Exchange - where email goes to die - The Something Awful Forums

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

«‹›97 »

mayodreams: Jul 4, 2003; Hello darkness,
my old friend

NevergirlsOFFICIAL posted:

Ok so you're saying don't decom and make it someone else's problem

There is no harm in leaving those legacy Exchange attributes in there as they don't negatively affect O365.

# ? Mar 8, 2016 16:56

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 08:03

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

SeaborneClink posted:

code:
Get-Recipient -RecipientTypeDetails UserMailbox | Select Name, @{n="Email Address";e={$_.EmailAddesses | ? %_ -like "SMTP:*}}} -ExpandProperty EmailAddresses | Select name, smtpaddress
Two different results, onprem works as intended, O365 smtpaddress is returning null

That's going to be difficult if you're missing a double-quote and replaced it with an extra curly brace.

Will Styles posted:

In O365 the EmailAddresses property is just an array of strings, so there's no smtpaddress property to return. Unfortunately, I don't think there's a way to do what you want with select. You can use a for-each loop though to get basically the same info.
code:
Get-Recipient -RecipientTypeDetails UserMailbox | % { $recipient = $_; $recipient.EmailAddresses | % { if ($_ -like "SMTP:*") { ($recipient.Name,$_.Substring(5,$_.length-5)) -join ',' } } }
You can also use -join "`t" for tabs instead of commas.

Check it out:

code:

Get-Recipient -RecipientTypeDetails UserMailbox | Select-Object Name,@{N="EmailAddresses";E={$_.EmailAddresses -like "SMTP:*" -join "`t"}}

# ? Mar 8, 2016 17:16

Will Styles: Jan 19, 2005

anthonypants posted:

That's going to be difficult if you're missing a double-quote and replaced it with an extra curly brace.
Check it out:
code:
Get-Recipient -RecipientTypeDetails UserMailbox | Select-Object Name,@{N="EmailAddresses";E={$_.EmailAddresses -like "SMTP:*" -join "`t"}}

His code (completed) and my code returns something like the below, which I assumed was his intention

User1 - mail1@domain.com
User1 - mail2@domain.com
User1 - mail3@domain.com
User2 - mail4@domain.com
User2 - mail5@domain.com

Yours outputs
User1 - mail1@domain.com mail2@domain.com mail3@domain.com
User2 - mail4@domain.com mail5@domain.com

If your output fits his needs then that's great, it'll definitely run faster than what I provided.

Will Styles fucked around with this message at 17:36 on Mar 8, 2016

# ? Mar 8, 2016 17:30

SeaborneClink: Aug 27, 2010; MAWP... MAWP!

anthonypants posted:

That's going to be difficult if you're missing a double-quote and replaced it with an extra curly brace.
Check it out:
code:
Get-Recipient -RecipientTypeDetails UserMailbox | Select-Object Name,@{N="EmailAddresses";E={$_.EmailAddresses -like "SMTP:*" -join "`t"}}

Indeed I was, however that did not return the intended results, it's still null.

Will Styles posted:

His code (completed) and my code returns something like the below, which I assumed was his intention

User1 - mail1@domain.com
User1 - mail2@domain.com
User1 - mail3@domain.com
User2 - mail4@domain.com
User2 - mail5@domain.com

Yours outputs
User1 - mail1@domain.com mail2@domain.com mail3@domain.com
User2 - mail4@domain.com mail5@domain.com

If your output fits his needs then that's great, it'll definitely run faster than what I provided.

Yeah, I'm sorry I just mashed my post out in frustration and :justpost:

before leaving for the day.

I am in fact trying to get a result of:

User1 - mail@domain.com
User1 - mail@domain2.com
User1 - mail@domain3.com
User2 - mail@domain.com
User2 - mail@domain2.com
User3 - mail@domain.com

Will Styles your snippet gets me the closest to what I wanted and I can just fix in Excel. Thank you so much and I will try to post better in the future.

