a problem. Since I didn't have shared storage readily available, this was the next best option.

Installing Apple Quicktime

2006-01-17T09:47:00.000-06:00

I was just thinking about my installation experience the last time I needed to install Quicktime, and how I (seemingly) had to install iTunes with it (which I didn't want, or need), and just saw Susan Bradley's blog talking about this very thing.

Funny enough, the second time I installed it, I managed to find the quicktime only download, but it sure doesn't make me happy when software companies such as Apple try and intentionally make it difficult to only download quicktime player without any additional "stuff". In fact, it makes me want to avoid installing it altogether.

Go to the Quicktime download site, and see if you can find the standalone installed for Quicktime, without looking REALLY hard for it.

Newsflash to Apple: You aren't earning fans by doing this.

Been a little busy lately :-)

2006-01-17T09:25:00.000-06:00

I haven't posted anything to my blog in almost a week. Check that - a little over a week. Things have been a little crazy around here. We've been doing some internal Beta testing of new applications here at work, my wife has been busy having our baby

(insert sound of scratching record...)

Oh yeah...
My wife gave birth to the newest member of our family, Carli Hart Winzenz, at 8:53am on Saturday January 14th, 2006. This was a bit surprising, because she was almost 4 weeks early at that point. All 3 of our other children were born roughly on their due dates, or within a few days of it (none of them were late though). The nurses all joked and blamed it on the full moon. They said there were a TON of births this past weekend.

Anyway, Carli was 5 lbs 15 oz, and 18 inches long. She's TINY! At least compared to our other kids. Despite being almost 4 weeks early, she seems to be thriving. Her lungs definitely work (though her cries aren't really loud yet), and she doesn't like diaper changes.

I'm also posting the obligatory few pictures (just a smattering of the many we took). Carli is child number 4 for us, and we're absolutely thrilled to have her.

Vista Upgrade Pain (build 5270)

2006-01-08T23:05:00.000-06:00

I've got a few computers running Windows Vista. The first one is a desktop machine with an Athlon XP 2200+, 512mb ram and an older video card (very soon to be replaced). The second is an HP Pavilion ZD7000 laptop, with a 2.66Ghz P4, also with 512mb ram, and a GeForce FX5600 Go. I haven't had anything important on my desktop PC, because, well, it's pretty much dedicated to Beta testing at the moment. Since no one else uses it but me, it's fairly easy to keep it clean. However, the laptop is what we are using as a home PC at the moment. Nothing like trying to load some kids games to give Vista a good test :-) Anyway, because it gets used as our home PC, there was quite a bit of information that I didn't want to lose if I could help it.

Right before Christmas, build 5270 was made available to beta testers (it's on MSDN now...). so I figured it was time to load it up on these PC's. The desktop PC was no problem - I formatted the hard drive so as to get a clean build. Installation went fine and everything was up and running fairly quickly. I did notice that 5270 includes some additional drivers that previously weren't there (my USB wireless adapter), so that was nice.

The laptop was a different story. Since I wanted to keep some of the data, I decided to try and to a new install without formatting. Big mistake. The process went something like this:
1. Boot from Vista DVD - start setup.
2. Choose existing partition. Setup informs me that it has detected an existing Windows installation and if I continue, it will rename the windows directory to windows.old, etc. Fine by me.
3. Setup continues (and takes a LONG time). It reboots the first time and resumes setup (as normal), but after appearing to finish and rebooting a final time, the only thing I get is a black bootup screen telling me that Windows has detected problems with the bootup environment (or something similar). Specifically, it tells me that ntoskrnl.exe is missing.

Ok, I've got an external USB hard drive case for laptop hard drives (it's really more just a circuit board with the IDE connector going to a USB connector), so I pull out my hard drive and hook it up to my other laptop (running XP). I browse the directories, and I see that the old Windows directory was renamed properly (old user profiles were moved inside the Windows.old directory), and when I look in the windows\system32 directory, sure enough, there is no ntoskrnl.exe file present. That's weird!

I think to myself that it must have just been a glitch with the setup proces, so I'll do it over. Oops - now there isn't enough space left. Vista needs 8gb of free space in order to run setup. I had to go in and whack the windows directory that setup created along with a bunch of the temp installation files (note to Vista team - make sure that setup cleans up any temp files once it RTM's). Once that's done, I run setup again. SAME result. Unfortunatlely, I don't know how to extract that one file from the DVD (note to self - need to find this out), so I try asking around for a copy. I was desperate! Anyway, no one had a copy immediately available, and no one seemed to have encountered this problem before (my newsgroup question still remains unanswered to this day).

The end result (there was no "solution") was that I used my new DVD burner that I got for Christmas to back up all the documents, pictures, and other data that I wanted (though somehow I forgot our PST file - bummer). Once that was done, I formatted and got Vista to install with no problems. Ugh.

Now for the next part of the story. We had been using Office 2003 on the previous Vista build with no issues whatsoever. However, when I installed Office 2003 on this build, Outlook would not download any mail from my POP accounts. Totally weird! I tried everything I could think of, including completely removing office, deleting the office directory, re-creating the mail profile, etc. etc. Nothing seemed to work. So, I'm also on the Office 12 beta and decide to try and install that, or rather "upgrade" to Office 12. I'm mystified that right at the end of setup, there are some registry keys that setup doesn't seem to be able to access. When I check the keys, the owner shows up as a SID, and I can't change permisssions (System only had read access as well as Administrators). I tried changing permissions on all the keys that it mentioned to no avail. Finally, I completely removed Office 2003, then installed Office 12 and it worked fine. As soon as I installed Office 12 and configured Outlook, it began pulling down all my mail again. PHEW! At least we had webmail access to the mail for the period of time it took to sort this out. What a mess!

Do you have an upgrade horror story? Send me your link.

Microsoft provides patch early

2006-01-05T14:33:00.000-06:00

Microsoft has released a patch for the WMF vulnerability that could potentially result in an attacker taking control of a compromised system. Initially, Microsoft was going to wait and release the patch next Tuesday on "Patch Tuesday", however, based on customer feedback, they have decided to make it available immediately.

I have verified that it is available via Microsoft Update (Windows Update should be the same). I'd suspect that folks that use SUS and WUS will download it tonight (or the next time their servers check). It's also available on the Microsoft Download center should you want to use that.

You can read about the details of the vulnerability here. I'd recommend applying this update immediately. A reboot may be required once it has been applied. I can't say for certain, as I applied another update along with this one.

