Hi- I'm trying to add an Edge Transport Server to an existing deployment. But I can't get internet email to hit the Edge. Here's what I did:

Install Exchange 2013Edge Transport Role on Windows Server 2012 R2

Verify I can resolve CAS/MBX from Edge and Edge from CAS/MBX

Run following command in PS on Edge Server: C:\>New-EdgeSubscription -FileName C:\Admin\Edge.xml

Run following command on Mailbox Server: C:\>New-EdgeSubscription -FileData ([byte[]]$(Get-Content -Path "C:\Admin\Edge.xml" -Encoding Byte -ReadCount 0)) -Site "Default-First-Site-Name"

Verify new send connectors: EdgeSync DFSN to Internet, EdgeSync Inbound to DFSN

Verify new receive connector on Edge by running Get-ReceiveConnector: EdgeServer/Default Internal Receive Connector, however I don't see this in the ECP like I do the Send Connectors

Disable existing (original) SMTP send connector

Open ports on Edge Server: TCP 25, TCP 50389, TCP 50636

Change firewall rule to NAT public IP to Edge instead of CAS/MBX Server

Run following command in PS: Set-TransportConfig –InternalSMTPServers IP, IP

Run following command in PS: Start-EdgeSynchronization -Server MailboxserverFQDN -TargetServer EDGEServerFQDN -ForceFullSync

Mail flows out to internet through the Edge Server but nothing from the internet looks like it's even being accepted by the Edge Server.

Looking at the message tracking log (C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking) doesn't show ANY inbound messages.

Thanx

You should never, never doubt what nobody is sure about. -Willy Wonka

I'm running exchange 2013 and it seems to have problems with health mailboxes (monitoring mailboxes). I have 5 mailbox databases on this server, DB1, DB2, DB3, DB4 and DB5.

I know there are 2 health mailboxes per mailbox database.

The command `Get-Mailbox -monitoring | Get-MailBoxStatistics` shows that several of these have not been accessed since December, even though they are in mounted Databases and powershell shows they are healthy.

There is also 2 health mailboxes that are missing from the below output because I got warninings saying these mailboxes have not been logged into yet.

-----

[PS] C:\windows\system32> Get-Mailbox -monitoring | Get-MailBoxStatistics

DisplayName   : HealthMailbox98fb2dc7692341ad8a3325ea2b14bbcc
ItemCount     : 17426
LastLogonTime : 12/8/2012 3:28:04 PM
Database      :  DB1

DisplayName   : HealthMailboxe27d88df28ae4d53af620604a83aca4d
ItemCount     : 12386
LastLogonTime : 2/4/2013 3:29:46 PM
Database      : DB1

DisplayName   : HealthMailbox815f0ff077a342f7889a53ef38e40256
ItemCount     : 291
LastLogonTime : 12/8/2012 3:26:43 PM
Database      : DB3

DisplayName   : HealthMailboxbca2f3409f1d4ae99098f48b574fc36d
ItemCount     : 579
LastLogonTime : 12/8/2012 3:26:05 PM
Database      : DB2

DisplayName   : HealthMailbox2412e1a0e5d9415b8328f653b2e42efe
ItemCount     : 209
LastLogonTime : 2/3/2013 6:08:41 PM
Database      : DB3

DisplayName   : HealthMailbox594b739a129941e688eafee6bbdfece6
ItemCount     : 209
LastLogonTime : 2/3/2013 6:09:52 PM
Database      : DB2

DisplayName   : HealthMailboxc401cae2a70d4d659f5758908582406e
ItemCount     : 210
LastLogonTime : 2/4/2013 3:28:59 PM
Database      : DB4

DisplayName   : HealthMailbox4b81211d555c4accad1f61a98700382e
ItemCount     : 212
LastLogonTime : 2/3/2013 6:09:46 PM
Database      : DB5

Warning: The user hasn't logged onto mailbox `<AD Domain>/users/HealthMailbox2c62876ca1bb45849c0daf2ecee6d715`, so there is no data to return. After the user logs on, this warning will no longer appear.

