SBS 2008 - An internal transport certificate expired

On one of my SBS 2008 servers, I was getting this event log error 2 years after I built it:

EVENT # 2048076
EVENT LOG Application
EVENT TYPE Warning
OPCODE Info
SOURCE MSExchangeTransport
CATEGORY TransportService
EVENT ID 12015
COMPUTERNAME   SERVERNAME
DATE / TIME   5/19/2012 10:57:55 AM
MESSAGE An internal transport certificate expired. Thumbprint:98F05ABC27FEB37D5C156FD7E9FFBFFC0B098288

I had a 3 year UCC Exchange certificate on this server that IIS, POP, IMAP, and SMTP were using.  But for some reason, this "internal transport certificate" was using a self signed certificate.  It seems as though the solution was as simple as running "New-ExchangeCertificate" from the Exchange Shell.  I had already run this to replace my internal certificate, but here's what it looks like when you run the command, it prompts you to overwrite the SMTP certificate for internal processing (noting that the 3rd part SSL cert takes precedence for external communications).

tool for editing/adding SSL certificates to Exchange 2007 / SBS 2008

This tool:

http://www.u-btech.com/products/certificate-manager-for-exchange-2007.html

has been a great help to me in the management of multi-domain SSL certificates (UCC or SAN certificates). Particularly for SBS 2008, you need to use the Exchange shell to add a multi-domain SSL certificate, but this GUI tool will easily help you add it.

installing Exchange 2007 SP 3 on SBS 2008

Installing Exchange 2007 SP 3 on SBS 2008 is pretty easy, with one weird exception. As per this page:

http://www.sbsfaq.com/?p=2140

You need to stop the "Windows SBS Manager" service to allow the service pack to run. In the two service pack installations I've done so far, each time it complained about the datacollectorsvc - which as the above article says is stopped when you stop the Windows SBS Manager.

Tool for message tracking in Exchange 2010 is now called "Tracking Log Explorer"

I had been getting very frustrated with the tracking tools in Exchange 2010 as message tracking kept leading me to the Outlook Web App web interface, which I find unhelpful.

But then I found that what I'm used to seeing as Message Tracking is now called "Tracking Log Explorer" and near the same location.

Open Exchange Management Console -> Tools -> Tracking Log Explorer

It works the same was as Message Tracking in Exchange 2007

running message tracking on Exchange 2007 with wildcards

From what I can tell, the message tracking tool on Exchange 2007 does not allow wildcards like *@domain.com. I found this command which will allow you to use a wildcard value in the Exchange Shell:

get-messagetrackinglog -Server "Exchange-server-name" -Start "7/1/2010 11:34:00 AM" -End "8/10/2010 9:44:00 AM" -resultsize unlimited |where {$_.Sender -like "*@domain.org"}

This will allow you to get a list that uses the wildcard - but the results it gives you are pretty weak. It doesn't include dates and the subject is cut off, but it's a good place to start.

sending spam to junk email folder on Exchange 2007/2010

When configuring actions on detected spam on Exchange 2007 and 2010, there is no option to send it to the junk email folder when configuring it on the EMC. This is absurd. It looks like this (shown here are the actions on the content filter):



As stupid as it is, the way you can configure an SCL to be sent to the junk e-mail folder is through the PowerShell.

This command will send all junk with an SCL of 4 or higher to junk e-mail:

Set-OrganizationConfig -SCLJunkThreshold 4

I put this command on all my Exchange servers. I also disable all outright rejection of spam. Users hate it when legitimate email gets rejected. All spam goes into the junk email folder.


More info on this issue is located here:
http://technet.microsoft.com/en-us/library/bb738127(v=exchg.80).aspx

adding a UCC (mulitple name) SSL certificate to SBS 2008

Adding a single name SSL certificate to SBS 2008 is pretty easy using the "add a trusted certificate" wizard in SBS 2008. But it's not as easy if you want a UCC SSL certificate - should you have a DNS host that doesn't support SRV records.

I found sembee's blog post on this exact topic here. His steps are a little convoluted, but here's a short version with just the need to know info:

You're not going to use the wizard. You'll use the powershell.

You'll go to Digicert's wizard for UCC creation:
https://www.digicert.com/easy-csr/exchange2007.htm

Then use the Powershell command it creates on your SBS 2008 box. It'll create a CSR file on the root of your C drive.

Take that CSR file to your SSL cert provider (godaddy or whoever). Buy the UCC cert and put in the CSR as needed.

After your cert is approved, download the cert and use this command to import the certificate:
Import-ExchangeCertificate -Path “D:\Shares\Install\SSL Cert\mail_ExternalDomaiName_com.crt” -FriendlyName “CompanyName UCC Cert”
(altered as appropriate of course for the actual path of your SSL cert)

Also follow the necessary instructions provided by the cert provider about intermediate certification authorities if applicable. Restart the MS Exchange Transport service and run an iisreset.

Then go back to the "add a trusted certificate wizard" in the SBS console and tell it that you'll use an already existing certificate and choose the cert that you just imported.