Hook 'em Horns!

2006-01-05T08:44:00.000-06:00

I must shamelessly admit that I am a University of Texas fan, and a sports junkie!

As I'm sure many of you did, I watched the Rose Bowl last night. We gathered at a friends house and watched it on this. A-ma-zing. Very clear picture. I WANT ONE!

Anyway, have you ever noticed that you get into a game a lot more when you are gathered with others? I was sitting on the edge of my seat almost the entire time. I'm surprised I didn't lose my voice last night - we were all yelling and screaming for most of the game.

Coming off watching the Orange Bowl the previous night where it went to triple overtime, I wasn't sure the Rose Bowl would live up to all the hype, but boy did it ever. Talk about 2 competitive (and good!) teams...

Congratulations to Vince Young and the rest of the University of Texas team on winning the College Football National Championship. They deserved it, and played like they deserved it as well.

MSN Spaces getting a lot of (negative) press

2006-01-03T15:37:00.000-06:00

I'd venture to say that it isn't very positive either. Robert Scoble was one of the first to bring this news to light in the mainstream blogs and he's not real happy about it. I'm not really sure where I stand here. On one hand, the Code of Conduct for MSN Spaces does seem to quite clearly spell out the rules and seems to quite clearly state that at their sole discretion, they may remove content, delete postings, ban users, etc. Listed here is the Code of Conduct from MSN Spaces.

Prohibited Uses

Violations of the MSN Spaces Code of Conduct may result in the termination of access to MSN Spaces services or deletion of content without notice.

You will not upload, post, transmit, transfer, disseminate, distribute, or facilitate distribution of any content, including text, images, sound, data, information, or software, that:

incites, advocates, or expresses pornography, obscenity, vulgarity, profanity, hatred, bigotry, racism, or gratuitous violence.
misrepresents the source of anything you post, including impersonation of another individual or entity.
provides or create links to external sites that violate this Code of Conduct.
is intended to harm or exploit minors in any way.
is designed to solicit, or collect personally identifiable information of any minor (anyone under 18 years old), including, but not limited to: name, email address, home address, phone number, or the name of their school.
invades anyone's privacy by attempting to harvest, collect, store, or publish private or personally identifiable information, such as passwords, account information, credit card numbers, addresses, or other contact information without their foreknowledge and willing consent.
is illegal or violates any local and national laws that apply to your location; including but not limited to child pornography, illegal drugs, copyright material and intellectual property not belonging to you.
is intended to threaten, stalk, defame, defraud, degrade, victimize, or intimidate an individual or group of individuals for any reason; including on the basis of age, gender, disability, ethnicity, sexual orientation, race, or religion; or to incite or encourage any one else to do so.
intends to harm or disrupt another user's computer or would allow others to illegally access software or bypass security on Web sites, or servers, including but not limited to spamming.
attempts to impersonate a Microsoft employee, agent, manager, host, another user, or any other person though any means.

Termination and Cancellation

Microsoft reserves the right, at its sole discretion, to review and remove user-created services and content at will and without notice, and delete postings or ban participants that are deemed objectionable.

On the other hand is the question of whether this type of censorship is good for blogs. Isn't the whole point of blogging being able to express yourself? Plus, who exactly is determining if content meets these criteria? Is it individual people? A group of people? An automated engine that searches for certain criteria? What constitutes grounds for removing the blog (space)? Do users get any warnings?

I'll be the first to admit that I don't know what type of content was being posted by Zhao Jing(Michael Anti). The limited information I've read seems to indicate that he pushes the boundaries of what is acceptable. Is that like Howard Stern on US Radio where he was fined by the FCC? I don't know. I'll publish any updates as I see more information on this.

RBL's - are they really worth it?

2005-12-29T14:06:00.000-06:00

I just added some new feeds to my RSS reader (which happens to be Outlook 12 right now) and I happened to notice a blog on Ant Drewery's blog from a few weeks back which talks about something that I feel strongly about - namely RBL's. For the most part, I despise them. Why? One main reason. Unless you build and maintain your own RBL (which I'd submit is just fine), YOU have no (or very little) control over WHO gets listed or how they (or you) get off. Let's face it - some of the folks that maintain some of the public RBL's that are available just don't care. Others want money in order to de-list you (when you get listed for some off-the-wall insane reason that no one in their right mind would do).

I understand the fight against spam - I really do. I sympathize with companies that are burdened with a lot of spam. It can get very nasty. However, working in the e-mail field, RBL's affect a lot of things negatively, and are very often used indiscriminately by novice admins. You try explaining to your CEO why that 2 milion dollar deal can't be sent to a customer because the customer uses a RBL that has you listed on it...

I am a very strong proponent of anti-spam, but using RBL's isn't a method that I encourage - at least not to BLOCK e-mail. Use RBL's as a way of increasing the spam score of an e-mail, but don't block using them. Use SPF/SenderID as a way of increasing the spam score of an e-mail, but don't block based on missing/incorrect SPF/SenderID records. Use Reverse DNS as a way of increasing the spam score of an e-mail, but don't block based on missing/incorrect PTR records. Now blocking e-mail for invalid e-mail addresses? That's another story. I'm all for doing that. :-)

Exchange 12 64-bit only information

2005-12-29T13:24:00.000-06:00

Terry Myerson goes over a few of the reasons why Exchange 12 will be shipping in 64-bit only code. The reasons make sense. I know there will be many who second-guess this decision and will say that it will prolong or delay the adoption rate of E12 by many companies. Initially, I thought the same thing, but I'm not so sure any more. It's all too early to tell anyways, as the RTM for E12 is likely more than a year away.

Sometimes the easiest problems are the most difficult

2005-12-23T21:25:00.000-06:00

I work a lot with our developers and QA folks. Heck, I maintain all of their environments, so I have to work pretty closely with them. Most of the problems that occur are fairly easy to fix, but I had one crop up today which absolutely stumped me for a while.

The environment is a 2-node Exchange 2003 Active/Passive cluster. It was reported to me that all of a sudden after a failover, something in the cluster wasn't working, and it was preventing QA work on that cluster. Because one of the cluster resources was failing, they couldn't use our product to manage/fail over the cluster. OK, I say, I'll have a look.