Warning: The user hasn't logged onto mailbox `<AD Domain>/users/HealthMailbox4399c592609a464d95c993ecee46f671`, so there is no data to return. After the user logs on, this warning will no longer appear.

-----

I am also getting a lot of queued messages in the inboundproxy.com queue that have the subject line "Undelieverable: Inbound Proxy Probe". I dont know how to get these to stop. I just have to clean out the queue once a day to prevent it from getting to large.

The last thing I notice is that I get a lot of audit errors in the event log when the system is trying to login to these mailboxes. That might be what is causing the issue. Here is one of the messages:

-----

An account failed to log on.
Subject:
Security ID:SYSTEM
Account Name:<computer name here>$
Account Domain:<AD DOMAIN>
Logon ID:0x3E7

Logon Type:8
Account For Which Logon Failed:
Security ID:NULL SID
Account Name:HealthMailboxbca2f3409f1d4ae99098f48b574fc36d@<domain.tld>
Account Domain:

Failure Information:
Failure Reason:Unknown user name or bad password.
Status:0xC000006D
Sub Status:0xC0000064

Process Information:
Caller Process ID:0x1265c
Caller Process Name:C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
Workstation Name:<computer name here>
Source Network Address:::1
Source Port:34602

Detailed Authentication Information:
Logon Process:Advapi  
Authentication Package:Negotiate
Transited Services:-
Package Name (NTLM only):-
Key Length:0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

-----

As you can see, the system can not login to to this health mailbox account. The one in my example one of the mailboxes that has not been logged into since december.

Is there anywhere to troubleshoot these? or possibly rebuild them? The is a huge lack of documentation on these mailboxes from microsoft, I  can not find any commands to interact with these other then 'get-mailbox -monitoring'

Hi 

Do you know how to add a multiple existing users in Exchange 2013,only permits add one user at time. I need add 200 users.

In exchange 2007 and 2010 this feature is possible through the management console

It´s possible in Exchange 2013?

We recieve a lot of 4009 errors on exchange 2013 (CU11 installed):

Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: Unable to open connection for mailbox <David Grof>SMTP:username@domain.com. Exception returned is: Microsoft.Exchange.Data.Storage.StorageTransientException: Cannot open mailbox /o=Company/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCHANGE2013/cn=Microsoft System Attendant. ---> Microsoft.Mapi.MapiExceptionRpcServerTooBusy: MapiExceptionRpcServerTooBusy: Unable to make connection to the server. (hr=0x80004005, ec=2419)
Diagnostic context:
    Lid: 41841   StoreEc: 0x973    
    Lid: 51059 
    Lid: 62321   StoreEc: 0x973    
    Lid: 47987 
    Lid: 50033   StoreEc: 0x973    
    Lid: 50544   ClientVersion: 15.0.1156.6
    Lid: 52080   StoreEc: 0x973    
    Lid: 51152 
    Lid: 52465   StoreEc: 0x973    
    Lid: 60065 
    Lid: 33777   StoreEc: 0x973    
    Lid: 59805 
    Lid: 52487   StoreEc: 0x973    
    Lid: 19778 
    Lid: 27970   StoreEc: 0x973    
    Lid: 17730 
    Lid: 25922   StoreEc: 0x973    
   at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message, Int32 hresult, Boolean allowWarnings, Int32 ec, DiagnosticContext diagCtx, Exception innerException)
   at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, IExInterface iUnknown, Exception innerException)
   at Microsoft.Mapi.ExRpcConnectionFactory.Create(ExRpcConnectionInfo connectionInfo)
   at Microsoft.Mapi.MapiStore.OpenMapiStore(String serverDn, String userDn, String mailboxDn, Guid guidMailbox, Guid guidMdb, String userName, String domainName, String password, String httpProxyServerName, ConnectFlag connectFlags, OpenStoreFlag storeFlags, CultureInfo cultureInfo, Boolean wantRedirect, String& correctServerDN, ClientIdentityInfo clientIdentity, Boolean unifiedLogon, String applicationId, Client xropClient, Boolean wantWebServices, Byte[] clientSessionInfo, TimeSpan connectionTimeout, TimeSpan callTimeout, Byte[] tenantHint)
   at Microsoft.Mapi.MapiStore.OpenMailbox(String serverDn, String userDn, Guid guidMailbox, Guid guidMdb, String userName, String domainName, String password, ConnectFlag connectFlags, OpenStoreFlag storeFlags, CultureInfo cultureInfo, WindowsIdentity windowsIdentity, String applicationId, Byte[] tenantPartitionHint, Boolean unifiedLogon)
   at Microsoft.Exchange.Data.Storage.MailboxSession.ForceOpen(MapiStore linkedStore, Boolean unifiedSession)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.Storage.MailboxSession.ForceOpen(MapiStore linkedStore, Boolean unifiedSession)
   at Microsoft.Exchange.Data.Storage.MailboxSession.Initialize(MapiStore linkedStore, LogonType logonType, IExchangePrincipal owner, DelegateLogonUser delegateUser, Object identity, OpenMailboxSessionFlags flags, GenericIdentity auxiliaryIdentity, Boolean unifiedSession)
   at Microsoft.Exchange.Data.Storage.MailboxSession.<>c__DisplayClass1c.<CreateMailboxSession>b__1a(MailboxSession mailboxSession)
   at Microsoft.Exchange.Data.Storage.MailboxSession.InternalCreateMailboxSession(LogonType logonType, IExchangePrincipal owner, DelegateLogonUser delegatedUser, CultureInfo cultureInfo, String clientInfoString, IBudget budget, Action`1 initializeMailboxSession, InitializeMailboxSessionFailure initializeMailboxSessionFailure, MailboxSessionSharableDataManager sharedDataManager)
   at Microsoft.Exchange.Data.Storage.MailboxSession.CreateMailboxSession(LogonType logonType, IExchangePrincipal owner, DelegateLogonUser delegateUser, Object identity, OpenMailboxSessionFlags flags, CultureInfo cultureInfo, String clientInfoString, PropertyDefinition[] mailboxProperties, IList`1 foldersToInit, GenericIdentity auxiliaryIdentity, IBudget budget, Boolean unifiedSession, MailboxSessionSharableDataManager sharedDataManager, UnifiedGroupMemberType memberType)
   at Microsoft.Exchange.Data.Storage.MailboxSession.ConfigurableOpen(IExchangePrincipal mailbox, MailboxAccessInfo accessInfo, CultureInfo cultureInfo, String clientInfoString, LogonType logonType, PropertyDefinition[] mailboxProperties, InitializationFlags initFlags, IList`1 foldersToInit, IBudget budget, Boolean unifiedSession, MailboxSessionSharableDataManager sharedDataManager, UnifiedGroupMemberType memberType)
   at Microsoft.Exchange.Data.Storage.MailboxSession.OpenAsSystemService(IExchangePrincipal mailboxOwner, CultureInfo cultureInfo, String clientInfoString, Boolean readOnly)
   at Microsoft.Exchange.InfoWorker.Common.Availability.CalendarQuery.GetDataInternal(FreeBusyQuery freeBusyQuery, EmailAddress emailAddress).

bostjanc

Hi all,

My Exchange 2013 autodiscover service is not working, testing fails at step :

Attempting to send an Autodiscover POST request to potential Autodiscover URLs
Autodiscover settings weren't obtained when the Autodiscover POST request was sent
The Microsoft Connectivity Analyzer is attempting to retrieve an XML Autodiscover response from URL https://autodiscover.mydomain.com:443/Autodiscover/Autodiscover.xml for user jack.chuong@mydomain.com
The Microsoft Connectivity Analyzer failed to obtain an Autodiscover XML response
Additional Details
Exception details:
Message: The operation has timed out
Type: System.Net.WebException
Stack trace:
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.Tools.ExRca.Extensions.RcaHttpRequest.GetResponse()
Elapsed Time: 25019 ms.

