Send As permission Exchange 2007

A customer asked for assistance as he was having difficulties with providing the "Send-As" permissions in Exchange 2007. To clarify the story i will talk about user A and user B. User B needs to have the send as permission on the mailbox of user A. Our customer provided Full mailbox access, and send as permission for User B on the mailbox of USer A. When User B tries to send a mail from the user A mailbox, User B recieves an error stating that User B has insufficient rights to send as user A. Checking the permissions with Adsiedit and Get-AdPermission proved that User B did indeed have the send as rights. After a small search i found out that users also need the Send-On-behalve permissions:

Powershell:

# Grant "Send on behalf" permission
Set-Mailbox -Id "User A" -GrantSendOnBehalfTo "User B"


# Grant "Send-As" permission
Add-ADPermission -id "User A" -ExtendedRights Send-As -user "User B"


# Grant full mailbox access permission
Add-MailboxPermission -id "User A" -AccessRights FullAccess -user "User B"

Note: You can add multiple users at the same time by using comma's as sepperator.

Gui:

Uninstalling Exchange Fails

I saw this issue many times on computers running Windows XP where the Exchange 2007 management tools are installed. For some reason the Exchange management tools need to be removed or reinstalled, but when the installation wizzard starts all options are grayed out. In which you cannot deselect the Exchange Management tools. Even when you start the installer you get the message the the install cannot be performed.

The easiest way and rather fail-safe is to remove the MSIinstallation through MSIEXEC.

Op a commandprompt and type following command:
Exchange 2007
[Code]
msiexec /X {24B2C164-DE66-44FE-B468-A46D9D5E6B31}
[/Code]
Exchange 2003
[Code]
msiexec /x {73404-665-00000016-05064}
[/Code]

Cross-Forest Mailbox Migration "LegacyExchangeDN".

If you are planning a consolidation of multiple Exchange organizations, you will need to move mailboxes from one organization to another. For those of you who use third party tools like Quest (or others) will probably never face the issue with the legacyExchangeDN attribute in the user mailbox. This because these tools do a conversion of the legacyExchangeDN during and after the consolidation.

But if you are planning to do the mailbox migration (or user migration for that matter) by using the Microsoft provided tools Powershell and ADMT. This article might turn out very useful.

Now what is this LegacyExchangeDN attribute and what is it used for?

For that information i would like to point you to following websites where the attribute is fully Explained by people who have far more better writing skills than me.

http://www.msexchange.org/tutorials/Understanding-LegacyExchangeDN.html

OK, migrating users and moving their mailboxes isn't that big of an issue after all.
You make sure that DNS is in order to make the trusts between the multiple Active Directory forests. Create a two way trust between the forests, and start moving users with ADMT.

Once you have provisioned the target forest with the user accounts from the source organization you can start moving some mailboxes. After moving a mailbox you start testing the moved mailbox. You check the mail routing (which you probably tested before) to see if the moved user is able to send mails. That looks OK, you ask the user to check his/her data. And everything looks fine. Suddenly you receive a call from the moved user telling you that when he replies to mails which where in his/her mailbox prior to the move, he/she gets an NDR.

You start to investigate the issue and you discover a nice Gotcha. When replying to mails Exchange uses the attribute ExchangeLegacyDN in stead of the SMTP address. As this is the legacyExchangeDN from the source forest it cannot be resolved in the target forest, and therefore resulting in a NDR.

The resolution for this issue is simple, but has to be noted before you move the mailboxes. This because you need the ExchangelegacyDN from the source forest. If you chose to remove the mailbox enabled user in the source forest in the move-mailbox script (which you use to move the mailboxes) the LegacyExchangeDN will be a bit harder to retrieve.

To make sure that you won't run into the ExchangeLegacyDN issue, you will need to make sure that the DN can be resolved in the target forest. This is required during and after the migration as long as user tend to reply to mails which originate from the old source organization (prior to the mailbox move).