So, I RDP to the server and look at Cluster Admin, and I find that the Message Transfer Agent resource is failing to come online. Let's see what happens if I just try to bring it online. Bzzzzt - thanks for playing. Ok, so I check the event logs. I see a Event ID 9400 for the Exchange Virtual Server saying that it is unable to open a particular file. That's odd. Ok, there has to be a KB article relating to this. Sure enough, I find http://support.microsoft.com/default.aspx?scid=kb;en-us;154385, which tells me that the file may be missing or corrupt.

So, I look in the c:\program files\exchsrvr\mtadata directory, thinking that I'll find that the specified file isn't there and it will be an easy fix. Well, it's present in the directory, so I decide to replace it. Copied it from the CD, removed the Read only attribute (that is important!) and tried to bring the resource online. No joy. I went around and around for a while, even replacing ALL of the files in the mtadata directory from the CD. Still doesn't work. I had put it on hold for a while and decided to look some more this evening. Oddly enough, it was a KB article written for Exchange 4.0 of all things that allowed me to figure out the problem. http://support.microsoft.com/default.aspx?scid=kb;en-us;162384 discusses a series of steps of how to troubleshoot MTA failures. One of the parts of the article talks about checking the parameters section of the registry associated with the MTA. HKLM\System\Current Control Set\Services\MSExchangeMTA\Parameters is where it's at. As soon as I looked at that, I spotted 2 values that didn't look right. The MTA Database path and MTA Run directory both pointed to another drive.

When I looked at the directory that those 2 values pointed to, I noticed that there were some missing files. I didn't have time or the desire to find out at that point how they became missing, but I was able to solve the problem by copying the files from the c:\program files\exchsrvr\mtadata directory to the directory specified in the registry. Once I did that, I was able to bring the MTA resource online and was able to successfully fail the cluster over to the other node and have the MTA resource come online as well.

Lesson learned: Don't forget to check the basic stuff. If I would have thought to check the registry, I probably would have saved a lot of time trying to figure out this problem.

Funny story about Hotel wireless

2005-12-08T08:58:00.000-06:00

Just read a story on one of my other feeds about a guy who is a network
security engineer was having troubles with a very slow hotel wireless
internet connection. The problem, he found, was that someone else was
using a P2P app and hogging all the bandwidth. Read here about his creative way of getting this guy
off the network.

While I probably wouldn't have done this, it's still pretty funny,
whether it is true or not...

Enabling SMTP Tarpitting in Windows 2003

2005-12-07T10:01:00.000-06:00

It's no secret that Windows 2003 now includes a mechanism to enable SMTP
Tarpitting. Tarpitting is, in short, delaying the response (5.x.x
response, specifically) your server sends after a certain number of
invalid RCPT TO: commands. With each invalid name submitted, the delay
will grow longer. What does this accomplish? It makes e-mail
operations more expensive for spammers. Why? They thrive on the
ability to send as many e-mails as possible in a given period of time.
If you make it so they can't send as many e-mails, the operations become
more expensive. Does it stop them? No, but it may thwart their efforts
a bit, especially in sending spam to *your* domain. Now, in order to be
useful, you have to enable Recipient Filtering, and specifically, the
option to "Filter Recipients who are not in the Directory". This is
really the only way that tarpitting will work, because with the
recipient filter enabled, Exchange will issue a 5.1.1 response
indicating "User Unknown". Tarpitting delays those 5.1.1 responses.

Another reason that tarpitting can be very useful is to prevent
Directory Harvesting Attacks. If you simply enable recipient filtering,
it's possible that a spammer can harvest your list of users simply by
brute force spamming your domain. Since invalid users would immediately
generate the 5.1.1 error, it wouldn't be that hard to make a list of
those addresses that are valid. I'm sure that it would take a bit of
time to accumulate that list, but what do they care? By implementing
tarpitting, you make the likelihood of someone successfully harvesting
the list of users much less likely. It doesn't make it impossible, but
much less likely.

http://support.microsoft.com/?id=842851 describes how to implement SMTP
Tarpitting in Windows 2003, but what it doesn't mention is that in order
to use tarpitting, you actually need to have a hotfix installed. That
hotfix is mentioned in http://support.microsoft.com/kb/899492. While
KB842851 has a link to this article, there is nothing that states that
you need the hotfix. This hotfix is actually included in Windows 2003
SP1, so if you don't want to call PSS and ask for the hotfix, simply
make sure that you are running Windows 2003 SP1.

So you want to change the location of IIS files or directories with Windows 2003?

2005-12-06T10:14:00.000-06:00

How do I do that, you ask? Well, it sort of depends on what you need to
change. It also depends on whether you have Exchange installed. Let's
assume that you do for the purposes of this exercise, though I'll
include information on how to change them if you don't.

Changing SMTP information:
Some of the SMTP locations can be changed from within Exchange System
Manager. These include the Badmail Directory and the Queue directory.
To change these 2 locations, simply navigate to the Server, Protocols,
SMTP, Default SMTP Virtual Server and go to the properties. Then, go to
the Messages Tab. You will see locations where you can browse and
select the directory for the Badmail and Queue directories. However,
this doesn't allow you to change the Pickup directory. While there may
not be much need to change it, you may still want to for the sake of
organization. For a server that has Exchange installed, this
information is stored in Active Directory, and as such, should be
modified there rather than in the IIS metabase.

Exchange uses a documented process called DS2MB (Directory Service to
MetaBase) to replicate information from Active Directory (such as
Default Domain setting on Exchange Virtual Server, etc.) into the IIS
Metabase. If the SMTP Pickup directory is modified using MetaEdit
(Windows 2000) or by modifying the XML file (Windows 2003), it is
possible that the DS2MB process will overwrite those values with those
that are stored in Active Directory. For this reason, as a rule of
thumb if the attribute is stored in Active Directory (as well as the
Metabase), it should be modified in Active Directory.

http://support.microsoft.com/?kbid=822933 (How to change the Exchange
2003 SMTP Mailroot folder location) is a good reference for this for
Windows 2003/Exchange 2003.
http://support.microsoft.com/kb/318230/ (How to change the Exchange 2000
SMTP Mailroot directory location) is the Windows 2000/Exchange 2000
version.

Note that both articles reference rebooting the Exchange server at the
end. I don't think that step is actually required, and would prefer not
to restart a server, but I leave that to your discretion.

What if you don't have Exchange installed?

