Exchange V15.1
Jkobe Peoples
I'm using Outlook 2016 with Exchange v15.1. If I log into Outlook Web Access (OWA) I can see dozens of unread email throughout my folders, but in Outlook I have to click each folder individually to get it to synchronize.
I believe multiple of the user accounts on this exchange server to be compromised. I have already reset the user passwords of the affected accounts, but I want to be certain that any session that was authenticated using the old credentials is invalidated.
From my searching I understand the Exchange server hangs on to each version so any user can access their mailbox on a different exchange server (not necessarily on the same CU) to match versions for compatibility. ( I could be wrong on this )
Before you do that, I suggest you backup this files, We cannot guarantee if deleting these folders will result in any potential problems, and once result in a problem, that would affect the user experience.
Recently, multiple employees have come to me saying that their exchange accounts were breached over the time span of a few days. I have a theory that there is some form of worm on one of the computers within the domain that is periodically sending out spam/phishing links to customers and contractors. I have tried multiple AV scanners on all of the computers but they're all turning up empty.
The main point of this question:I need to find out where a user login is originating so I can begin to fix the problem.How can I find out where a user login originates and at what time that login occurred so that it can be cross-referenced with some rejected spam emails that were returned to us.
Besides, based on your description, the version of your Exchange server is not the latest, you'd better install the latest CU/SU versions of Exchange. Normally the latest CU/SU includes the fixes for nonsecurity issues and all previously released fixes for security and nonsecurity issues: CU22 for Exchange 2016
Any idea why Exchange still thinks the drive is full. Rebooting the exchange server fixed this issue temporarily but within a week it goes back to reporting this error. Can I change the backpressure settings or disable it altogether?
Back Pressure is a system resource monitoring feature of Microsoft Exchange that detects and takes action to prevent service unavailability when vital resources, such as available hard disk space and memory, are overused.
Then start making full backups in order to clear out those log files! Everytime you do a full backup, those log files get committed to the exchange DB and then deleted, which frees up space AND updates the DB.
If you are just doing bare metal backups of the entire VM you are gonna have a bad time. For one, restoring it will always have missing data. Same thing will happen if you attempted to restore your domain controller. Never, ever, ever, ever, ever do that. You bare metal backup the VM one time, you backup the data on the machine daily.
Run your backup software against Exchange, not the entire VM. Any backup software that is Exchange aware, most are BTW, will take the logs and truncate to the EDB. The files will be automatically done once the backup is complete by Exchange.
I am having same exact problem. My log files are taking 85 gigs on my C drive. I was about to delete the files but then I took a step back and wanted to make sure it was safe. Make a long story short, how does running a NTbackup condense these files and delete/shrink them. You mentioned this in a post above.
Note that the script uses an XML file to store the (original) parameters used to start the script but also to keep track of the the process. Of course, if required, you can use predefined XML files to run the script without parameters.
For example, assume we want to start a fully unattended install of an Exchange Server 2013 Client Access server, using a network location for the Exchange Server 2013 source files. After setting the Execution Policy to Unrestricted and storing the script locally, we start the script using:
After rebooting, the system will automatically log on using the credentials specified earlier and start the script (RunOnce registry key is utilized for this purpose). It will read the last known state from the XML file and will continue with the next phase, which is downloading (when not present) and installing the Exchange prerequisites.
When running in AutoPilot mode, the system will automatically perform reboots and logons between the steps. Note that it may seem like a lot of reboots, but rebooting after installing Windows features and Exchange prerequisites is required anyway, so I also put reboots after the other milestones.
Customization
If you want to perform post-setup configuration of Exchange running Exchange cmdlets from the script, you need to tailor it to your needs. Locate the line which reads:
Uncomment this line so a proper Exchange Management Shell session will be set up to the local Exchange server. You can insert Exchange-related cmdlets after the Load-ExchangeModule line to configure your server. Be advised that you need to port modifications to new versions of the installation script.
Recovery
The script also supports recovery mode (/mode:RecoverServer). After checking the Exchange server object is present in Active Directory, installation will proceed as normal, with the exception of running setup in recovery mode. For example:
Update
The script also supports update mode (/mode:Update). After checking the Exchange server object is present in Active Directory, and checking for presence of Exchange installation, installation will proceed as normal, with the exception of running setup in Update mode.