EDIT - this all makes sense, and I should see this working as I see the certificate in the personal store of the certificates MMC, so I should be able to add the UCC cert in the "add a trusted certificate wizard" - but I don't see it there, so I'm going to go the more manual route and follow these instructions:

http://www.xbarit.com/bradblog/2009/12/14/how-to-manually-install-an-ssl-certficate-on-sbs-2008/

certificate mismatch when opening Outlook clients on Exchange 2007/2010 servers

After moving from Exchange 2003 to Exchange 2010, I found all my Outlook 2007 users on the LAN were getting this error:



The certificate it was referencing was the FQDN for the external name of the server. But it was accessing Exchange through the internal name. The solution was KB94072

Easy fix once you know what to look for. You're telling Outlook to use the external name - which is resolvable through internal DNS.

viewing mailbox size in Exchange 2007

There isn't a GUI method (as far as I can tell) for viewing mailboxes sizes. This page talks about a powershell command to show mailbox sizes:

http://www.exchangeninjas.com/MailboxSizeReport

Exchange 2007 Service Pack 2 installation tool for SBS 2008

Microsoft released a tool to enable Exchange 2007 Service Pack 2 installs on SBS 2008. Before this tool, it required a bunch of manual stuff to install Exchange 2007 SP 2. You still have to download Exchange 2007 SP 2 separately, but this tool is a must:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;974271

setting up autodiscover SRV records for SBS 2008 for complete functionality (including out of office assistant)

Exchange 2007 (and 2010) rely on DNS for certain functionality more than Exchange 2003 did. Particularly, I mean the autodiscover record.

A great example is the out of office assistant. This will not work on your Exchange 2007 box unless you have your autodiscover information set properly.

There are a couple ways to do set it up, but I'll cover what seems to be the easiest and least costly way - the SRV record.

Some nameservers support SRV records, and some don't (it's different from an A, MX, or CNAME record) - which is where it can get weird, but presuming you have a nameserver that does, you can set up an SRV record with these properties:

Service: _autodiscover
Protocol: _tcp
Port Number: 443
Host: remote.yourdomain.com

Once that record propagates, your autodiscover will work properly (because SBS autocreates the appropriate information at remote.yourdomain.com/autodiscover)

There are other options like getting an SSL certificate that encompasses autodiscover.domain_name.com - but that requries more cost and isn't really necessary.

If you can create the SRV record with your nameserver, that's the best method in my opinion.

If you'd like to check on the status of an SRV record, you can follow these instructions or use Microsoft's site at https://www.testexchangeconnectivity.com

Hopefully, this will help someone. As I was investigating why my out of office assistant wasn't working, I feel like all the resources available to me were pretty vague about what was needed and how to go about it.

UPDATE:
A good tutorial from Susan Bradley is here (which includes screen shots of setting up an SRV record on godaddy's DNS).

Removing password requirement for mobile devices on Exchange 2007 and/or SBS 2008

When you put in a Windows 2008 SBS box, it puts in a password requirement once the mobile device (for example - an iphone) has an active Exchange ActiveSync connection.

You can alter that setting in Exchange Management Console under Oragnization Configuration -> Client Access -> right click on Windows ... Mobile Policy ... and unchecking require password on the password tab.

In my experience, you need to remove and re-add the account on the mobile device after making the settings change (at least on an iphone 3Gs I tested on)

More details here:

http://msmvps.com/blogs/bradley/archive/2009/07/04/you-deployed-a-new-sbs-2008-and-now-the-phones-demand-a-password.aspx

adding blacklists to Exchange 2007

IMF in Exchange 2007 is more configurable than in Exchange 2003, but I find it more cumbersome than GFI Mail Essentials, which I love.

For this particular Exchange 2007 server (via SBS 2008), I had users complaining about Microsoft and Facebook spam. Since the IMF updates were not adjusting the content filtering to adjust for these messages, I decided to add black lists. I have hated black lists for years, as I occasionally find myself on them and it's a bitch getting off of them - but conceptually, if the blacklist is accurate with no false positives, it should be a very good tools.

OF NOTE - you should limit your number of blacklists to 3. See this post for more information

To configure it, I opened up Exchange Management Console -> Organization Configuration -> Hub Transport and went to the anti-spam tab. I went into IP block list providers and added these blacklists:

zen.spamhaus.org
list.dsbl.org
combined.njabl.org
bhnc.njabl.org
dnsbl.ahbl.org


Here are some others I could have added:

dnsbl.sorbs.net
bl.spamcop.net
dnsbl-1.uceprotect.net

Configuring Trusted SMTP Relay in Exchange on SBS 2008

Here are instructions for creating an SMTP relay on SBS 2008 (remote clients who don't use Exchange that you want to send through the Exchange server via SMTP with authentication):

http://blogs.technet.com/sbs/archive/2008/09/18/how-to-configure-trusted-smtp-relay-in-exchange-on-sbs-2008.aspx

whitelisting IPs in Exchange 2007 to bypass content filter

There are two places to adjust the anti-spam filter in Exchange Management Console. One place is in Organization Configuration -> Hub Transport.

But that doesn't help if you want to whitelist an IP address. You have to use the other anti-spam location in Server Configuration -> Hub Transport.

It looks like this:

Exchange 2007/2010 sending emails in RTF and winmail.dat attachments

Just corrected a stupid issue on an Exchange 2007 server where my users were sending emails to external recipients in rich text format (RTF) - even though the users were specifically choosingto send emails in HTML format. And part of what makes RTF a terrible format for email is that non-Outlook users receive all emails as winmail.dat files - which is how this problem presented itself. There is a setting in Exchange 2007/2010 where messages sent to certain external recipients in certain situations will always be converted to RTF no matter what the original format the message was sent in.

After investigating, I found this to be DEFAULT behavior in this scenario:
1) you are sending to an external contact defined in Exchange Management Console
2) the contact you are sending to does not use Outlook

To resolve it, you need to edit the properties of the contact. There is a field on the general tab for "Use MAPI rich text format." It should be changed from "use default settings" to "never"


You can also fix this universally for all users (by changing the default settings) in EMC > Organization configuration > hub transport.  On the Remote Domains tab, right click on Default and choose Properties.  Click on the message format tab and choose "Never use"