If you recall, with Windows 2000 (IIS 5.0), if you wanted to modify this
information, you had to do this with MetaEdit, which allowed you to
directly modify the IIS Metabase (Metaedit looks similar to a registry
editor). Well, with Windows 2003, MetaEdit is no longer necessary.
Now, the entire IIS metabase is stored in an XML file (yes, that's
right, XML). This XML file is located in the
c:\windows\system32\inetsrv directory and is called metabase.xml. Just
open it with your favorite text editor (I prefer EditPad Lite or Notepad2, both free for personal
use, and much more functional than notepad itself) and if you scroll
down far enough (or search for it), you will see information such as
below. The IIsSmtpServer Location section contains information related
to each SMTP Virtual Server. The first one is, aptly enough, instance
1, thus the SmtpSvc/1. Under there are several options. One of them,
shown below, shows the Pickup Directory. The example shown below makes
reference to Exchange, so the path would be different on a standalone
SMTP server. Simply make the change, save the xml file, and restart the
appropriate service(s), or perform an IISReset. Or, if you are brave
:-) you can enable direct metabase editing, which will apply the changes
on the fly. Note that even on standalone SMTP servers, some information
may be available to modify using IIS Manager, but if you are going to be
changing several values, it may be easier to simply modify the XML file.

IIsSmtpServer Location ="/LM/SmtpSvc/1"

Name="PickupDirectory"
ID="36880"
Value="C:\Program Files\Exchsrvr\Mailroot\vsi 1\PickUp"
Type="STRING"
UserType="IIS_MD_UT_SERVER"
Attributes="NO_ATTRIBUTES"

Changing NNTP information:
In the same XML file, you'll find the NNTP Virtual Server Settings.
While most people running Exchange probably don't configure NNTP, if you
do, you may have a desire to change this information. Keep in mind that
by default, NNTP newsgroups are actually stored in Public Folders, so
you won't find them in a local directory. As with SMTP, if you find any
of these settings in Exchange System Manager, or in Active Directory,
they should be modified there rather than the IIS Metabase. I believe
you'll find the virtual directory information within Exchange System
Manager, but I didn't see much else.

IIsNntpServer Location ="/LM/NNTPSVC/1"
AllowControlMsgs="FALSE"
ArticleTableFile="C:\Inetpub\nntpfile\article.hsh"
GroupHelpFile="C:\Inetpub\nntpfile\descrip.txt"
GroupListFile="C:\Inetpub\nntpfile\group.lst"
GroupVarListFile="C:\Inetpub\nntpfile\groupvar.lst"
HistoryTableFile="C:\Inetpub\nntpfile\history.hsh"
ListFile="C:\Inetpub\nntpfile\listfile.hsh"
MaxConnections="5000"
ModeratorFile="C:\Inetpub\nntpfile\moderatr.txt"
NTAuthenticationProviders="NTLM"
NewsDropDirectory="C:\Inetpub\nntpfile\drop"

NewsFailedPickupDirectory="C:\Inetpub\nntpfile\failedpickup"
NewsPickupDirectory="C:\Inetpub\nntpfile\pickup"
PrettyNamesFile="C:\Inetpub\nntpfile\prettynm.txt"
SecureBindings=":563:"
ServerAutoStart="FALSE"
ServerBindings=":119:"
ServerComment="Default NNTP Virtual Server"
XoverTableFile="C:\Inetpub\nntpfile\xover.hsh"

IIsNntpVirtualDir Location ="/LM/NNTPSVC/1/ROOT/_slavegroup"
Path="C:\Inetpub\nntpfile\root\_slavegroup"
VrDriverProgid="NNTP.FSPrepare"

IIsNntpVirtualDir Location ="/LM/NNTPSVC/1/ROOT/control"
Path="C:\Inetpub\nntpfile\root\control"
VrDriverProgid="NNTP.FSPrepare"

Changing Website information
Ok, so we've talked about both SMTP and NNTP. How do you change the
directory for the Default website? That's quite a bit easier. Simply
open IIS Manager, go to the properties of the default website, and
modify the Home Directory to point to the new path you designate.
Though you are prompted to specify the location of the Home Directory
for all new websites created, this same method applies to any websites
that you may want to move to another volume. Don't forget to copy the
contents of your old website to the new location prior to changing it in
IIS Manager :-)

Worth noting is that you need to be careful of any changes that might be
propagated to virtual directories underneath the website.
Exchange-specific virtual directories correspond to special locations
that you don't want to change :-)

Do you want to open a hidden mailbox or send a message to a hidden mailbox?

2005-12-05T13:05:00.000-06:00

There are really two ways that you can accomplish this.

Method 1:

Unhide the mailbox/user account, wait a few minutes for replication,
then add the account under the Account options (Tools, E-mail Accounts,
Change, Advanced, Add additional mailboxes). This would for obvious
reasons also allow you to send a message quite easily to the now
unhidden account. The only exception here is if you are using Outlook
2003 with cached mode and using the Offline address book, it would
require a rebuild of the offline address book (and re-download of OAB)
in order to get it working.

Once you have added the account to Outlook, you can then re-hide the account.

Method 2:

Use the legacyExchangeDN attribute of the account to add the mailbox.
Pre-Exchange 2000, you did this by adding the actual Distinguished Name
of the mailbox, which could be obtained by opening the Exchange Admin
program in raw mode and obtaining the DN of the object. Details of
doing that are documented in http://support.microsoft.com/?kbid=142781.

With Exchange 2000 and newer, this capability still exists, but instead
of using the DN, you use the legacyExchangeDN. Note that using the full
Distinguished Name of the object will not work for Exchange 2000 and
newer - it must be the legacyExchangeDN. Use the same procedure as
Method 1 (Tools, E-mail accounts, etc.) and when prompted for the
mailbox, enter the full legacyExchangeDN. You will notice that it is
then changed to the display name of the hidden object. This process
works the same when addressing a message to a hidden recipient. Simply
paste in the legacyExchangeDN, hit Ctrl-K, and the name will be resolved
to the display name of the hidden user.

How do you get the legacyExchangeDN value, you ask? Easy. Use ADSIEdit
(part of the Windows 2000/2003 support tools), or use your favorite LDAP
client (ldp.exe is either part of the support tools, or part of the
Resource Kit) and list the attributes of the hidden user.

Note that the above instructions assume that you are adding a hidden
mailbox as an "additional" mailbox, but the procedure should work the
same for setting up a new profile.