For mailboxes which have been moved, you will need to add the LegacyExchangeDN from the source domain as a custom x400 address to the mailbox in the target organization. To ensure coexistence during the migration period, you will need to create contacts for all mailboxes in the source organization (which haven't been migrated). You will than add the LegacyExchangeDN from the source forest to the contact also as a custom x500 address. This makes sure that when a moved user replies to a mail (originating before the move) in his/her mailbox to a user the legacyExchangeDN can be resolved to a valid SMTP address.

If you plan to move the next batch of user mailboxes, you know you will need to remove the contacts for these users in the target forest prior to moving the mailboxes. During the time frame between the removal of the contacts, the move of the mailbox and adding the LegacyExchangeDN to the move mailbox, the LegacyExchangeDN will not be resolved in the target forest. To minimize this period it is best to put the procedure in one script and specify a domain controller. By doing so, you will not have to await replication prior to moving the mailboxes and therefore shorten the time in which the LegacyExchangeDN cannot be resolved in the target forest.

Jim Mcbee wrote about it too, and even provided a usefull script.
http://mostlyexchange.blogspot.com/2007/08/exchange-2007-legacyexchangedn-and-mail.html

Using Exchange 2007 for Resource booking

Found a very interesting article today which handles resource mailbox in exchange 2007.
The article is written by Nathan Winters, and gives a good view how to manage resource mailboxes in Exchange 2007.

http://www.simple-talk.com/exchange/exchange-articles/using-exchange-2007-for-resource-booking/

Update Roll-up 7 for Exchange Server 2007 Service Pack 1 has been released.

Update Roll-up 7 for Exchange Server 2007 Service Pack 1 has been released.
http://msexchangeteam.com/archive/2009/03/18/450863.aspx

Common Exchange 2007 Errors

· (Windows Server 2008) A new mailbox creation fails with following message: “An Exchange 2007 server on which an address list service is active cannot be found”.
The “Microsoft Exchange System Attendant” service is not running.
***********************************************************************************
· (Windows Server 2008) The exchange Data store fails to mount after disabling IPV6 on a Windows Server 2008.
Re-enable IPV6 for the network interface.
***********************************************************************************
· (Windows Server 2003/2008) When running “Setup /prepareAD /OrganizationName:%name%” following error message is received “Error:A reboot from a previous installation is pending. Please restart the system and rerun setup.”

Although the message is pretty straightforward, the same message appears after rebooting the system. The setup check following registry path “HKLM\System\CurrentControlSet\Control\SessionManager\PendingFileRenameOperations. The entries in this path are set by previous installations and are awaiting execution. For some reason the rename failed, and therefore the entry is not removed. Manually remove the entries will allow the Exchange Setup to proceed.
************************************************************************************
· (Windows Server 2008) Running “Setup /PrepareAD /OrganizationName:%name%” fails with access denied.
Be sure to run the command with administrative privileges.
************************************************************************************
· (Windows Server 2008) Following warning is shown during the setup. "Warning:Setup cannot detect an SMTP or Send connector with an address space of '*'.Mail flow to the Internet may not work properly.".
Complete the installation and create proper Receivers and connectors to assure mailflow from and too the internet.
************************************************************************************
· (Windows Server 2008) Following Warning is shown on the Client Access Server:
--------------------------------------------------------
Microsoft Exchange Warning
--------------------------------------------------------
The following warning(s) were reported while loading topology information:
Get-OWAVirtualDirectory
Completed
Warning:
The virtual directory "Exchange (Default Web Site)" is not configured correctly. This server has the Mailbox server role installed, so HTTP compression must be disabled. You can use the IIS Manager to disable compression.
Warning:
The virtual directory "Public (Default Web Site)" is not configured correctly. This server has the Mailbox server role installed, so HTTP compression must be disabled. You can use the IIS Manager to disable compression.