# ? Mar 8, 2016 20:44

Dans Macabre: Apr 24, 2004

Thanks Ants posted:

Exactly this

This has been confirmed by a friendly MS support guy.

Next question!

I have a handful of failed mailboxes in the mig batch. They failed because they aren't using the email address policy and therefore didn't get the @poop.onmicrosoft.com proxy SMTP address.

Once a mailbox fails, will it try it again? After I add the correct SMTP address and let it sync, will it attempt it again? Or do I need to create a new mig batch?

# ? Mar 9, 2016 16:16

Will Styles: Jan 19, 2005

Pretty sure you can resume the migration batch and it will try it again. I don't think it'll do it on it's own automatically but I could be wrong.

# ? Mar 9, 2016 16:24

mayodreams: Jul 4, 2003; Hello darkness,
my old friend

NevergirlsOFFICIAL posted:

This has been confirmed by a friendly MS support guy.

Next question!

I have a handful of failed mailboxes in the mig batch. They failed because they aren't using the email address policy and therefore didn't get the @poop.onmicrosoft.com proxy SMTP address.

Once a mailbox fails, will it try it again? After I add the correct SMTP address and let it sync, will it attempt it again? Or do I need to create a new mig batch?

It may try again, but I think it will fail. I think I remember having to remove the user object from dirsync and delete the mailbox in o365 and they try it again.

# ? Mar 9, 2016 20:10

SeaborneClink: Aug 27, 2010; MAWP... MAWP!

This may be a dumb question, and I'm probably going to mince the words, but here goes. I'm cleaning up a after an 2010 -> O365 migration and have been tasked with auditing permissions on old mailboxes and matching my butt counterparts.

I'd like to preserve userPrincipalName from Get-Mailbox, and pass it forward to the end of my pipeline to use in my Export, as the Identity property from Get-MailboxPermission obviously doesn't match the O365 instance name of the mailbox.

My get+export

code:

Get-Mailbox -RecipientTypeDetails RoomMailbox | Get-MailboxPermission | ? {($_.IsInherited -ne "true") `
							-and ($_.User.tostring() -ne "NT Authority\Self") `
							-and ($_.User.tostring() -ne "contoso\svcact1") `
							-and $_.User.tostring() -ne "contoso\svcact2") `
							-and -not ($_.User.tostring() -like "S-1-*")} | select identity, user | Export-CSV C:\calendarperms.csv

I'm sure there's a cleaner way of doing this, but it worked.. so far, except I'd like to somehow get UserPrincipalName or some other way to uniquely identify the resource mailbox instead of getting the whole OU structure.

code:

Identity                                                                       User
------------                                                                -----------------
contoso.local/Contoso - User Accounts/Resource Mailboxes/Conf Rm. 1         contoso\jsmith

I was hoping to just connect up to outlook.office365 and then run:

code:

Import-CSV -Path calendarPerms.csv | % $_ {Add-MailboxPermission -Identity $_.UserPrincipleName -User $_.User -AccessRights FullAccess }

Thoughts?

SeaborneClink fucked around with this message at 00:39 on Mar 10, 2016

# ? Mar 10, 2016 00:34

Will Styles: Jan 19, 2005

SeaborneClink posted:

Thoughts?

It might be easier to consider looking for a tool that will do this for you. Most migration products out there will also copy over permissions so there may be something you can use to do this. Avoid re-inventing the wheel etc. If you want to do this on your own you may be able to get away with simply modifying the csv file you're making to remove the domain/ou information from the identity. So for your example remove "contoso.local/Contoso - User Accounts/Resource Mailboxes/" from the CSV file so you're left with

code:

Identity           User
------------       -----------------
Conf Rm. 1         contoso\jsmith

Then when you reimport the permissions you can just use $_.Identity, this may not work depending on how things are named in your org, but it might if you're lucky. I'd test things out first by doing a get-mailboxpermission command to see if it can work on the modified identities. If it doesn't work you can get things done by using for each loops and making variables like what we talked about before.