My new toy - Imate Jasjar

2005-12-01T08:29:00.000-06:00

Ok, so I've got a new toy. I previously owned a Dell Axim X5, but
unfortunately, didn't use it a whole lot. Why? To be honest, a
standalone PocketPC doesn't offer a ton of value to me. Sure, it was
intrigueing at first, and I used it for things like creating grocery
lists, and I installed some programs on it like an eBook reader, but it
wasn't something I used every day. It didn't have phone functionality
and it didn't have built-in wireless. One nice thing I did like was
that it had both a CompactFlash AND Secure Digital memory slot.

Anyway, back to my new device...

The Imate Jasjar is a Windows Mobile 5.0 device with a 62-key QWERTY
keyboard, and a 180-degree swivel screen. It also includes 2 cameras
(one for video conferencing) and is a fully functional phone. The size
is about as big as most other Pocket PC's, which means that if you will
be using it as your primary cell phone, you will want to have a
earpiece, likely a Bluetooth headset. Details about the Jasjar can be
found on Imate's website here:
http://www.imate.com/DETAILS_JASJAR.htm

First thoughts...
1. Needs a more robust voice-dialing package. Microsoft Voice Command
is supposed to do wonders - the built in Voice dialing package just
doesn't have enough features. Having a Bluetooth headset that supports
CallerID would be great here too, but I'm not about to shell out for one
yet.
2. I LOVE the swivel screen. I almost think of this as a mini-tablet
PC. Handwriting recognition works very well (I tried writing very
sloppily and it still correctly translated it to text).
3. The speed seems slow, even compared to my old PPC (300Mhz). This
has more memory (Flash and RAM), and also has a 520Mhz processor.
Hopefully this will change with ROM updates that optimize some more
things.
4. Syncing with Exchange via ActiveSync leaves a little bit to be
desired. I can't wait for the Messaging and Security Feature Pack
(MSFP) - it should improve things quite a bit. Notably, there will be
no more SMS messages to notify the device that there is new mail. I've
found so far that another area where Exchange ActiveSync isn't quite
like BES is that Exchange only notifies you when there are new messages
in your Inbox. If you are like me, and have server-side rules to move
messages into other folders, you will not be notified when messages get
dropped in those folders. I don't know of a way to configure ActiveSync
to notify you if messages arrive in folders other than your inbox.
5. The battery life can be pretty bad. Coming from my Axim, where the
battery would last the better part of a week, my Jasjar lasts about 2
maybe 3 days if I don't use Wireless. If I do, I pretty much have to
recharge it on a daily basis. I'm sure that the extended life batteries
will be gobbled up once they come out.
6. This is a quad-band phone, but coverage in the US will likely be
spotty. It only supports the 1800Mhz US GSM band, which both Cingular
and T-Mobile use, but Cingular also uses the 850Mhz band. I've been
using this with T-Mobile, and haven't had any problems with coverage
thus far. Phone quality seems fine. The packaged earpiece is good. I
should note that the Jasjar uses a standard size 3.5mm plug instead of
the mini one that most cell phones use.
7. AWESOME screen. It has a VGA screen (640x480 resolution) that is
stunning. I had a few days with both this and my old Axim, and there is
just no comparison. Even using the Terminal Services client is now
usable.
8. The keyboard is very usable. I've tried typing e-mails on
Blackberry devices - they are horrible (for me). The size of the keys
on Blackberries is too small for me to thumb type (which is what you
need to do). The keys on this are just the right size. If you want,
you can even set it on your desk and type with a few fingers - this also
works well. There is also a backlight that lights up the keys in a red
glow in low light situations. My only complaint about the keyboard (a
weak one at that), is that there is only one shift key and Function key
(on the left side of the keyboard), so if I have to type a symbol, I
have to use my left hand to hit the shift or Fn key, even though there
are some keys with symbols on the left side of the keyboard.

Do you use a Windows Mobile device? If so, which one do you use? Does
it have phone capability? Are you able to use it as your only mobile
device?

Outlook 12 First thoughts

2005-11-28T10:22:00.000-06:00

1. I like the new Ribbon UI design. Sure, it will take some getting
used to, but it would appear to be more functional than using the menus.

2. I like that there is a built-in RSS reader. I don't quite like the
functionality yet, but we'll see how it does. So far, comparing it to
my previous RSS reader (Intravnews), Intravnews is still a much better
choice. Since this is still Beta 1, I'd suspect that Outlook's handling
of RSS will get better.

3. So far, I'm not so fond of the memory usage. When I first
installed, I upgraded from Office 2003 SP2. Perhaps that was my first
mistake. After the upgrade, my CPU frequently shot up to 100% and
memory usage went as high as 700mb (I have 1GB installed on my laptop).
YIKES! It seems that the solution ended up being deleting and
re-creating my profile. Why (or how) my profile would have caused this
is beyond me, especially since my laptop was just recently rebuilt and
Office 2003 had only been on there for about a week. Anyways, now that
the CPU usage is under control, Outlook is still using quite a bit of
memory. I'm told that this may be by design, but I don't see any
documentation (yet) that references this.

4. There is a new cool "To-Do Bar", that identifies upcoming things.
It shows you a condensed Calendar view (month view), upcoming meetings,
and tasks. It doesn't take up a lot of space, and is quite
informational. This is definitely a big plus.

5. Word is now your default E-mail editor. All I will say is, let's
hope that Word as e-mail editor has vastly improved. That used to be
one thing I would always turn off.

As I continue testing Office 12, I'll post additional thoughts.

New announcements at IT Forum

2005-11-15T14:23:00.000-06:00

Lots of new announcements at IT Forum in Barcelona.

1. Exchange 12 will be 64-bit only. This is sort of a bummer for
anyone that has non 64-bit hardware, but honestly, there is quite a bit
of hardware that is x64 capable right now, and that will only increase.
Let's review what current processors support x64.

Intel's moniker for x64 is EMT64. The following processors from Intel
support EMT64:
Xeon (2.8Ghz and above)
Pentium D (2.8Ghz - 3.2Ghz)
Pentium 4 Extreme Edition (3.2Ghz)
Pentium 4 with Hyper threading support (most 2.8Ghz and above with some
exceptions)
Celeron D (some starting at 2.53Ghz and above)

AMD also has quite a few products that support x64:
Opteron (all)
Athlon 64 (all)
Other mobile-based 64-bit processors weren't mentioned...

Many of these products have been out for quite a while now. In fact,
you may be surprised to find that your system already supports x64. It
may perhaps require a BIOS update, but if you are running an x64 capable
processor, odds are that the rest of the hardware supports 64-bit
computing as well.

