Sender Email address with Apostrophe gives 550 Requested action not taken: mailbox unavailable

This was another fun one because there were no logs on the Exchange server to show it ever saw the message and my spam filtering service was passing the email and saying my Exchange 2010 server was responding with:

550 Requested action not taken: mailbox unavailable (in reply to MAIL FROM command)

The senders email address was like this first.o'last@domain.com which is technically a valid address but I frequently see admins remove the apostrophe to avoid complications.

I finally figured out that yes this error was happening where I suspected on our WatchGuard firewall. For some reason their SMTP proxy disallows this character by default even though it is valid. To fix:

• Open WatchGuard System Manager then Policy Manager. Right click the SMTP-proxy rule then select Modify Policy option.
• lick the View/Edit Proxy button in the right side of Proxy action field.
• (Fix Sender) Mail From of the SMTP-proxy, click Change View button to switch to Advanced View. Click Edit button to edit the Non-allowed characters rule.
• Add the apostrophe at the end of default Regular Expression then click OK.
  Change from [^-_.+=%*/~!&@?0-9a-zA-Z] to [^-_.+=%*/~!&@?0-9a-zA-Z']
• (Fix recipient) Rcpt To of the SMTP-proxy, click Change View button to switch to Advanced View. Click Edit button to edit the Non-allowed characters rule.
• Add the apostrophe at the end of default Regular Expression then click OK.
  Change from [^-_.+=%*/~!&@?0-9a-zA-Z] to [^-_.+=%*/~!&@?0-9a-zA-Z']
• To enable save the config to the device.

Exchange 2003 to Exchange 2010 upgrade fails with public folder ACL permissions issue

I have seen a few instances now where upgrading from Exchange 2003 to Exchange 2010 will give an error of:

Access control list (ACL) inheritance is blocked for the Public Folder tree object (CN=Public Folders,CN=Folder Hierarchies,CN=first administrative group,CN=Administrative Groups,CN=<Your domain>,CN=Microsoft Exchange, CN=Services, CN=Configuration, DC=<your domain>, DC=<your domain suffix>). Re-enable the inheritance and restart setup

The easiest way I have discovered to fix this is through ADSIEdit .

Open ADSIEdit.msc, Select the Configuration partition then drill down the tree through this path

• Service
• Microsoft Exchange
• Your Exchange organization
• Administrative groups
• First Administrative Group 
• Select Folder Hierarchies 

You should now see CN=Public Folders in the right hand pane. Right click and go to properties then the security tab of both the Folder Hierarchies folder and the CN=Public Folders item. In the security tab click the advanced button and make sure"Allow inheritable permissions" is checked for both of them. After this is done retry your install.

OWA showing blank page in Exchange 2010

After certain rollups or patches are applied to Exchange 2010 OWA may start showing a blank page instead of the login page and the URL will look something like https://myexchange.com/owa/auth/logon.aspx?url=https://myexchange.com/owa/&reason=0

To fix this issue open Exchange management console go to your Exchange installation bin folder, typically this is C:\Program Files\Microsoft\Exchange Server\V14\Bin and run updatecas.ps1

Quickly update self signed Exchange certificates

We have several customers who use self signed certificates for their Exchange SBS servers and I wanted to share a quick easy way to update expired certificates.

First you can get a list of all certificates using Get-ExchangeCertificate

Then when you have the certificate you need to replace copy the thumbprint and issue the following command.

Get-ExchangeCertificate -Thumbprint <the thumbprint> | New-ExchangeCertificate

Once you are sure it is installed and working you can remove the old expired cert with

Remove-ExchangeCertificate -Thumbprint <the thumbprint>

This process makes it a bit easier since it retains all the information you need that already existed in the old cert.

Get details about user mailboxes on Exchange 2010

Ever wanted to see how much email all of your users have or how much space their deleted items is taking up? This PowerShell command will give you some nice details on all of your mailboxes on an Exchange Server. Replace exchange with your server name.