Also when you're exporting your permissions, you're pulling anyone who has any type of permission Read, Write, Full Access, etc. and giving them Full Access regardless of what they had. This may be your intention, but if not you can also export the access rights into your csv and set them when you re-import. Or if you only want to export full access permissions I'd add that into your where clause "-and $_.AccessRights -like '*full*' "

# ? Mar 10, 2016 02:27

Dans Macabre: Apr 24, 2004

mayodreams posted:

It may try again, but I think it will fail. I think I remember having to remove the user object from dirsync and delete the mailbox in o365 and they try it again.

It looks like completely stopping the batch, then starting it again, worked.

# ? Mar 10, 2016 04:47

Methanar: Sep 26, 2013; by the sex ghost

I'm trying to demo ADFS SSO for office 365 in a hybrid deployment in my home lab.

I've got a public UCC certificate that includes mail, autodiscover, adfs and www. Will I need to dedicate a SAN for my adfs web proxy?

I've read a few blogs regarding this and it seems implied that no I do not, but nothing definite.

# ? Mar 12, 2016 07:47

Dans Macabre: Apr 24, 2004

Hey dudes why, when I open Outlook after migrating the mailboxes to Office 365, I'm getting a cert error for old_onprem_server.poop.LOCAL? Obviously I don't have .local in my SSL. But activesync, OAB, OWA all have virtual directory URL as mail.poop.com. Where's it getting the .LOCAL from?

(hybrid 2010/exchange online)

edit to clarify: after I relaunch outlook it goes to exchange online correctly with no cert warning. Just wondering why it's trying to refer to .local at all.

Dans Macabre fucked around with this message at 02:39 on Mar 13, 2016

# ? Mar 12, 2016 22:24

Thanks Ants: May 21, 2004; #essereFerrari

Can't remember the PowerShell command but run the one that lists the autodiscover endpoints being returned.

# ? Mar 13, 2016 00:23

Methanar: Sep 26, 2013; by the sex ghost

NevergirlsOFFICIAL posted:

Hey dudes why, when I open Outlook after migrating the mailboxes to Office 365, I'm getting a cert error for old_onprem_server.poop.LOCAL? Obviously I don't have .local in my SSL. But activesync, OAB, OWA all have virtual directory URL as mail.poop.com. Where's it getting the .LOCAL from?

(hybrid 2010/exchange online)

Could a mailbox be using an old UPN?

# ? Mar 13, 2016 01:04

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Thanks Ants posted:

Can't remember the PowerShell command but run the one that lists the autodiscover endpoints being returned.

I don't know the PowerShell one but there's the remote connectivity analyzer https://testconnectivity.microsoft.com/

If that doesn't show any .local domains you can also hold Ctrl and right-click the Outlook icon in the systray and run the email autoconfiguration tester from the client machine.

# ? Mar 13, 2016 01:21

Dans Macabre: Apr 24, 2004

anthonypants posted:

I don't know the PowerShell one but there's the remote connectivity analyzer https://testconnectivity.microsoft.com/

If that doesn't show any .local domains you can also hold Ctrl and right-click the Outlook icon in the systray and run the email autoconfiguration tester from the client machine.

yeah it works 100% fine with brand new profile it's just the first time you run the old profile it does that.

I'll check rpcdiag on a another computer once I have access to one of those

# ? Mar 13, 2016 02:42

JBark: Jun 27, 2000; Good passwords are a good idea.

NevergirlsOFFICIAL posted:

Hey dudes why, when I open Outlook after migrating the mailboxes to Office 365, I'm getting a cert error for old_onprem_server.poop.LOCAL? Obviously I don't have .local in my SSL. But activesync, OAB, OWA all have virtual directory URL as mail.poop.com. Where's it getting the .LOCAL from?

(hybrid 2010/exchange online)

edit to clarify: after I relaunch outlook it goes to exchange online correctly with no cert warning. Just wondering why it's trying to refer to .local at all.