Really, it makes sense - in order to lift some of the memory constraints
(we're talking virtual memory constraints here), 64-bit is really the
only way to go.

2. The pricing for Virtual Server has been dramatically reduced.
Virtual Server R2 Standard
Was: $499
Now: $99

Virtual Server R2 Enterprise
Was: $999
Now: $199

VMWare - watch out :-)

Seriously though, this is a pretty substantial change. With the new
licensing changes, If you buy one license of Windows Server and are
running Virtual Server 2005 R2, you can run up to 4 additional instances
of Windows Server at no extra cost.

3. Several other products will be 64-bit only as well. Among those are
Windows Compute Cluster Server 2003, Windows Server "Longhorn" Small
Business Server and another server product code-named "Centro". Other
applications will be (or are) optimized" for 64-bit, including SQL 2005,
Visual Studio 2005 and Virtual Server 2005 R2.

The Microsoft Press release can be found here
and a related article on Infoworld can be found here

Followup on Sony DRM Rootkit

2005-11-10T17:07:00.000-06:00

I'm really not sure how this can get much worse for Sony. I've been following Mark Russinovich's blog regarding this topic. If you haven't followed his posts, you can read the series here.

First post: Sony Rootkits and Digital Rights Management Gone Too Far

Second post: More on Sony: Dangerous Decloaking Patch, EULAs and Phoning Home

Third post: Sony’s Rootkit: First 4 Internet Responds

Fourth post: Sony: You don’t reeeeaaaally want to uninstall, do you?

more to come???

Let's just say that his discovery has made a lot of folks look at DRM in a whole new light, especially the method that Sony is using.

As a result of the information that Mark discovered, several Antivirus vendors have already classified the hidden rootkit software as varying degrees of spyware. On top of that, Microsoft is now "concerned", but hasn't decided yet whether to detect/remove the rootkit software or not. Sony is also facing a potential criminal investigation by Italian Police (that can't be good). You can read more about that here. There is also a lawsuit that has been filed in California. Now, admittedly, there are lots of lawsuits filed every day, and I'd suspect a fair amount of them simply get thrown out, but if this does end up going to court, not only could it hurt Sony, but also the artists whose CD's are protected by this DRM technique. I'm not sure I would want to be a musician on a Sony label right now...

Finally, Sony was quite adamant that their "rootkit" could not be used for malicious means. To rebut that, BitDefender (among others) has detected the first Trojan that is using the Sony DRM to hide itself. So much for that. Read more about that here and here.

Obviously, Sony has a lot invested in DRM, but this is going way too far. I'll be following the developments in this and I am very interested to see how things turn out.

New Exchange tools released

2005-11-04T09:46:00.000-06:00

Microsoft released a bunch of new tools on November 2nd. Along with PFDAVAdmin, which I mentioned the other day, they have released the following tools:

1. New version of Exchange Best Practices Analyzer (ExBPA). The new version is version 2.5 and includes some enhancements and additions to both the UI and the database.

2. A new tool called the Exchange Server Performance Troubleshooting Analyzer Tool (ExPTA). At first glance, this would appear to be a tool to help admins determine root causes for performance problems. It will be able to gather perfmon counters, tracing information, etc. and then analyzes that data to present information on what the root cause could be. It seems like this functionality could be compared to tools such as Quest's Spotlight for Exchange. Though obviously more advanced, Spotlight allows admins to see potential bottlenecks and act accordingly. Still, it's nice to see Microsoft release a product that does some of this natively. I don't think it's meant to serve as direct competition for 3rd party providers of tools like these such as Quest. It's kind of like comparing NTBackup to 3rd party backup tools. NTBackup works, but it doesn't have some of the value-add functionality that 3rd party software companies can provide.

3. Another new tool called the Exchange Server Disaster Recovery Analyzer Tool (ExDRA). This should be a great tool for Exchange admins to have in their toolkit. According to the overview on Microsoft's website, it will basically gather configuration data and header information from both the databases and log files, then analyze that data and give you a list of problems as well as instructions on how to resolve the problem. I see this as a tool that is meant for the seeming trend of less-experienced Exchange admins. However, it's a tool that should be beneficial to any Exchange admin, even the most experienced ones. I know I'll definitely try it out.

You can find these tools on Microsoft's site at the following location. http://www.microsoft.com/technet/prodtechnol/exchange/downloads/2003/analyzers/default.mspx

In addition, the Exchange Team blogged about these new tools here. My feed reader (IntraVnews) didn't pick up that post for some reason, so this may be old news to you.

New version of PFDAVAdmin released

2005-11-02T12:51:00.000-06:00

Microsoft has released version 2.4 of their PFDAVAdmin utility. You can find the download here. PFDAVAdmin can be used for a multitude of things, including replicating permission, fixing permissions and exporting/importing permissions among other things.

Of note is that this was previously an unsupported utility. Although it was likely fairly widspread in it's distribution, it could only officially be obtained by contacting PSS and having them send you a copy (that would help fix a problem you were experiencing), or by grabbing a copy from the relatively unknown (or not) PSS FTP site.

Any Exchange admin who has to deal with Public folders should have this utility. It's a great tool that basically allows you to make bulk changes, and to do so easily and quickly.

SysInternals uncovers Sony DRM Rootkit

2005-10-31T16:25:00.000-06:00

That doesn't sound good...did I read that right? A Rootkit? Don't you usually associate Rootkits with hackers and malware attempting to cover their tracks? Don't know about you, but I sure do.

Mark Russinovich of SysInternals recently found that Sony's DRM protection scheme employs a rootkit in order to hide itself. Read his blog here. Not only that, but it places hooks deep into the OS that make it near impossible for anyone but the most advanced users to get rid of it afterwards. How did this rootkit get installed? Simply by playing a CD that had protected content on it on his computer.

First off, I'm not a fan of DRM to begin with. If I purchase something (song, cd, whatever), no one should be telling me what I can and can't do with that, or what devices I can and can't play it on. Secondly, for a large music corporation like Sony to resort to something like this is absolutely pitiful. It makes me lose any and all respect for them. It also stinks of a lawsuit. It will be interesting to see how this pans out. I'm betting that they (Sony) didn't count on anyone finding this out.

Make sure to read Mark's blog to get entire coverage of how he went about discovering what Sony did and how he finally got rid of it.

Exchange 2003 SP2 confusion

2005-10-25T17:06:00.000-05:00

I've seen quite a bit of confusion about SP2 and the requirements. Most of it centers around IMF and what to do if you have IMF v1 installed (SP2 containst IMF v2), and what to do if you want to enable the Sender ID checking filter.

