Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Swink
Apr 18, 2006
Left Side <--- Many Whelps
^ our office shuts down over Christmas and we have a policy of all staff having an out of office. I use this cmdlet to set and enable the message for all staff, then disable it.

Adbot
ADBOT LOVES YOU

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010

snackcakes posted:

Holy crap I can't believe I didn't know about this cmdlet. I have just been logging into their webmail when I know their password or grant myself full access to the mailbox when I don't.

:aaa: don't do that. Impersonate from the exchange owa interface. Grant yourself the proper rights and fix their account. set-mailboxautoreplyconfiguration needs the similar permissions.

snackcakes
May 7, 2005

A joint venture of Matsumura Fishworks and Tamaribuchi Heavy Manufacturing Concern

incoherent posted:

:aaa: don't do that. Impersonate from the exchange owa interface. Grant yourself the proper rights and fix their account.

I always fix it when I'm done :angel:

...usually

Dans Macabre
Apr 24, 2004


does anyone know about sharepoint online site mailboxes? Microsoft sure doesn't.

SleevelessJoe
Jul 1, 2003

WHAAAHHHT ISSS GHOOIINNNG ONNNN!?
I'm looking for some assistance on the following scenario: The end goal is to have two domain names set up with different email addresses in Exchange and have the email go to different mailboxes in Outlook. For example, if someone emails joe_user@domainname1.com, it goes into their existing primary email account. If someone emails joe_user@domainname2.com, it goes into a new email account.

So far, I've managed to get the domainname2 added into Exchange, had the proper MX records updated for domainname2 so that it matches the MX record of the domainname1 and verified that I can add an email address from domainname2 to an existing Exchange user and have the email go to their domainname1 inbox in Outlook.

However I'm not sure what I need to do in order to separate the accounts into two distinct mailboxes. If any Exchange wizards can lend some guidance it would be appreciated. I've Googled this and found some stuff that doesn't seem relevant.

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe

AstroMatt posted:

I'm looking for some assistance on the following scenario: The end goal is to have two domain names set up with different email addresses in Exchange and have the email go to different mailboxes in Outlook. For example, if someone emails joe_user@domainname1.com, it goes into their existing primary email account. If someone emails joe_user@domainname2.com, it goes into a new email account.

So far, I've managed to get the domainname2 added into Exchange, had the proper MX records updated for domainname2 so that it matches the MX record of the domainname1 and verified that I can add an email address from domainname2 to an existing Exchange user and have the email go to their domainname1 inbox in Outlook.

However I'm not sure what I need to do in order to separate the accounts into two distinct mailboxes. If any Exchange wizards can lend some guidance it would be appreciated. I've Googled this and found some stuff that doesn't seem relevant.

You create a second mailbox. That's it.

SleevelessJoe
Jul 1, 2003

WHAAAHHHT ISSS GHOOIINNNG ONNNN!?

nexxai posted:

You create a second mailbox. That's it.

Are these the steps that I'd follow? http://windowsitpro.com/exchange-server/q-can-active-directory-user-have-more-one-exchange-mailbox This seems like it is just a hack and not proper steps.

SleevelessJoe fucked around with this message at 18:39 on Mar 11, 2015

Thalagyrt
Aug 10, 2006

AstroMatt posted:

Are these the steps that I'd follow? http://windowsitpro.com/exchange-server/q-can-active-directory-user-have-more-one-exchange-mailbox This seems like it is just a hack and not proper steps.

A user can only have one mailbox associated with them. You'll need to create a new user and a new mailbox, then you can delegate permissions to allow a different user to access that mailboxes in Outlook.

Dans Macabre
Apr 24, 2004


AstroMatt posted:

I'm looking for some assistance on the following scenario: The end goal is to have two domain names set up with different email addresses in Exchange and have the email go to different mailboxes in Outlook. For example, if someone emails joe_user@domainname1.com, it goes into their existing primary email account. If someone emails joe_user@domainname2.com, it goes into a new email account.