I can access to https://autodiscover.mydomain.com:443/Autodiscover/Autodiscover.xml , it return600
      Invalid Request

OWA , ECP , ActiveSync are working find but Autodiscover is not so MS Outlook has problem trying to connect...Please give me some advice, Thank you very much.

Hello Guys,

We used to have Exchange 2007 BPA which runs across all servers and gives us a final report.

I ran Exchange 2013 BPA but it runs only against local  server and gives me results only about local  server.

We have more than 50 servers and I can't run this against all servers by logging into each one of them...

Do we have some tool like we have in 2007 where we can run across all servers from a single location ?

I have to submit this report/results every month to a team who handles ITIL stuff in our company.

I've installed a fresh copy of Exchange 2013 w/ SP1 on Server 2012 R2.  After Install I tried logging into the URL https://localhost/ecp/?ExchClientVer=15. I get a login page. I login and them immediately get redirected to https://localhost/owa/auth.owa and a blank page with HTTP 500. 

Some online threads have pointed to SSL cert or IIS virtual directory issues. 

To import the cert, I exported it from my current Exchange server with the private key and imported into MMC. (It has the little golden key displayed by it), I then ran the command below from the EMC.

Enable-ExchangeCertificate -Services "SMTP, IMAP, POP, IIS"

Commands worked and I tried the URL again and still same result.  I then recreated the OWA and ECP virtual directories using the commands below. 

Remove -EcpVirtualDirectory -Identity Servername\ecp (Default Web Site)

new-EcpVirtualDirectory -InternalUrl https://ServerFQDN/ecp -WebSiteName Default Web Site

Remove -OwaVirtualDirectory -Identity Servername\owa (Default Web Site)

new-OwaVirtualDirectory -InternalUrl https://ServerFQDN/owa -WebSiteName Default Web Site

All seemed to work and directories were recreated. But still the same result. Any ideas what is causing the blank page after login? 

Hello Exchange guru's,

We are a mid-size organization running Exchange 2010 (migrated from Exchange 2003 a number of years ago) and recently were  directed to add an additional smtp address to all users. (not a new primary)

I'm going to add the new domain (as an authoritative accepted domain), but am unsure of the step to add the additional smtp address.

We currently have 2 (applied) email address policies: (1) Default -  with a recipient filter of "Alias -ne $null" and current SMTP address and X400 c=US;a= ;p=Corp;o=Exchange;   (2) Company - with a recipient filter of "((Alias -ne $null) -and (((((((((((ObjectCategory -like 'person') -and (ObjectClass -eq 'user'))) -and (RecipientType -eq 'UserMailbox'))) -or (ObjectCategory -like 'group'))) -or (ObjectCategory -like 'publicFolder'))) -or (ObjectCategory -like 'msExchDynamicDistributionList'))))" and the same SMTP and X400 as the default.

Questions:

1) when I rclick and edit either - it says "this email address policy was created with the Exchange Management Shell. Please use the EMS to modify the filter.  So, being that I don’t intend to modify the actual filter (simply add an additional smtp address), can I edit it through the EMC?

 It looks like I can, but until my change window I'm not actually able test it.  I do believe the objects were updated from 2003 to 2010 - following the 'upgrade custom ldap filters to opath filters' to make them 2010 ready.

So I’m hoping its very simply editing it through the EMC, but if  I have to use the shell, do I have to include all of the current parameters? I'm thinking I do as one article says its not 'additive' via the shell.

 Would this then be the correct full complete syntax to edit our company policy, to add the one new secondary smtp address? Do I even need to include the recipient filter if I’m only adding another smpt address via the shell?