I personally believe that these questions can be answered by simply reading the Relase Notes. They quite clearly state the following related to SenderID:

Important:
Before you enable Sender ID on Exchange 2003 SP2 server, make sure that you apply the Windows Server 2003 hotfix that is referenced in Microsoft Knowledge Base article, "Windows Server 2003 may stop responding when you enable Sender ID filtering on an SMTP virtual server in Exchange Server 2003 SP2." Windows 2000 Server is in extended support mode only. Please contact your Microsoft account representative for information about obtaining the hotfix for Windows 2000 Server. For more information about this issue in Windows 2000 Server, see the Microsoft Knowledge Base article, "Windows 2000 Server may stop responding when you enable the "Sender ID Filtering" setting on an SMTP virtual server in Exchange Server 2003 SP2."

Important:

Before you enable Sender ID on Exchange 2003 SP2 server, make sure that you apply the Windows Server 2003 hotfix that is referenced in Microsoft Knowledge Base article, "Windows Server 2003 may stop responding when you enable Sender ID filtering on an SMTP virtual server in Exchange Server 2003 SP2." Windows 2000 Server is in extended support mode only. Please contact your Microsoft account representative for information about obtaining the hotfix for Windows 2000 Server. For more information about this issue in Windows 2000 Server, see the Microsoft Knowledge Base article, "Windows 2000 Server may stop responding when you enable the "Sender ID Filtering" setting on an SMTP virtual server in Exchange Server 2003 SP2."

Of course, for now, this means that you have to call PSS to get the hotfix, but hotfix calls are free. In fact, there is even an option on the phone menu to press if you are calling for a Hotfix. you get routed to a Customer Support representative and give them the KB article and they send you the hotfix.

Regarding IMF, they also clearly state that IF you have IMF v1 installed, it must first be uninstalled prior to installing SP2. Though it is clear about what must be done during the install, what isn't clear is how to re-enable IMF once you have remove v1 and installed v2 with SP2. Bharat Suneja has a post in his blog that details how to re-enable IMF over here

Other standard rules apply, such as upgrading Front End servers prior to upgrading Back End servers.

It is also recommended to be running Windows 2003 SP1 on your Exchange 2003 server, as this is required to enable SMTP Tarpitting.

The Release Notes for SP2 can be found here. If you are planning on installing SP2, I'd highly recommend to read through them. They contain a lot of useful information, and are only a few pages long. It shouldn't take more than about 5 minutes to read through them.

Good press for AMD from HP

2005-10-20T12:15:00.000-05:00

I originally read about this over here and the original story can be found here

This really is huge news from HP. It comes from HP's Technology Forum and basically several different managers at HP state that the performance of AMD's Server class processor, the Opteron, is better than Intel's Xeon processors. When you get into 64-bit and dual-core, AMD outpaces Intel even more, according to HP.

I've always been a big fan of AMD. You gotta love them - they are the perpetual underdog in this (their market share is much lower than Intel), yet their products continue to be high quality time and time again. With HP being one of the only major vendors that sells both AMD and Intel chips in it's server lines (along with Desktop and Laptops), this sort of comes as a surprise. It just isn't common to see comments like this. It's not that I don't agree - I wholeheartedly DO agree with the comments. Benchmarks of the two processors always seem to come out in favor of AMD. Personally, I have used AMD processors for a long time. When I get another PC, it will likely be the AMD dual core desktop chip.

As a co-worker said to me, AMD is the best thing that could happen to Intel, because it forced them to compete (and innovate). More competition equals better products, which is better for us as consumers.

Outlook AutoComplete and LegacyExchangeDN

2005-10-14T10:36:00.000-05:00

Recently, I've seen several posts referring to Outlook's autocomplete feature (Automatic Name Resolution) displaying incorrect information. Specifically, this information was stored in the legacyExchangeDN value assigned to a user account. OK, I'll correct the legacyExchangeDN value, you say.

Before you do that, however, be aware of the unintended consequences of doing such. Outlook actually still uses the legacyExchangeDN value for some things. For one, it uses the legacyExchangeDN when replying to messages sent by an internal user. You don't believe me? Well, it is sort of hard to find, but try this.

Download the MDB Viewer utility (MDBVu32) from Microsoft and open your mailbox and view a message that was sent by an internal user. Specifically, look at the PR_SENDER_EMAIL_ADDRESS property. Guess what that is :-) Yep - that's the legacyExchangeDN value on an account. Still don't believe me? Use ADSIEdit and go to the properties of the user account in question. Go down and view the legacyExchangeDN. You should see that it will match the PR_SENDER_EMAIL_ADDRESS property. Now, if you modify the legacyExchangeDN value for a user account, the message still has the OLD value listed - that doesn't get modified. So, when Outlook tries to reply to the message, it tells Exchange to send to the account with the OLD value, which no longer exists. Since that value no longer exists, an NDR will be generated. Not fun.

How do you get around this? There are 3 things that I can think of.

1. Don't rename/re-use user accounts. If you want the new account to be a member of the same groups as the old one, then simply Copy the account. At one point at a previous employer, we created "dummy" accounts that were only there so they could be copied. If you make a practice of creating a new account for each new user, you won't have to deal with incorrect legacyExchangeDN values.

2. Disable Outlook's Automatic Name Resolution feature. Ok, this may not be the most viable option, but by disabling ANR, you don't have to deal with Outlook caching and displaying incorrect information in it's autocomplete names. This will allow you to leave the legacyExchangeDN value intact and not worry about

3. If you MUST change the legacyExchangeDN value, make sure that you add the OLD legacyExchangeDN value as an X500 address on the user account. This will allow replies to still work because the address Outlook tells Exchange to use is still valid.

Ben

Great new Exchange news!

2005-10-08T13:30:00.000-05:00

Exchange 2003 clusters will now support Standby clusters! What does that mean? It means that you can now recover a production Exchange virtual server to a totally different cluster. This is great news if the number of users your servers support dictate a cluster.

