Exchange: 421 internal B channel certificate unknown

We have been seeing this error on a few of our customers with WatchGuard XTM firewalls. The resolution is to disable deep inspection of SMTP.

Go to Firewall > Firewall Policies > (select the policy that controls outbound email) > Proxy Actions > TLS Encryption. Uncheck everything under "enable deep inspection of SMTP with TLS" and make encryption rules optional.

Repeat for the inbound policy.

Getting E-Mail Auto forwarded by a Rule

Do you have a user getting email "forwarded" from a long gone employee? Do you keep old employee's mailboxes around in order to keep getting their emails or for archiving? Interestingly at least in Exchange 2003 rules will continue to fire even for disabled user accounts. If you get emails with "Auto forwarded by a Rule" in the body this is likely what you are experiencing (Unfortunately this notice was removed from later versions of Exchange). The only way to remove this rule is to recreate or enable the user, connect a copy of Outlook, login and disable the rules. Ok to be honest that is not the "only way" you can also use mcfmapi but this is more complicated and runs the risk of causing other problems.

SBS Server only 5 CALS

I have run into this several times lately and felt this issue was important enough to repost how to fix the problem. Full credit goes to the "Knight-Time Ramblings blog" who originally posted this fix.

In a nutshell Small Business Server 2003 stores its license data in the windows\system32 folder on the server and if this drive fills up it tends to corrupt the license file. There are also reports that certain AV programs may corrupt it. The best solution is of course to have a backup of these but if you don't you can fix this by doing the following

1. Open services.msc
2. Stop the License Logging Service
3. Rename %windir%\system32\licstr.cpa to something else like licstr.cpa-old
4. Copy %windir%\system32\autolicstr.cpa to licstr.cpa
5. Start the License Logging Service

Server management should now show the correct number of licenses.

Sender Email address with Apostrophe gives 550 Requested action not taken: mailbox unavailable

This was another fun one because there were no logs on the Exchange server to show it ever saw the message and my spam filtering service was passing the email and saying my Exchange 2010 server was responding with:

550 Requested action not taken: mailbox unavailable (in reply to MAIL FROM command)

The senders email address was like this first.o'last@domain.com which is technically a valid address but I frequently see admins remove the apostrophe to avoid complications.

I finally figured out that yes this error was happening where I suspected on our WatchGuard firewall. For some reason their SMTP proxy disallows this character by default even though it is valid. To fix:

• Open WatchGuard System Manager then Policy Manager. Right click the SMTP-proxy rule then select Modify Policy option.
• lick the View/Edit Proxy button in the right side of Proxy action field.
• (Fix Sender) Mail From of the SMTP-proxy, click Change View button to switch to Advanced View. Click Edit button to edit the Non-allowed characters rule.
• Add the apostrophe at the end of default Regular Expression then click OK.
  Change from [^-_.+=%*/~!&@?0-9a-zA-Z] to [^-_.+=%*/~!&@?0-9a-zA-Z']
• (Fix recipient) Rcpt To of the SMTP-proxy, click Change View button to switch to Advanced View. Click Edit button to edit the Non-allowed characters rule.
• Add the apostrophe at the end of default Regular Expression then click OK.
  Change from [^-_.+=%*/~!&@?0-9a-zA-Z] to [^-_.+=%*/~!&@?0-9a-zA-Z']
• To enable save the config to the device.

Searching returns no results even though you can see files in folder

This one was fairly obscure to find and the cause of the problem probably exists on desktops as well as servers.  I recently had a customer who could search in all of their drives and folders on their server except their main share. From within this folder I would search for *.doc or *.docx files I could see right there in the folder and it would immediately return no results found like it was not even trying to search.

The cause? Someone had removed the SYSTEM account from this branch of folders. The SYSTEM account must have full permissions to files and folders in order to index them.

Once I added the SYSTEM account back on indexing took off and indexed about 60,000 more items and I was able to search for files and get results.