So far, I've managed to get the domainname2 added into Exchange, had the proper MX records updated for domainname2 so that it matches the MX record of the domainname1 and verified that I can add an email address from domainname2 to an existing Exchange user and have the email go to their domainname1 inbox in Outlook.

However I'm not sure what I need to do in order to separate the accounts into two distinct mailboxes. If any Exchange wizards can lend some guidance it would be appreciated. I've Googled this and found some stuff that doesn't seem relevant.

Create a second AD user account called DOMAINNAME2-JUSER@domain.local.
Create a mailbox for that new user.
In Exchange give full access and send-as to the existing account JUSER@domain.local.

Depending on your settings or Exchange version the new mailbox will appear for that user in outlook under his main mailbox. If not you add it manually in the client.

If the user needs to access both mobile device/activesync you'll need to literally give him credentials for domainname2-juser and he'll have to log in twice like an idiot unless they fixed activesync already

fatman1683
Jan 8, 2004
.
I'm having some trouble getting Microsoft to respond and wondering if anyone else has run across this:

I'm testing a smart card implementation. After setting 'require smart card for interactive logon' on a user account, then resetting the password, the user is able to do network logons with password auth (net use, etc) with no issues. However, the user can't log into OWA.

Anyone seen this before?

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.

fatman1683 posted:

I'm having some trouble getting Microsoft to respond and wondering if anyone else has run across this:

I'm testing a smart card implementation. After setting 'require smart card for interactive logon' on a user account, then resetting the password, the user is able to do network logons with password auth (net use, etc) with no issues. However, the user can't log into OWA.

Anyone seen this before?

You're going to need to configure your Client Access Server for Certificate based authentication.

fatman1683
Jan 8, 2004
.

Gyshall posted:

You're going to need to configure your Client Access Server for Certificate based authentication.

I shouldn't, because I'm not using certificates to authenticate to OWA. I'm using password auth. Which should work, since it's a network logon and not an interactive logon.

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.

fatman1683 posted:

I shouldn't, because I'm not using certificates to authenticate to OWA. I'm using password auth. Which should work, since it's a network logon and not an interactive logon.

You're requiring Smart Cards with Active Directory, so you need to configure your Client Access Servers for Smart Cards (Certificate based Authentication) in addition to Password Auth.

Speaking from experience.

fatman1683
Jan 8, 2004
.

Gyshall posted:

You're requiring Smart Cards with Active Directory, so you need to configure your Client Access Servers for Smart Cards (Certificate based Authentication) in addition to Password Auth.

Speaking from experience.

Will that still let me use password auth with OWA? I don't want to require smart cards for OWA login.

EuphrosyneD
Jan 25, 2004
I'm certifiably insane and am running Exchange 2013 as my personal mail server in an attempt to learn the product itself, plus a bit more about Server 2012 R2.

Up until about 3/9, I was able to access OWA from within my LAN by using the "outside" FQDN of my mail server.

I renumbered all my servers to something more sane on 3/10, following a disastrous attempt to enable load balancing on my VM box.

I know I probably broke more than a few things in AD, but I fixed as much as I could, namely the hardwired IP addresses for my two domain controllers (who are also running DNS for each other).

Outlook 2010 on my home PC can no longer connect using either the inside or outside FQDN and neither can any browser from inside my LAN. Using the hosts file to define the outside and inside FQDN to the internal IP was a temporary workaround but that doesn't work anymore; Outlook stalls when trying to resolve my mailbox.

Using the internal IP to access OWA works about 25% of the time, but more often than not I just see a blank screen.

I can always instantly access stuff on the server itself with localhost or the Active Directory FQDN.

No clients (phone, %dayjob% PC, other mail servers) from "outside" my LAN have any issues accessing the Exchange server.

What's the next step? I've looked everywhere I can in AD. IIS seems to be the obvious suspect but I'm not even sure what to do in that regard.

orange sky
May 7, 2007

I'm not very experienced in Exchange but I think the fault might be on your DNS records - a duplicate record or something like that. Go check out your DNS table.