Evan Dodds pointed this out in his blog

Information regarding hardware requirements and instructions on how to configure the standby cluster can be found at:

http://www.microsoft.com/technet/prodtechnol/exchange/guides/DROpsGuide/2493c2d6-618c-4c49-9cb1-fff556926707.mspx

Instructions are included on how to move the production virtual servers to the standby cluster as well as how to move the virtual servers from the standby cluster back to the production cluster once it has been rebuilt/repaired. One recommendation worth noting here is that the IP address of the standby cluster is recommended to be in the same IP subnet as the production cluster. This is due to potential latency issues within Active Directory, WINS and DNS replication and client name caches, and can potentially cause the cluster resources to go offline. Obviously, if your entire production cluster is offline, then there wouldn't be much choice here, but this is one thing to take into consideration if you will be employing a Standby cluster as a disaster recovery plan.

Ben Winzenz, MCSE

MS Exchange MVP

Senior Support Engineer

MessageOne

Austin, TX

(512) 652-4500

New Exchange 2003 SP2 info posted

2005-09-14T16:13:00.000-05:00

The Exchange team has posted new information regarding SP2. They clarify a few things, notably, while it has been widely publicized that the limit for Exchange Standard will be increased to 75gb, it will not be configured as such by default. Rather, the default configured limit will now be 18gb, but can be "configured" up to 75gb via modifying the registry. The licensed limit will then be 75gbThe reasoning for this was that many Exchange Standard customers may not have the storage capacity at present to support larger databases. I can buy that, but at least the capability exists to easily modify the configured limit.

Another nice feature that will be included is that the database size check will use the logical database size - this means that empty space will not be counted. I assume that empty space is analogous to white space, as they mention that no offline defrags will be required for recovery after running out of licensed database size. The current method for being able to re-mount a database once it has reached the limit is to set Deleted Items Retention to 0 days, delete mail, then have online maintenance run to purge those items. The resulting white space can be removed via running eseutil /d to perform an offline defragmentation/compaction of the database. If the last part no longer has to be performed, this will be a welcome step, as it would reduce recovery time by several hours.

Also, there will be database size warnings that will now be generated. These warnings are configurable via another registry key. When the database has reached the threshold size, an event will be logged to the Application log. Since it's a good practice to check event logs on servers on a daily basis anyways, this will provide a mechanism for admins to receive and early warning. I'm sure that monitoring products will be updated within short order to take advantage of this new capability as well.

New videos available on Channel 9

2005-09-14T09:40:00.000-05:00

Robert Scoble has posted some new videos on Channel 9. The latest round of videos (uploaded yesterday) include:

Diving into the new Office 12

Exploring and using Windows Vista

10 things developers need to know to build a great Windows Vista app

Looking at Windows Vista's UI (AERO)

Light up an App with WPF (Avalon)

LINQ (Language INtegrated Query)

I've seen the Aero, Exploring Vista, and Office 12 videos. All I'm going to say is that it looks like there are some really cool new features coming - things that will enhance productivity. Many of these products have been showcased at PDC (going on now in LA). It sure seems like it would be an exciting time to be a developer (though I still love what I am doing).

Windows Vista hardware requirements way overblown

2005-09-09T11:32:00.000-05:00

Robert Scoble links to an article in his blog and states that the source they quoted is WAY wrong. I'm pretty sure that Robert has a newer build of Vista and can't reveal some of the information yet, but the folks that run the Beta program have already said none of the Beta1 information is NDA and we are free to blog about anything we want, including screenshots. Here is sort of my followup to Robert's post (I think his comments are down again...)

I've been reading the comments on the article in questionand am amazed at how stupid (ok, maybe stupid is the wrong word - gullible is more like it) people are and how easily they buy into this information (think Sheep). I suppose it may be because they think it's from a reliable source, but let me tell you what I've been running my Vista Beta1 on.

AMD Athlon XP 2400+ (1.8Ghz)

512mb DDR Ram

2x40gb IDE drives with SATA converters running in an SATA RAID0 array

Nvidia GeForce Ti4200 video card 128mb - I'll probably upgrade to a Radeon 9550 or 9600 so I can see how the Aero Glass features look.

Vista Beta1 runs absolutely FINE on this hardware. Ok - I don't get all the cool Aero effects. For that, you do need a DirectX9.0 video card. For those that want a list of supported video cards, the minimum requirement is NOT 256mb, rather 64mb, but I doubt you will find a DX9.0 card with only 64mb. All of the ones I have seen have a minimum of 128mb, with many having 256mb onboard memory. I don't know if the intention of the author of the article was to increase hatred of Microsoft, but the author does a pretty good job of what I think is misquoting, or at the very least, misrepresenting what was intended.

Here's a list of video cards that have LDDM support in Vista Beta1 (i.e. they can display the cool Aero effects). BTW - this information is publicly available and can be obtained simply by visiting the manufacturers websites (ATI and NVidia) and seeing what cards have LDDM drivers

Nvidia Cards

GeForce FX 5100

GeForce FX 5200 Series

GeForce FX 5500

GeForce FX 5600 Series

GeForce FX 5700 Series

GeForce FX 5800 Series

GeForce FX 5900 Series

GeForce FX 5950 Series

GeForce PCX 5300

GeForce PCX 5750

GeForce PCX 5900

GeForce 6600 Series

GeForce 6800 Series

GeForce 7800 GTX

Quadro FX 540

Quadro FX 1000

Quadro FX 1100

Quadro FX 1300

Quadro FX 1400

Quadro FX 3000

Quadro FX 3000G

Quadro FX 3400

Quadro FX 4000 SDI

Quadro FX 4400

Quadro NVS 280 PCI

ATI Cards

Radeon 9500 Series

Radeon 9550

Radeon 9600 Series

Radeon 9650

Radeon 9700 Series

Radeon 9800 Series

Radeon X300

Radeon X600

Radeon X700 Series

Radeon X800 Series

Radeon X850 Series

FireGL X1

FireGL X2

FireGL X3

FireGL Z1

FireGL T2

FireGL V3100

FireGL V3200

FireGL V5000

FireGL V5100

FireGL V7100

FireMV 2200

Mobility Radeon 9550

Mobility Radeon 9600

Mobility Radeon 9700

Mobility Radeon 9800

Mobility Radeon X300

Mobility Radeon X600

Mobility Radeon X700

Mobility Radeon X800

Mobility FireGL V3100

Mobility FireGL V3200

Mobility FireGL V5000

Mobility FireGL V5100

Radeon Xpress 200

Radeon Xpress 200M

I'm not going to address the other concerns the article seems to purport yet. Let's remember that Vista is still in Beta1! That means we are a long ways from RTM and we've already seen lots of things change. Beta2 will undoubtedly see even more changes. I hear that the Sidebar is even coming back!