Set-emailaddresspolicy -identity Company –enabledEmailAddressTemplates ‘SMTP:%g%s@ourCurrentprimary.com’ ‘smtp:%g%s@ourNEWsecondarydomain.com’ ‘x400:c=US;a= ;p=Corp;o=Exchange;’ –RecipientFilter {"((Alias -ne $null) -and (((((((((((ObjectCategory -like 'person') -and (ObjectClass -eq 'user'))) -and (RecipientType -eq 'UserMailbox'))) -or (ObjectCategory -like 'group'))) -or (ObjectCategory -like 'publicFolder'))) -or (ObjectCategory -like 'msExchDynamicDistributionList'))))}

And then would I use the following to kick it off?

Update-EmailAddressPolicy –Identity Company

2) Do I have to, or should I update both the Default and the Company e-mail address policies?

3) side note, but with office 2010+ and Exchange 2010 users in or org, the x400 shouldn’t even need to be included in our 2 policies would it?

DQ

In performing maintenance in AD via Exchange or GPO, etc, you come across Orphaned SID's. Is there an LDAP query, or PS script that i can plug in the Orphaned SID and it will show me all the OU's or location where that SID is located so I can remove it?

(I cant be the only Admin dealing with this problem)

Any Help would be appreciated.

Hi all,

I am trying to hide 250 DL’s from the GAL using a csv

Import-CSV "C:\temp\hide.csv" | foreach {Set-distributiongroup $.Alias -HiddenFromAddressListsEnabled $true}

It errors with "$.alias' couldn't be found on the server.

csv format:

alias

dl1

dl2

dl3

Hello,

Every other day at 6 am (GMT +1) our exchange server generates an error in the global monitoring event log. I have tried overriding the probe using both add-serveroverride and add-globaloverride to disable this probe/monitor, but it keeps returning.

I have checked maxsize on all connectors and they all match.

Regards,

Event Detail:

Log Name:      Microsoft-Exchange-ManagedAvailability/Monitoring
Source:        Microsoft-Exchange-ManagedAvailability
Date:          4/03/2014 6:00:28
Event ID:      4
Task Category: Monitoring
Level:         Error
Keywords:     
User:          SYSTEM
Computer:      EXCSrvr.org.local
Description:
The Ehlo options for the client proxy target x.x.x.x did not match while setting up proxy for user  on inbound session 08D0EC1CD7785679. The critical non-matching options were <maxSize>. The non-critical non-matching options were <NONE>. Client proxying will continue.
Probe Exception: ''
Failure Context: ''
Execution Context: ''
Probe Result Name: 'Transport/SmtpProxyEhloOptionsDoNotMatchContinueProxying'
Probe Result Type: 'Failed'
Monitor Total Value: '0'
Monitor Total Sample Count: '1'
Monitor Total Failed Count: '1'
Monitor Poisoned Count: '0'
Monitor First Alert Observed Time: '8/02/2014 5:00:29'

Event Xml:
<Event>
  <System>
    <Provider Name="Microsoft-Exchange-ManagedAvailability" Guid="{C424A887-A89F-455F-8319-960917152221}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-04T05:00:28.605087400Z" />
    <EventRecordID>9926</EventRecordID>
    <Correlation ActivityID="{F0F8C47D-9BFA-4B4B-93B6-A6B067D35315}" />
    <Execution ProcessID="17916" ThreadID="14576" />
    <Channel>Microsoft-Exchange-ManagedAvailability/Monitoring</Channel>
    <Computer>EXCSrvr.org.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML>
      <HealthSet>HubTransport</HealthSet>
      <Subject>Critical EHLO options do not match - SMTP client proxying will continue.</Subject>
      <Message>The Ehlo options for the client proxy target x.x.x.x did not match while setting up proxy for user  on inbound session 08D0EC1CD7785679. The critical non-matching options were &lt;maxSize&gt;. The non-critical non-matching options were &lt;NONE&gt;. Client proxying will continue.
Probe Exception: ''
Failure Context: ''
Execution Context: ''
Probe Result Name: 'Transport/SmtpProxyEhloOptionsDoNotMatchContinueProxying'
Probe Result Type: 'Failed'
Monitor Total Value: '0'
Monitor Total Sample Count: '1'
Monitor Total Failed Count: '1'
Monitor Poisoned Count: '0'
Monitor First Alert Observed Time: '8/02/2014 5:00:29'
</Message>
      <Monitor>SmtpProxyEhloOptionsDoNotMatchContinueProxyingMonitor/HubTransport</Monitor>
    </EventXML>
  </UserData>
</Event>

I'm having a hard time finding a way to make this monitor show as healthy.  I don't think I'm having a certificate issue.