Exchange 2003 to Exchange 2010 upgrade fails with public folder ACL permissions issue

I have seen a few instances now where upgrading from Exchange 2003 to Exchange 2010 will give an error of:

Access control list (ACL) inheritance is blocked for the Public Folder tree object (CN=Public Folders,CN=Folder Hierarchies,CN=first administrative group,CN=Administrative Groups,CN=<Your domain>,CN=Microsoft Exchange, CN=Services, CN=Configuration, DC=<your domain>, DC=<your domain suffix>). Re-enable the inheritance and restart setup

The easiest way I have discovered to fix this is through ADSIEdit .

Open ADSIEdit.msc, Select the Configuration partition then drill down the tree through this path

• Service
• Microsoft Exchange
• Your Exchange organization
• Administrative groups
• First Administrative Group 
• Select Folder Hierarchies 

You should now see CN=Public Folders in the right hand pane. Right click and go to properties then the security tab of both the Folder Hierarchies folder and the CN=Public Folders item. In the security tab click the advanced button and make sure"Allow inheritable permissions" is checked for both of them. After this is done retry your install.

OWA showing blank page in Exchange 2010

After certain rollups or patches are applied to Exchange 2010 OWA may start showing a blank page instead of the login page and the URL will look something like https://myexchange.com/owa/auth/logon.aspx?url=https://myexchange.com/owa/&reason=0

To fix this issue open Exchange management console go to your Exchange installation bin folder, typically this is C:\Program Files\Microsoft\Exchange Server\V14\Bin and run updatecas.ps1

Cannot add Server 2012 to existing 2003R2 DFS namespace

When trying to add a new server 2012 standard server to our domains DFS namespace which was created on a 2003R2 server (so is a 2000 based DFS) we get the following error

\\domain.local\dfs: The namespace server \\2012SERVER\DFS cannot be added. The server already hosts a namespace. You can host multiple namespaces only on Windows Server 2003, Enterprise Edition or Windows Server 2003, Datacenter Edition.

This was somewhat confusing since the server did not host any other namespaces and I had just added the same namespace to a 2008R2 server a month ago. The resolution ended up being to just go to one of my 2008R2 machines and add it from there and I was then able to manage everything else from the 2003R2 machine.

SharePoint 2013 logging in with wrong user name

There is (as of release) a bug with SharePoint 2013 that will log users into SharePoint using an incorrect account if you map a drive as a user name other than yours through the SharePoint design manager interface. This issue will persist even after disconnecting the mapped drive. It will also continue to be a problem even if you re-enable the log in as another user ability in SharePoint. It will show you are logged in as the correct user but will actually use the mapped credentials. To fix the issue you need to remap the drive with the correct username and password.

SCVMM the domain account specified for the service account could not be verified

Recently when installing system center virtual machine manager I decided to use a domain account for it so I could do HA and got the error "the domain account specified for the service account could not be verified" when trying to click next. I had just created this account while I was installing SCVMM. To fix it I ended up rebooting the machine and logging in as the service account I had created then logging back out and completing the install with my normal admin account. Make sure your service account is an admin on the machine as well though.

Pinning Outlook 2013 icon to Windows 7 taskbar shows a 2nd icon when opened

There appears to be a bug with Outlook 2013 that will cause Windows 7 to show a 2nd icon if you pin it to the taskbar "too soon".  From testing if you pin the icon to the taskbar before first running it or even during the first run it will start showing 2 icons in the taskbar. I have managed to resolve this by unpinning all the Outlook icons on my taskbar, closing out Outlook, opening and reclosing Outlook (just to be sure) then pinning Outlook again from the start menu. Now when I open Outlook I am only getting the 1 icon in the taskbar and multiple Outlook 2013 windows stack correctly.

Update: The above was back during beta. If you have problems today I suggest unpinning your icons then run Outlook and right click and pin from the running icon instead of from the start menu.

Connecting via VPN to authenticate to a domain in Windows 7

In XP there used to be an option to connect via dial-up to log in to a computer. This is no longer obviously available in Window 7. The good news is it still exists and works really well. This is how to configure it.

1. Login as a user with local admin rights 
2. Create the VPN connection by going to “Network and Sharing Center”, then click “Setup up a connection or network” - “Connect to a workplace”.
3. Fill out the details to connect to your work VPN and choose the option to allow other people to use this connection. This is what will make the option appear on the log in screen. 
4. Complete the wizard and save the connection.

You can now use this connection to log in directly to the domain and/or to join the PC to the domain if needed.

1. After rebooting, press Ctrl-Alt-Delete to log on if prompted. 
2. Click Switch User to view other logon options. 
3. Will now see a blue button in the lower left for each connection shared with all users. 
4. Click the blue button.
5. Type the username and password for the connection and click the blue arrow to connect. 
6. After the connection is established, Windows will use the same credentials to try to log into Windows. If that fails, (for example you use a different password for your VPN) the connection remains active and you will be taken back to the Windows log in screen to submit Windows credentials.

HP RAID 50 NPG raid info

Lately when buying HP servers I have started seeing what looks like a new type of RAID listed when choosing RAID 50. Depending on the number of disks you have you may see the following options available as part of RAID 50.

RAID 50 NPG:2
RAID 50 NPG:3
RAID 50 NPG:4

When I asked around what these were no one seemed to know so I started creating them on a D2700 and seeing what the result was. Below is a listing of what you end up with when you create each of these. It appears all the NPG means is Number of Parity Groups. I’ve seen a lot of confusion about this both inside and outside of HP support. One advantage to this is the ability to lose more than 1 disk as long as they are different parity groups. A disadvantage is to increase storage you would need to add the number of disks you have of parity groups.

RAID 50 NPG:2

Drives Assigned to Parity Group 1	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 1 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 2 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 3 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 4 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 5 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 6
Drives Assigned to Parity Group 2	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 7 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 8 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 9 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 10 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 11 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 12

RAID 50 NPG:3

Drives Assigned to Parity Group 1	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 1 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 2 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 3 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 4
Drives Assigned to Parity Group 2	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 5 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 6 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 7 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 8
Drives Assigned to Parity Group 3	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 9 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 10 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 11 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 12

RAID 50 NPG:4

Drives Assigned to Parity Group 1	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 1 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 2 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 3
Drives Assigned to Parity Group 2	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 4 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 5 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 6
Drives Assigned to Parity Group 3	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 7 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 8 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 9
Drives Assigned to Parity Group 4	146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 10 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 11 146 GB 2-Port SAS Drive at Port 2E : Box 1 : Bay 12

Connect PowerShell to Office 365 cloud

We do quite a few Office 365 migrations and recently found out you can connect PowerShell to the Office 365 cloud and do quite a lot of tasks that way instead of using their web interface. This is going to make our jobs much easier. I will show you how to connect to 365 and some examples of things you can do. Some of the more powerful scripts such as user control require you to install the Office 365 sign in tool and the Microsoft Online PowerShell snap-in.

To be able to run commands that affect user accounts you must install the Microsoft Online Services Module for PowerShell which can be found here which also requires the single sign on tool located here.

To connect to Office 365 with PowerShell run the following 4 commands. You will be prompted for your account credentials.

set-executionpolicy remotesigned
$LiveCred = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
Import-PSSession $Session

To connect to the user management service issue the following

connect-msolservice

To set a users password to something you know and set them to not have to change it

Set-MsolUserPassword -UserPrincipalName CHANGETO@USERNAME -NewPassword SETTHISTOTHENEWPW -ForceChangePassword $false

To set all users to not have to change password every 90 days

Get-MsolUser | Set-MsolUser –PasswordNeverExpires $True

SBS Server 2003 Exchange ActiveSync forbidden

Recently I worked on a customer who had Exchange 2003 and a new iPhone he wanted to connect but was failing. The phone actually verified and connected but they kept get a message of cannot get mail.  Their first issue was an invalid SSL certificate but once we cleared that up the iPhone was still kicking back an error it could not get email and an android device we tested with gave a access denied error. The tool at https://www.testexchangeconnectivity.com gave the following error

An HTTP 403 forbidden response was received. The response appears to have come from Unknown. Body of the response: <body><h2>HTTP/1.1 403 Forbidden</h2></body>

I saw several suggestions for this on the web but their problem ended up being that their previous IT had configured a website on port 80 and redirected the default website to port 8082. Once we switched this back everything started working and the support tool passed all tests.