The Office Filter packs are not needed on Exchange 2013. The Search Foundation component includes all of the filters for Office already. I would also use the /InstallWindowsComponents setup switch and skip the manual installs of IIS and related components.
I am having problems with the script when installing from a newly built 2012 server it fails to install the UCMA 4.0 runtime as the windows feature Server-Media-Foundation is not getting installed before UCMA 4.0 and it seems to be a prerequisite for this even though its not published. Have you seen this before?
I installed RTM and then tried to upgrade to CU2 (yes i know next time install CU right away, but i forgot that CU2 was released) and de setup from CU2 gave me the error that i need to istall the 3 components above
Not required, but highly recommended (alternative is 4.5 with a set of hotfixes only available through support).
Installing Windows features does not require original source files (like in early versions of Windows)
Thank you. I am able re-start the installation using elevated powershell privileges.
I have a quick followup question. What do I need to change in the code to make sure the pre-reqs are picked from the c:\install if already present?
Hello, This is why on Windows 2012 R2 the autologin does not work. If you see the log, it tells you if you use the -verbose switch. Any idea how to get the autologin to work, I am not sure how many times to run the script because it is not autologin and running the script. Thanks for your help Michael.
When you run it with the -Verbose parameter, what is it trying to execute? Just checked with a local path (C:\ExchangeSetup) as I usually run it directory off an UNC path, and see no issues. Could it be blocked from running?
Lastly, if the install fails, for whatever reason, the next time I run the script (no matter what new switches I add), the XML file seems to take precedence because it contains information (switch values) from the previous run(s). This caused me some frustration when trying to run the script after I found the cause of the install failure and tried to add the Organization switch. The value I added for Organization did not get updated in the XML file, therefore, the install continued to fail. I had to remove/rename the XML file and start all over with phase 1 by running the script again.
Performance Counters Layout information: FileMappingNotFoundException for category MSExchangeRemotePowershell : Microsoft.Exchange.Diagnostics.FileMappingNotFoundException: Cound not open File mapping for name Global\netfxcustomperfcounters.1.0msexchangeremotepowershell. Error Details: 2
Does the /DoNotStartTransport persist? I want to install some servers BUT not have them route mail etc. i was planning on also adding some sections to net stop some other services. Have you looked into this, or have any pointers?
Hi! Nice script!
Trying to install using the Exchange 2013 CU10-installer and I get this error in the ExchangeSetup.log: [ERROR] Exchange organization name is required for this mode. To specify an organization name, use the /OrganizationName parameter.
Script C:\Scripts\Install-Exchange15.ps1 called using [InstallMultiRole, True] [SourcePath, D:\] [Organization, Tenant03
] [MDBName, DB01] [MDBDBPath, C:\MailboxData\DB01\DB] [MDBLogPath, C:\MailboxData\DB01\Log] [InstallPath, c:\ExchangeIns
tall] [AutoPilot, True] [IncludeFixes, True] [InstallFilterPack, True] [Credentials, System.Management.Automation.PSCred
ential] [SCP,
Running on OS build 6.3.9600
Performing sanity checks ..
Computer name is 003MS01.tenant03.com
Checking temporary installation folder ..
Operating System is 6.3.9600
.NET Framework is 379893 (4.5.2)
Script running in elevated mode
Checking provided credentials
Credentials seem valid
Cannot index into a null array.
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : NullArray
+ PSComputerName : 192.168.0.131
Script C:\Scripts\Install-Exchange15.ps1 called using [InstallMultiRole, True] [SourcePath, D:\] [Organization, Tenant03
] [MDBName, DB01] [MDBDBPath, C:\MailboxData\DB01\DB] [MDBLogPath, C:\MailboxData\DB01\Log] [InstallPath, c:\ExchangeIns
tall] [AutoPilot, True] [IncludeFixes, True] [InstallFilterPack, True] [Credentials, System.Management.Automation.PSCred
ential] [SCP,
Running on OS build 6.3.9600
The requested operation cannot be completed. The computer must be trusted for delegation and the current user account m
ust be configured to allow delegation.
+ CategoryInfo : NotSpecified: (:) [ConvertFrom-SecureString], CryptographicException
+ FullyQualifiedErrorId : System.Security.Cryptography.CryptographicException,Microsoft.PowerShell.Commands.Conver
tFromSecureStringCommand
+ PSComputerName : 192.168.0.131