I just dealt with this since we just sold our domain name and I had to change all the autodiscover/owa/etc... entries. On a few PCs, I found that they never, ever picked up the new name changes, no matter how many times you restart Outlook/PCs/etc... Even repairing the Outlook profile did nothing. Launch Outlook, and get a cert mismatch a few minutes later referencing the old hostname. Turns out that Outlook caches the autodiscover hostname, which is cool, but in some cases it will never actually attempt to use the new autodiscover hostname, unless the old hostname is inaccessible. I pulled my hair out on this for weeks, and once I removed the internal DNS entries for the old hosts, every PCs that was still prompting was fixed.

95% of the PCs were like you've noticed, prompt at first launch of Outlook, fine after that. Again, it's related to the caching of the autodiscover server, but at least in this case it saw the new name, and updated itself to use it.

Only other fix I could find was creating a new Outlook profile. Every other fix I found online did nothing, even ones that specifically said they would fix this problem.

# ? Mar 14, 2016 05:37

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

NevergirlsOFFICIAL posted:

yeah it works 100% fine with brand new profile it's just the first time you run the old profile it does that.

I'll check rpcdiag on a another computer once I have access to one of those

If it's just the first time, then that's probably because autoconfigure always starts off with the last successful cached URL.

# ? Mar 14, 2016 10:56

Dans Macabre: Apr 24, 2004

Cool thank you dudes. I think I came across one of those needs-a-new-profile people.

One weird thing I noticed is that a bunch of spam is still trying to hit (and getting blocked by) the old on-prem spam filter. My guess here is that these spammers just don't respect the TTL on my MX records. I'm not seeing any legit mail try to go through the old filter so I don't really care.

# ? Mar 14, 2016 16:14

Thanks Ants: May 21, 2004; #essereFerrari

I feel like I'm going round in circles, but does anyone have a guide for configuring Office 365 to auth people against a SAML provider? I have the directory sync all working happily, but all the TechNet documentation seems to mention setting up ADFS which sounds like it's the wrong way to go.

# ? Mar 16, 2016 00:24

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

Stick with dirsync unless you really need password writeback.

# ? Mar 16, 2016 02:44

Beefstorm: Jul 20, 2010; "It's not the size of the tower. It's the motion of the airwaves."; Lipstick Apathy

incoherent posted:

Stick with dirsync unless you really need password writeback.

I fought tooth and nail with ADFS to make it work. It's not worth it unless you already have ADFS setup for another purpose. Then it might go alot easier for you.

# ? Mar 16, 2016 13:53

Methanar: Sep 26, 2013; by the sex ghost

I just set up a hybrid office 365 deployment with adfs for SSO for fun. It's so cool. I can watch the redirects and watch everything bounce around. Just thinking of how many complex processes are taking place in the instant I click to login is making me giddy with excitement.

Wasn't as bad as everyone said it would be. What I've got is a pretty hacky lab set up though which is probably not actually appropriate for production. Might be because I used the new AD Connect instead of dirsync as well.

:shrug:

Methanar fucked around with this message at 06:20 on Mar 17, 2016

# ? Mar 17, 2016 05:56

Thanks Ants: May 21, 2004; #essereFerrari

It's because you weren't setting up hybrid where the on-premise element was an Exchange 2010 box that had been improperly upgraded from 2003 to 2007 and then best practises had once again been ignored when going from 2007 to 2010. Every error I hit in the last hybrid deployment I did was poo poo that should have been resolved six years previously.

# ? Mar 17, 2016 09:02

AutoArgus: Jun 24, 2009

Thanks Ants posted:

It's because you weren't setting up hybrid where the on-premise element was an Exchange 2010 box that had been improperly upgraded from 2003 to 2007 and then best practises had once again been ignored when going from 2007 to 2010. Every error I hit in the last hybrid deployment I did was poo poo that should have been resolved six years previously.