E: Nevermind, accessing by internal IP directly doesn't work. Well, I don't know.

Thanks Ants
May 21, 2004

#essereFerrari


Have you left a loopback NAT rule in place and not updated it?

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.

fatman1683 posted:

Will that still let me use password auth with OWA? I don't want to require smart cards for OWA login.

If you are on Exchange 2010+ you can use the Management Console to change the authentication settings on the OWA Client Access virtual directory, but this is basically how Smart Card authentication with AD is going to work - if you're requiring Smart Card auth for an Active Directory user account, you will need to authenticate with said Smart Card everywhere you're using AD.

I've never had that scenario where you want it for some things but not others, but I'd start at the EMC and see if you can change the settings there to get what you want. In all our environments where we require smart card auth we require it on any access point to network resources, including OWA.

EuphrosyneD
Jan 25, 2004

Thanks Ants posted:

Have you left a loopback NAT rule in place and not updated it?

As far as I know, no.

On a lark I set my Exchange box to be the DMZ host on my prosumer router (RT-AC68u running custom firmware).

I can log into OWA no problem, but Outlook still has fits trying to connect.

EuphrosyneD fucked around with this message at 17:09 on Mar 13, 2015

fatman1683
Jan 8, 2004
.

Gyshall posted:

If you are on Exchange 2010+ you can use the Management Console to change the authentication settings on the OWA Client Access virtual directory, but this is basically how Smart Card authentication with AD is going to work - if you're requiring Smart Card auth for an Active Directory user account, you will need to authenticate with said Smart Card everywhere you're using AD.

I've never had that scenario where you want it for some things but not others, but I'd start at the EMC and see if you can change the settings there to get what you want. In all our environments where we require smart card auth we require it on any access point to network resources, including OWA.

Well I've tested actual network logons and they work with password auth after requiring smartcard for interactive logon. The Microsoft AD engineers that work here agree that it should work that way in theory, since they're not interactive logons. None of them work with Exchange, though, so they don't have any useful input on what Exchange might be doing. I have a case open with MS and I'm waiting for an Exchange engineer to take a look.

Will Styles
Jan 19, 2005

EuphrosyneD posted:

I'm certifiably insane and am running Exchange 2013 as my personal mail server in an attempt to learn the product itself, plus a bit more about Server 2012 R2.

Up until about 3/9, I was able to access OWA from within my LAN by using the "outside" FQDN of my mail server.

I renumbered all my servers to something more sane on 3/10, following a disastrous attempt to enable load balancing on my VM box.

What's the next step? I've looked everywhere I can in AD. IIS seems to be the obvious suspect but I'm not even sure what to do in that regard.

Just to get it out of the way, did you change the FQDNs for internal/external URLs for every service to match the new names? Get-OwaVirtualDirectory | fl *url*, Get-WebServicesVirtualDirectory | fl *url*, etc.

Edit: VV Oh, looks like I misread your first post. When you said you renumbered your servers I took that to mean changing the server names from like "CAS32, CAS74" to "CAS01, CAS02" as opposed to changing IP addresses. My mistake.

Will Styles fucked around with this message at 18:05 on Mar 13, 2015

EuphrosyneD
Jan 25, 2004

Will Styles posted:

Just to get it out of the way, did you change the FQDNs for internal/external URLs for every service to match the new names? Get-OwaVirtualDirectory | fl *url*, Get-WebServicesVirtualDirectory | fl *url*, etc.

The only thing that changed on the LAN was the internal IPv4 addresses of my DCs, and Exchange box.

I checked DNS on both DCs and everything looks fine; the DCs and Exchange server are present at the current addresses.

As far as I know, the DNS naming on the inside didn't change at all.