Get-MailboxStatistics -server exchange | where {$_.ObjectClass -eq "Mailbox"} | Sort-Object TotalItemSize -Descending | ft @{label="User";expression={$_.DisplayName}},@{label="Total Size (MB)";expression={$_.TotalItemSize.Value.ToMB()}},@{label="Items";expression={$_.ItemCount}},@{label="DeletedItems";expression={$_.deletedItemCount}},@{label="DeletedItemSize (KB)";expression={$_.totalDeletedItemSize.value.toKB()}},@{label="Storage Limit";expression={$_.StorageLimitStatus}} -auto

You will get a report like this

 User                         Total Size (MB)  Items DeletedItems DeletedItemSize (KB) Storage Limit
----                              ---------------             -----      ------------   --------------------     -------------
User1                          10466                  96237          490                 2888           NoChecking
User2                            6021                  71813          248                 5219           NoChecking
User3                            4033                  46138          809                 7921           NoChecking
User4                            3843                  37157          945                 4141           NoChecking

How to remove multiple contacts from a users Exchange 2010 mailbox

We recently noticed that we had a user with 516,000 contacts in his mailbox. Many of them duplicated hundreds of times. We figured out this was an issue that other people had seen when switching from one mobile device to another. Mostly it seems from a BlackBerry to an Android. For some reason this has caused some users to experience a massive replication of contacts. I did not delve much into why as this had stopped already but we needed to clean up his current contacts. He had already tried to  manually do it but this was not working.

It turned out the easiest way to clean up the contacts was to have him backup 1 copy of the correct contacts and then run the following PowerShell command.

 Search-Mailbox -Identity "<user name>" -SearchQuery kind:contacts -DeleteContent -TargetMailbox "<logging mailbox>" -TargetFolder "SearchAndDeleteLog" -LogLevel Full

This command will search the <user name> mailbox for all contacts and delete them. This process will be logged into the folder SeachAndDeleteLog in the account you specify in <logging mailbox>

After this completed (about 3 hours) we had him replace his saved contacts.

Search-Mailbox replaces the old Export-Mailbox with deletecontent in Exchange 2010.

More information on Search-Mailbox can be found at http://technet.microsoft.com/en-us/library/dd298173.aspx

You can find information on advanced querying here http://msdn.microsoft.com/en-us/library/aa965711%28v=vs.85%29.aspx

Create multiple distribution groups with powershell and a CSV

So recently I had a need to create over 100 mail enabled enabled security groups for a new application we are rolling out. I really did not want to do this by hand. Powershell it turns out is a great resource for doing this. Create a CSV file with headers (header fields are important!) for example:

name,OU,email
group1,mydomain.com/distrogroups/ou1,group1@mydomain.com
group2,mydomain.com/distrogroups/ou1,group2@mydomain.com
group3,mydomain.com/distrogroups/ou2,group3@mydomain.com

Then if your file is c:\newgroups.csv run the following Powershell command

Import-CSV "C:\newgroups.csv" | % { New-DistributionGroup -Name $_.name -OrganizationalUnit $_.OU -PrimarySmtpAddress $_.email -Type Security }

This will import your CSV file and parse it line by line replacing each $_ value with the correct value under the header for that line. There is one extra value at the end (-Type Security) that makes every group a mail enabled security group which can be omitted to create distribution only groups.

You can add or remove fields as needed just add or remove the $_ value and create a new header line. You can find a list of acceptable fields by entering Get-Help New-DistributionGroup -Detailed at an exchange Powershell prompt. You can name the header fields whatever you want.

If you just want to create AD groups you can use the following

Import-CSV "C:\newgroups.csv" | % { New-ADGroup -Name $_.name -groupscope Global }

Moving Exchange mailboxes with more than 50 corrupted items

The maximum number of corrupted items a move request will allow you to enter in the GUI for skipping is 50. If you enter more it will act like it will work then not do the move.

If a mailbox move fails with too many errors you will need to move the mailbox via an exchange PowerShell command line (make sure you run the exchange PowerShell not the general PowerShell). The command line is as follows:

New-MoveRequest -Identity <USERNAME> -AcceptLargeDataLoss -BadItemLimit '<max number of corrupted items>' –TargetDatabase <GUID>

You can get your database GUID's with this command:

Get-MailboxDatabase | fl Identity, GUID

So for example to move testuser to a database with GUID 89261a9a-ce53-41bb-a652-1361bc3616e0 and allow up to 999 corrupted items you would use the following command:

New-MoveRequest -Identity testuser -AcceptLargeDataLoss -BadItemLimit '999' -TargetDatabase 89261a9a-ce53-41bb-a652-1361bc3616e0

Increasing Exchange 2010 local move request limit

Exchange 2010 SP1 reduced the number of users that could be moved at one time within the same database which drastically slowed down our user migration. The limit was originally 5 it is now 2. 

To increase this limit you can edit %programfiles%\Exchange Server\V14\Bin\MSExchangeMailboxReplication.exe.config and change the value for MaxActiveMovesPerTargetMDB to the number you want. Make sure you change it in both locations. I would probably not go over 5. 

Once you do that restart the Microsoft Exchange Mailbox Replication service and your moves should now do more at a time.