This is like half the problems Ive encountered in any O365 Hybrid migration: Some knobgoblin went "eh" on a decision in the 2003-2007 era, and then everyone in the next decade either ignored it, didn't know how to fix it properly, or perpetuated the mistake because 'thats how we always did it'. End result is that a mistake survives, never gets corrected, and blood gets shed in 2016 to finally fix it when its now a crisis that mailboxes aren't moving right. I had one recently where someone just guessed at what an email alias should look like in 1998 and never looked back through 18 years of subsequent upgrades, and somehow managed to make the exact decisions to keep anything from rejecting the bad attributes in the process.

Combing through your environment for the guts of bad decisions and halfassed decomissions before making the move really, really helps. That and having UPNs match people's primary SMTP, those two things eliminate the vast majority of issues you run into with a hybrid config.

# ? Mar 25, 2016 03:20

TITTIEKISSER69: Mar 19, 2005; SAVE THE BEES
PLANT MORE TREES
CLEAN THE SEAS
KISS TITTIESS

- User who is an employee of our ChildCo needed to have an email address of our ParentCo for a project
- I made a shared mailbox with the needed address, gave her Send As permission on it, added it to her Outlook (it shows up below her ChildCo mailbox)
- Showed her how to use the From: button when sending messages, she's been doing that
- Problem: every message, whether in Inbox or Sent Items, doesn't appear in her ParentCo shared mailbox. Instead they're all in her ChildCo mailbox

I've never seen this before, but before I was used to 365 shared mailboxes. This is an on-prem Exchange 2013 server and she uses Outlook 2013.

# ? Mar 25, 2016 05:16

Beefstorm: Jul 20, 2010; "It's not the size of the tower. It's the motion of the airwaves."; Lipstick Apathy

Wilford Cutlery posted:

- User who is an employee of our ChildCo needed to have an email address of our ParentCo for a project
- I made a shared mailbox with the needed address, gave her Send As permission on it, added it to her Outlook (it shows up below her ChildCo mailbox)
- Showed her how to use the From: button when sending messages, she's been doing that
- Problem: every message, whether in Inbox or Sent Items, doesn't appear in her ParentCo shared mailbox. Instead they're all in her ChildCo mailbox

I've never seen this before, but before I was used to 365 shared mailboxes. This is an on-prem Exchange 2013 server and she uses Outlook 2013.

I ran into this exact problem with one of my customers. The fix is to connect to powershell and do this.

quote:

For emails Sent As the shared mailbox: set-mailbox <mailbox name> -MessageCopyForSentAsEnabled $True

For emails Sent On Behalf of the shared mailbox: set-mailbox <mailbox name> -MessageCopyForSendOnBehalfEnabled $True

Source: http://blogs.technet.com/b/exchange/archive/2015/03/03/want-more-control-over-sent-items-when-using-shared-mailboxes.aspx

# ? Mar 25, 2016 12:08

TITTIEKISSER69: Mar 19, 2005; SAVE THE BEES
PLANT MORE TREES
CLEAN THE SEAS
KISS TITTIESS

Beefstorm posted:

I ran into this exact problem with one of my customers. The fix is to connect to powershell and do this.

Source: http://blogs.technet.com/b/exchange/archive/2015/03/03/want-more-control-over-sent-items-when-using-shared-mailboxes.aspx

Awesome, thanks. I'll try that this morning. I was afraid I'd have to set a bunch of rules instead.

# ? Mar 25, 2016 14:42

TITTIEKISSER69: Mar 19, 2005; SAVE THE BEES
PLANT MORE TREES
CLEAN THE SEAS
KISS TITTIESS

Wait a minute, is this only for Sent Items? Because the problem is also happening to Inbox items (received mail).

# ? Mar 25, 2016 15:08

The Electronaut: May 10, 2009

Wilford Cutlery posted:

Wait a minute, is this only for Sent Items? Because the problem is also happening to Inbox items (received mail).

How is the additional mailbox configured in Outlook? Is it added under the primary mailbox as an additional mailbox under the Advanced tab of the mailbox properties or is it added under the account settings with one of the two mailboxes defined as a default delivery location?