Edit:

figures it's in the last place you'd look, my home PC's DNS settings had an invalid entry. Now to puzzle out why it takes 60-90 seconds for Outlook to connect to the Exchange box even though it's on the same drat network

EuphrosyneD fucked around with this message at 18:33 on Mar 13, 2015

Thanks Ants
May 21, 2004

#essereFerrari


Ctrl+Right-click the Outlook icon in your system tray, and pick "Test Email AutoConfiguration".

itskage
Aug 26, 2003


Yeah what do you get from https://testconnectivity.microsoft.com/ ?

Tool has been great for trouble shooting OWA and Outllook anywhere.



So my question. We just updated to 2013 a few months ago, and now I'm setting up in place archiving and I want to convince the rest of management to let me force an archive policy (we have none now and it's a mess).

Biggest concern I get back is having to search in two places for items. Is there anyway I can force outlook to search the user's box and their archive, while ignoring any other mailboxes they have in outlook? Like there is an option to search all mailboxes, but for some managers they have like 5-10 boxes they have full access to, and it will search all of those as well which is really annoying when they only want to search their box and the archive.

I think if I can address this concern then we will be able to implement a policy.

TheDestructinator
Jul 18, 2006
A client lost a hub transport server recently. We spun up a new server (new server name as well) and set it up as CAS and Hub Transport. Mail flow is working fine, but out of office on the local client does not (It does work from OWA).

We spun up a new server with the name of the failed hub transport server and reinstalled Exchange with the /recoverserver switch. I tried recreating the EWS virtual directory and get the following output:
code:
C:\Documents and Settings\(username).XXXXXXX>New-WebServicesVirtualDirec
tory -WebsiteName "EWS (Default Web Site)" -InternalUrl "https://xxxxxxxxxxx/EWS
/Exchange.asmx" -BasicAuthentication 1 -WindowsAuthentication 1
New-WebServicesVirtualDirectory : The Web site 'EWS (Default Web Site)' on serv
er '(Servername).(domain).local' does not exist. The name of a Web site is case s
ensitive.
Most people recommended reinstalling IIS and the CAS role. I'd really prefer not to have to do that again.

wyoak
Feb 14, 2005

a glass case of emotion

Fallen Rib

TheDestructinator posted:

A client lost a hub transport server recently. We spun up a new server (new server name as well) and set it up as CAS and Hub Transport. Mail flow is working fine, but out of office on the local client does not (It does work from OWA).

We spun up a new server with the name of the failed hub transport server and reinstalled Exchange with the /recoverserver switch. I tried recreating the EWS virtual directory and get the following output:
code:
C:\Documents and Settings\(username).XXXXXXX>New-WebServicesVirtualDirec
tory -WebsiteName "EWS (Default Web Site)" -InternalUrl "https://xxxxxxxxxxx/EWS
/Exchange.asmx" -BasicAuthentication 1 -WindowsAuthentication 1
New-WebServicesVirtualDirectory : The Web site 'EWS (Default Web Site)' on serv
er '(Servername).(domain).local' does not exist. The name of a Web site is case s
ensitive.
Most people recommended reinstalling IIS and the CAS role. I'd really prefer not to have to do that again.

Does that web site ('EWS (Default Web Site)') exist in the IIS console? Usually it's just called 'Default Web Site'

TheDestructinator
Jul 18, 2006

wyoak posted:

Does that web site ('EWS (Default Web Site)') exist in the IIS console? Usually it's just called 'Default Web Site'

Default Web Site exists in IIS, but EWS does not.

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.
I wrote a script a while back to update all the internal URLs for exchange CAS. Copy this into InternalURL.ps1:

code:
$urlpath = Read-Host "Type internal Client Access FQDN starting with [url]http://[/url] or [url]https://[/url]"
Set-AutodiscoverVirtualDirectory -Identity * –internalurl “$urlpath/autodiscover/autodiscover.xml”
Set-ClientAccessServer –Identity * –AutodiscoverServiceInternalUri “$urlpath/autodiscover/autodiscover.xml”
Set-webservicesvirtualdirectory –Identity * –internalurl “$urlpath/ews/exchange.asmx”
Set-oabvirtualdirectory –Identity * –internalurl “$urlpath/oab”
Set-owavirtualdirectory –Identity * –internalurl “$urlpath/owa”
Set-ecpvirtualdirectory –Identity * –internalurl “$urlpath/ecp”
Set-ActiveSyncVirtualDirectory -Identity * -InternalUrl "$urlpath/Microsoft-Server-ActiveSync"
#get commands to  to doublecheck the config
get-AutodiscoverVirtualDirectory | ft identity,internalurl
get-ClientAccessServer | ft identity,AutodiscoverServiceInternalUri
get-webservicesvirtualdirectory | ft identity,internalurl
get-oabvirtualdirectory | ft identity,internalurl
get-owavirtualdirectory | ft identity,internalurl
get-ecpvirtualdirectory | ft identity,internalurl
get-ActiveSyncVirtualDirectory | ft identity,internalurl
and execute it on your Client Access server.

If you want to do External URLs as well (you do), try this (just modified for this post, I haven't tested this yet):

code:
#InternalURL.ps1
$urlpath = Read-Host "Type internal Client Access FQDN starting with [url]http://[/url] or [url]https://[/url]"
Set-AutodiscoverVirtualDirectory -Identity * –internalurl “$urlpath/autodiscover/autodiscover.xml” -externalurl "“$urlpath/autodiscover/autodiscover.xml”
Set-ClientAccessServer –Identity * –AutodiscoverServiceInternalUri “$urlpath/autodiscover/autodiscover.xml” –AutodiscoverServiceExternalUri “$urlpath/autodiscover/autodiscover.xml”
Set-webservicesvirtualdirectory –Identity * –internalurl “$urlpath/ews/exchange.asmx” -externalurl “$urlpath/ews/exchange.asmx”
Set-oabvirtualdirectory –Identity * –internalurl “$urlpath/oab” -externalurl “$urlpath/oab”
Set-owavirtualdirectory –Identity * –internalurl “$urlpath/owa” –externalurl “$urlpath/owa”
Set-ecpvirtualdirectory –Identity * –internalurl “$urlpath/ecp” –externalurl “$urlpath/ecp”
Set-ActiveSyncVirtualDirectory -Identity * -InternalUrl "$urlpath/Microsoft-Server-ActiveSync" -ExternalUrl "$urlpath/Microsoft-Server-ActiveSync"
#get commands to  to doublecheck the config
get-AutodiscoverVirtualDirectory | ft identity,internalurl,externalurl
get-ClientAccessServer | ft identity,AutodiscoverServiceInternalUri,Autodiscoverserviceexternaluri
get-webservicesvirtualdirectory | ft identity,internalurl,externalurl
get-oabvirtualdirectory | ft identity,internalurl,externalurl
get-owavirtualdirectory | ft identity,internalurl,externalurl
get-ecpvirtualdirectory | ft identity,internalurl,externalurl
get-ActiveSyncVirtualDirectory | ft identity,internalurl,externalurl
In my experience Out of Office issues are related to the autodiscover service. Ideally your internal and external URLs should both be the same thing (https://mail.company.com)

wyoak
Feb 14, 2005

a glass case of emotion

Fallen Rib

TheDestructinator posted:

Default Web Site exists in IIS, but EWS does not.
Change WebsiteName in the command to match that:
code:
C:\Documents and Settings\(username).XXXXXXX>New-WebServicesVirtualDirectory 
-WebsiteName "Default Web Site" 
-InternalUrl "https://xxxxxxxxxxx/EWS/Exchange.asmx" 
-BasicAuthentication 1 -WindowsAuthentication 1

EuphrosyneD
Jan 25, 2004
I'm stumped again.

It is impossible for me to log in to Exchange 2013's web-based control panel as my domain admin account(s). Any attempt results in a HTTP 500 error on <server>/owa/auth.owa

Attempting to log in to ECP as my regular domain user brings me to the OWA control panel to change things like signatures and such.

The Exchange PowerShell on the server still works, and I can still log in to OWA as my regular mail user; Outlook connectivity is fine as well.