Warning:
The virtual directory "Exchweb (Default Web Site)" is not configured correctly. This server has the Mailbox server role installed, so HTTP compression must be disabled. You can use the IIS Manager to disable compression.
--------------------------------------------------------
OK
--------------------------------------------------------
Open the IIS Manager, click the default website, than sub sellect the "Exchange" website in the left pane. In the middle pane (under IIS), double click compresion and desellect "Enable Static Content Compression".
*************************************************************************************
-(Windows Server 2003/2008) The Microsoft Exchange System Attendant fails to start.
Following event is notted in the event viewer:
Source: MSExchangeTransportL EventID:7005

Microsoft Exchange couldn't read the configuration from the Active Directory directory service because of error: Failed to load config due to exception: Microsoft.Exchange.Common.ExClusTransientException: The Windows Cluster service encountered an error during function OpenCluster:. ---> System.ComponentModel.Win32Exception: The interface is unknown

Check your site configuration and see if the correct subnet(s) are defined.
*************************************************************************************
-(Windows Server 2003) new mailbox cannot be accessed through https://%Servername%/Owa although the mailbox resides on a Exchange 2007 mailbox server.

Inner ExceptionException type: Microsoft.Exchange.Data.Directory.InvalidADObjectOperationExceptionException message: Property Languages cannot be set on this object because it requires the object to have version 0.1 (8.0.535.0) or later. Current version of the object is 0.0 (6.5.6500.0).

The mailbox was created using ADUC (DSA.MSC) and not the Microsoft Exchange 2007 tools. Therefore the mailbox is marked as legacy and can therefore not be accessed through OWA 2007. Open the Exchange Management Shell, and type: Set-Mailbox %Alias% -applymandatoryproperties
*************************************************************************************

Exchange Store will not mount when IPV6 is disabled.

This morning i discovered that the store of a freshly installed Windows server 2008 (SBS), was unable to mount after disabling IPV6 on the interface. After re-enabling the IPV6 again, the exchange store was able to mount again.

Exchange 2007 SP1 released

The 29th of november Microsoft released Service Pack 1 for Exchange 2007.

Overview
Microsoft Exchange Server 2007 Service Pack 1 (SP1) has been designed specifically to help meet the challenges of any business and the needs of all the different groups with a stake in the messaging system. Exchange Server 2007 SP1 is a mission-critical communications tool that enables employees to be more productive and access their information anywhere and anytime while providing a messaging system that enables rich, efficient access to e-mail, calendar items, voice mail, and contacts. For the administrator, Exchange Server 2007 SP1 provides advanced protection options against e-mail security threats, such as spam and viruses, as well as the tools to help manage internal compliance and high availability needs.In Exchange Server 2007 SP1, several new features and improvements will extend the Anywhere Access capabilities of Exchange Server 2007 to help make employees more productive on whatever device they’re using, provide additional Operational Efficiency tools for administrators seeking a streamlined management and deployment experience, and enable advanced Built-in Protection for more robust high availability and compliance scenarios.Improvements in Exchange Server 2007 SP1 include: Anywhere Access• Integrated Exchange Unified Messaging functionality with Microsoft Office Communicator 2007 and Microsoft Office Communications Server 2007.• Outlook Web Access additions, including public folder access, S/MIME support, personal distribution lists, and mailbox rules editor.• Webready document viewer supports Microsoft Office 2007 documents in addition to Microsoft Office 2003 documents.• Extended language support in Outlook Web Access with Arabic and Korean spell checking.Operational Efficiency• Support for Windows Server 2008 deployments, including benefits in flexible clustering, advanced networking, and simplified management.• Additional tools in the Exchange Management Console, including public folder management and configuration options for clustering and POP/IMAP access.• Improvements to the Exchange Management Shell syntax and import-export PST in the move-mailbox command.• Wider variety of web services for application development, including public folder access, delegate management, and folder level permissions.Built-in Protection• Addition of Standby Continuous Replication (SCR) for site resilient high availability deployments.• Extended Exchange ActiveSync policies for mobile policy enforcement.• Information rights management pre-licensing by the Hub Transport role.• Secure Real Time Protocol (SRTP) support in the Unified Messaging role.• Support for IPv6 when using Windows Server 2008.