# ? Mar 25, 2016 15:58

TITTIEKISSER69: Mar 19, 2005; SAVE THE BEES
PLANT MORE TREES
CLEAN THE SEAS
KISS TITTIESS

The Electronaut posted:

How is the additional mailbox configured in Outlook? Is it added under the primary mailbox as an additional mailbox under the Advanced tab of the mailbox properties or is it added under the account settings with one of the two mailboxes defined as a default delivery location?

The former.

# ? Mar 25, 2016 16:04

Dans Macabre: Apr 24, 2004

Check your mail delivery rules on that shared mailbox... Sounds like it's forwarding to her.

# ? Mar 29, 2016 02:18

TITTIEKISSER69: Mar 19, 2005; SAVE THE BEES
PLANT MORE TREES
CLEAN THE SEAS
KISS TITTIESS

It only happens in Outlook. All the emails are in the right place if she logs into the mailbox in OWA. Yesterday at her request I set up an alternate Outlook profile for it, she is happy with that instead.

# ? Mar 29, 2016 14:46

AutoArgus: Jun 24, 2009

Wilford Cutlery posted:

It only happens in Outlook. All the emails are in the right place if she logs into the mailbox in OWA. Yesterday at her request I set up an alternate Outlook profile for it, she is happy with that instead.

That actually raises one angle to look at: Does it happen in a full out fresh outlook profile, or on Outlook on another system? It sounds like she's managed to get some consolidated 'all my inboxes in one' view really, and if you can isolate it to the client or that client's specific config, that might be your smoking gun.

# ? Mar 29, 2016 15:23

ZetsurinPower: Dec 14, 2003; I looooove leftovers!

So our backups snapshot causes the primary Exch2013 server to fall out of the DAG, making all 10 DBs active on the secondary server (activation preference should split them evenly). After backups complete, the primary server doesn't always pick back up the DBs it should.

I've got an open ticket with Veeam, but in the mean time I want to run the PS script to re-balance the DBs every morning, but I can't seem to get it working as a Scheduled Task. Anyone know why this wouldn't work? Also, is it a bad idea to automate the re-balance?

The task runs powershell.exe with admin creds and these arguments:

quote:

-command ". 'c:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto;. 'c:\Program Files\Microsoft\Exchange Server\V14\Scripts\RedistributeActiveDatabases.ps1' -DagName DAG01 -BalanceDbsByActivationPreference -confirm:$false"

ZetsurinPower fucked around with this message at 17:22 on Mar 31, 2016

# ? Mar 31, 2016 17:19

devmd01: Mar 7, 2006; Elektronik
Supersonik

Or you could adjust the failoversubnetdelay to account for the snapshot stun period to prevent failover from happening at all.

http://kevingreeneitblog.blogspot.com/2010/11/increase-exchange-2010-dag-failover.html

# ? Mar 31, 2016 17:39

ZetsurinPower: Dec 14, 2003; I looooove leftovers!

devmd01 posted:

Or you could adjust the failoversubnetdelay to account for the snapshot stun period to prevent failover from happening at all.

http://kevingreeneitblog.blogspot.com/2010/11/increase-exchange-2010-dag-failover.html

Yep, I've already maxed out both of those values. It still drops from the cluster.

# ? Mar 31, 2016 18:01

BaseballPCHiker: Jan 16, 2006

Does anyone have any idea why external email senders wouldnt get an NDR from Exchange if they sent to a recipient who doesnt exist? I've confirmed that I have NDRs enabled and internally if I send to someone who doesnt exist I get a bounceback but when I test from my gmail account I get no message.

# ? Apr 18, 2016 19:52

Thanks Ants: May 21, 2004; #essereFerrari

Do you have Mimecast or an equivalent sitting in front of your Exchange server that is just dropping them silently?

# ? Apr 18, 2016 20:28

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 08:03

ChubbyThePhat: Dec 22, 2006; Who nico nico needs anyone else

That's all I can think of as well. We use AppRiver, but AppRiver usually sends the NDR if you hit it with an address that doesn't exist on the exchange server. So maybe a config in your similar system is broken?

# ? Apr 18, 2016 21:32

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

«‹›97 »