If you have additional issues this post is a good resource.

VBscript FileSystemObject copy file gives permission denied error

This is something I forget about since I don't do a lot of file copying using VBS but I figured it is good information to have out there.

Any time you are copying to a folder using VBScript your folder path needs to have the trailing \ on it or your script will try to treat your folder like a file and try to overwrite it and give a permission denied.

So while this example will not work:

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.GetFile("c:\test.txt")
objFile.Copy "c:\temp", True

This one will:

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.GetFile("c:\test.txt")
objFile.Copy "c:\temp\", True

Windows 7 gadgets show a white box with greater than sign

Recently had a Windows 7 user who had some desktop gadgets from MSDN that were showing up as a small white box with a greater than sign in it while other gadgets were showing up fine. The fix was surprisingly simple.

Go into the control panel, choose default programs, set program access and computer defaults, select the Microsoft Windows option and click ok. Close down the sidebar process and restart it.  Gadgets should show up normal again.

You can reset your default programs back after this.

Setup was unable to create a new system partition or locate an existing system partition

As part of trying to recover data from a Novell NSS partition we attempted to install Windows 7 onto a brand new disk so we could run some recovery tools. During the install at the disk selection part we got the error in the title of this post. It took me awhile to figure it out but the resolution ended up being very simple. We had 2 raid controllers plugged in that once we unplugged the system was able to create the partition. It was a bit odd since the install did not even see these disks but it worked.

Recovering data from a corrupted VMWare guest

Recently I had a client whose previous support team had set them up with 2 servers running VMWare with one of them being duplicated to the other using Veeam. The one thing they failed to do was limit the growth of the VM partition to the available space of the drive so guess what happened? Yep the VM storage drive ran out of space and corrupted the heck out of the 2 disks attached to the only guest on it. Veeam then dutifully copied over the corrupted data. Once they called us the machine was beyond recovery as a usable machine (did I mention this was their DC?) even after trying several snapshots. We freed up enough space to boot the guest and got a solid 45 minutes of check disk repair and then a notice that were was no available AD information and a notice we needed to boot into recovery mode and restore that data. Too bad that was gone. So now the client really just wants their data back and a new machine built but how were we going to get into the drive hosted on a Unix machine with multiple snapshots?  It turns out this ended up being easier than expected.  There is a great bootable CD called SystemRescueCD which I was able to upload to the storage partition on VMWare and attach it as a CD image to the corrupted guest and boot from. Once booted you can attach the drives using the mount command and the drive name in our case it was sdb1 so:

mount -t ntfs /dev/sdb1 /mnt/windows -o ro

Once the drive is mounted you can copy the data off over the network just like normal assuming the rescue cd was able to initialize your network card. I would recommend the use of a program like teracopy to do the copy rather than normal windows copy. Keep in mind this mounts the drive read only so any tools like teracopy need to be installed on the destination machine. You can mount the drive read/write but this is not recommended.

iTunes artwork not modifiable

So I had a user ask me the other day why in iTunes he can't change any of his artwork on his TV shows he put on his iPad. Odd question but since I have an iPad I was curious as well. I did some looking online and saw some other people asking the same question but no answers or answers like "you don't have enough rights to the file to edit it." None of the sparse answers I found were right but after some questioning I did find out that he had recently enabled the sync TV shows option under the main iPad settings/TV Shows section and then later disabled. The odd thing was every time he went and sync'd TV shows manually again it would put that check back in sync TV shows. It turned out once we put a check in "manually manage my music and videos" in the main section it stopped doing this and it enabled him to modify the artwork again.