CurrentHealthSetState   : Online
Name                    : Transport.ServerCertMismatch.Monitor
TargetResource          : HubTransport
HealthSetName           : HubTransport
HealthGroupName         : ServiceComponents
AlertValue              : Unhealthy
FirstAlertObservedTime  : 2/12/2016 1:43:30 PM
Description             :
IsHaImpacting           : False
RecurranceInterval      : 0
DefinitionCreatedTime   : 2/12/2016 1:17:33 PM
HealthSetDescription    :
ServerComponentName     : HubTransport
LastTransitionTime      : 2/12/2016 1:43:30 PM
LastExecutionTime       : 2/16/2016 1:10:45 PM
LastExecutionResult     : Succeeded
ResultId                : 5529034
WorkItemId              : 66
IsStale                 : False
Error                   :
Exception               :
IsNotified              : False
LastFailedProbeId       : -2065310054
LastFailedProbeResultId : 2970374
ServicePriority         : 2
Identity                : HubTransport\Transport.ServerCertMismatch.Monitor\HubTransport
IsValid                 : True
ObjectState             : New

Notice the last execution time is February.  How do I clear the issue or which probe do I run?

David Jenkins

Dear Team,

we faced one issue in my organization one user id show not properly please check below when we do new mail and enter that user id id show below format

Ok Folks,

Originally I was getting access to the http://localhost/ecp page but now when I type this URL I get the OWA page and only after flushing the cache on the browser I can see the Exchange Admin login page. But then I try logging in and I get a Page Not Found error!!

Is there a way to reset the IIS ecp virtual directory or perhaps when I set the Application Pool items to ApllicationPoolIdentity which BPA was compalining about it broke then. To be honest I think it may also be a certificate problem, Im kinda grasping at straws here and need to know how to reinstall the ECP component??

Ill stop my rambling and let an expert hold my hand please!!

Jim

Jim

I am in the middle of migrating from Exchange 2010 to 2013. I created the requests via EAC. It seemed slow, so I poked around here and there and eventually figured out that there was an inordinate amount of TotalStalledDueToWriteCpu time. This, of course, turned out to be my own fault for allocating only a single process to the Exchange 2013 VM (when I had 32 cores available!).

I stopped (paused) the current batches, waited until they all came back with Suspended, the shut down both the Exchange 2010 & 2013 servers, increased cores, started up, waited until everything was fully loaded, and blithely went back to the EAC and clicked Resume on each batch.

Shortly, they call came back Completed with Errors → UserAlreadyBeingMigratedException.

That gave me a rather brief headache, since these batches had already been running for a couple of hours and all must be done by tonight (end of the weekend). However, I turned around and just did this in the EMS:

Get-MoveRequest -MoveStatus Suspended | Resume-MoveRequest

But this all begs the question of what is going on with the EAC. Running Get-MoveRequestStatistics with fl to capture the details reveals that these move requests are, indeed, progressing from the point at which they were suspended (i.e. ItemsTransferred& PercentComplete continue to grow). But the EAC stubbornly insists that they have failed due to the duplicate request--even after I close EAC and re-open.

At this point, it seems that I am on my way to success, but the EAC is doing nothing at the moment to inspire any confidence. Is there some way to force the EAC to refresh its view of the real world on the server? It seems it will be done soon, but perhaps an answer here will spare some other hapless jack-of-all-trades-master-of-none like me an alarming moment or two.

I'm trying to figure out why the Details option is missing for admins in our Exchange 2013 deployment.  I see the button and the option works as expected, but I installed Exchange with this account so it may have some extra permissions.

I tried adding accounts to different groups based off this article: 

David Jenkins