I upgraded to the recently released CU8 to see if this would fix the issue but the issue is still persisting.

What should I be looking for?

Proud Christian Mom
Dec 20, 2006
READING COMPREHENSION IS HARD
a credit card and Microsoft's support #

jesus what did yall do to that install

Dans Macabre
Apr 24, 2004


EuphrosyneD posted:

I'm stumped again.

It is impossible for me to log in to Exchange 2013's web-based control panel as my domain admin account(s). Any attempt results in a HTTP 500 error on <server>/owa/auth.owa

Attempting to log in to ECP as my regular domain user brings me to the OWA control panel to change things like signatures and such.

The Exchange PowerShell on the server still works, and I can still log in to OWA as my regular mail user; Outlook connectivity is fine as well.

I upgraded to the recently released CU8 to see if this would fix the issue but the issue is still persisting.

What should I be looking for?

Just to throw out there have you tried using a different url to access? For instance, logging into the actual server and going to https://localhost/ecp, or fqdn instead of server, or mail.company.com, etc.

other thoughts:
1. Have you tried creating a new domain admin?
2. Have you tried assigning a regular user exchange admin roles (assign role through powershell, then use that user to connet to ecp)

EuphrosyneD
Jan 25, 2004
I've used every possible permutation of URL to try to get in, but every one results in a 500 error.

I took a further look into the HTTP Proxy logs and it may have something to do with Exchange not being able to find the organization mailbox(?!).

I was this close to just tearing down the whole thing and starting over. I have backups of the mail database and I don't get a lot of email anyway, so I wouldn't miss much during the rebuild.

I have also created a new admin user (I copied the built-in domain admin) and that user cannot login either.

I have NOT tried assigning roles through the Exchange powershell, yet.

Gyshall
Feb 24, 2009

Had a couple of drinks.
Saw a couple of things.

EuphrosyneD posted:

I've used every possible permutation of URL to try to get in, but every one results in a 500 error.

I took a further look into the HTTP Proxy logs and it may have something to do with Exchange not being able to find the organization mailbox(?!).

I was this close to just tearing down the whole thing and starting over. I have backups of the mail database and I don't get a lot of email anyway, so I wouldn't miss much during the rebuild.

I have also created a new admin user (I copied the built-in domain admin) and that user cannot login either.

I have NOT tried assigning roles through the Exchange powershell, yet.

imo remove all virtual directories and reset them to defaults - https://technet.microsoft.com/en-us/library/ff629372%28v=exchg.141%29.aspx (should apply for 2013 as well - just use powershell.)

KennyTheFish
Jan 13, 2004
Left field question, but are the arbitration mailboxes borked?

EuphrosyneD
Jan 25, 2004
I unfortunately don't know how to tell. I was starting the preproduction phase of switching my VM box over to Hyper-V anyway since I have a datacenter license to WS2012R2, but haven't done anything destructive yet.

EuphrosyneD
Jan 25, 2004
I burned down my setup and rebuilt it in a crash manner.

Everything works now, but I can't get the built-in Forefront to update its anti-malware definitions. The Microsoft documentation on how to do it is no help. I'm trying to get it to update from a UNC path but it simply refuses to update; all I see in Event Viewer is that it couldn't find the path.

Gucci Loafers
May 20, 2006

Ask yourself, do you really want to talk to pair of really nice gaudy shoes?


Two question,

I find this difficult to believe but in large 1,000+ user environments will Exchange Online have better TCO than on-prem Exchange?

Thanks Ants
May 21, 2004

#essereFerrari


It's an unanswerable question really, at least with no more details. Exchange 2003 running on some shitbox old servers and kept running by "someone who's good with computers" will be a lot cheaper than Office 365. Do it properly - have a DR site, keep it updated, keep the servers in warranty, employ people to run it? It's not such an easy to answer question.

Adbot
ADBOT LOVES YOU

Gucci Loafers
May 20, 2006

Ask yourself, do you really want to talk to pair of really nice gaudy shoes?


On-prem environment with best practices.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply