Exchange - where email goes to die - The Something Awful Forums

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

Bald Stalin: Jul 11, 2004; Our posts

We're O365. A new employee has random emails going into Deleted folder somehow. No rules (local or OWA), Junk is configured NOT to delete, user is not using Ignore/Move functions. The types of emails seem random, I don't notice a pattern. The only thing I could think of was the Outlook Android app on her super old Motorola Nexus running 7.0 was buggy so that's been uninstalled, leaving only the local Outlook 2016 client on her recently imaged Win10 laptop. Does anyone have suggestions on more troubleshooting?

edit: I'm sorry that the first post of a new page is a poo poo end user troubleshooting question :\

# ? Jul 26, 2018 19:05

Adbot: ADBOT LOVES YOU

# ? Apr 26, 2024 08:10

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Check mailbox access control/delegation, but the user is probably lying to you.

# ? Jul 26, 2018 19:18

Bald Stalin: Jul 11, 2004; Our posts

She's an administrative assistant (so Outlook is meant to be her bread and butter... sigh) and she noticed the emails in deleted items on her first day, and it continued on her second day (today is her third day with the company). I believe her that it's not user action caused.

Thanks for the tip, I'll go check that now.

# ? Jul 26, 2018 19:48

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

Actuarial Fables posted:

I've been tasked to migrate AD Users and their Exchange 2013 mailboxes from one forest to another. The new forest is completely fresh, as is the new Exchange 2016 server. I've managed AD a bit but I'm not that knowledgeable about it, and I'm used to tiny postfix/dovecot email servers, not Exchange. The end goal is to get everyone off the old forest.

Has anyone had success doing this kind of migration? I've been poking at it with ADMT and Prepare-MoveRequest.ps1 for a few days and I keep running into walls - duplicate GUID's while trying to migrate mailboxes, our test user's password not coming over.

How many users? why not export the mailbox via pst and import it back in via the import-pst function

https://docs.microsoft.com/en-us/exchange/recipients/mailbox-import-and-export/import-procedures

# ? Jul 26, 2018 20:00

Actuarial Fables: Jul 29, 2014; Taco Defender

Actuarial Fables posted:

I've been tasked to migrate AD Users and their Exchange 2013 mailboxes from one forest to another. The new forest is completely fresh, as is the new Exchange 2016 server. I've managed AD a bit but I'm not that knowledgeable about it, and I'm used to tiny postfix/dovecot email servers, not Exchange. The end goal is to get everyone off the old forest.

Has anyone had success doing this kind of migration? I've been poking at it with ADMT and Prepare-MoveRequest.ps1 for a few days and I keep running into walls - duplicate GUID's while trying to migrate mailboxes, our test user's password not coming over.

Well, I think I managed to figure out what was going on. When migrating a user with ADMT, some exchange attributes are copied over as well. Since these attributes are really only relevant to the old system, the new exchange does not like it at all and declares it corrupt. I excluded a bunch of msExch attributes, so now the user doesn't show up in the new exchange w/ a non-existant mailbox (with the same GUID as the old mailbox, which is what was causing the duplicate GUID errors!).

Then, the Prepare-MoveRequest script relies on the 'proxyAddress' to match a local user account with a remote one, so I set the 'proxyAddress' attribute along with the 'mail' and 'legacyExchangeDN' attributes. Since I'm able to have this script to update a local account, I can run ADMT first and have the password copied over.

Finally, to migrate a mailbox the user needs to have ExternalEmailAddress defined, which can be set using Set-MailUser.

e. Didn't see your post!

incoherent posted:

How many users? why not export the mailbox via pst and import it back in via the import-pst function

https://docs.microsoft.com/en-us/exchange/recipients/mailbox-import-and-export/import-procedures

1209 users. Thanks for the suggestion; I'll investigate it if my method turns out to be bunk, which it very well could be as Active Directory and Exchange are not my strengths.

Actuarial Fables fucked around with this message at 21:51 on Jul 26, 2018

# ? Jul 26, 2018 20:03

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Ranter posted:

She's an administrative assistant (so Outlook is meant to be her bread and butter... sigh) and she noticed the emails in deleted items on her first day, and it continued on her second day (today is her third day with the company). I believe her that it's not user action caused.

Thanks for the tip, I'll go check that now.

It's probably going to be something like, "oh, I didn't know the X in the popup deleted the email, I thought that just made the popup go away"

# ? Jul 26, 2018 20:31

Bald Stalin: Jul 11, 2004; Our posts

Oh my god you may have nailed it.

No wait some of them are unread. There's no X/delete on Android Outlook app notifications nor on Windows 10 Outlook 2016 notification popups.

# ? Jul 26, 2018 20:58

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

Actuarial Fables posted:

1209 users.

Welp. There is always migrationwiz https://www.bittitan.com/migrationwiz/mailboxes/. I think its like 5 dollars a mailbox last i checked, but they'll support you every step of the way..

e: They're up to $11.99 a seat??

# ? Jul 26, 2018 23:56

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

incoherent posted:

Welp. There is always migrationwiz https://www.bittitan.com/migrationwiz/mailboxes/. I think its like 5 dollars a mailbox last i checked, but they'll support you every step of the way..

e: They're up to $11.99 a seat??

There might be a discounted rate through a reseller. I don't remember what we spent a few years ago.

# ? Jul 27, 2018 00:06

Old Binsby: Jun 27, 2014

Actuarial Fables posted:

Well, I think I managed to figure out what was going on. When migrating a user with ADMT, some exchange attributes are copied over as well. Since these attributes are really only relevant to the old system, the new exchange does not like it at all and declares it corrupt. I excluded a bunch of msExch attributes, so now the user doesn't show up in the new exchange w/ a non-existant mailbox (with the same GUID as the old mailbox, which is what was causing the duplicate GUID errors!).

Then, the Prepare-MoveRequest script relies on the 'proxyAddress' to match a local user account with a remote one, so I set the 'proxyAddress' attribute along with the 'mail' and 'legacyExchangeDN' attributes. Since I'm able to have this script to update a local account, I can run ADMT first and have the password copied over.

Finally, to migrate a mailbox the user needs to have ExternalEmailAddress defined, which can be set using Set-MailUser.

e. Didn't see your post!

1209 users. Thanks for the suggestion; I'll investigate it if my method turns out to be bunk, which it very well could be as Active Directory and Exchange are not my strengths.

Mind, some of these attributes can trip you up even though you're in a fresh domain. You're doing good by the sound of it but a plain .PST migration will incur major trouble when your users don't also receive a fresh Outlook profile or at least a wiped autocompletion cache. Especially when you're not migrating everyone in one go, because after each migration the issue will just pop up again for both migrated users and those left to do. This is because Outlook/Exchange don't use SMTP address routing internally when a user is in the Global Address List. In those cases the X.500/LegacyExchangeDN style address is used and cached in the autocompletion list, which when used after migration will generate NDRs. It's my favorite migration pet peeve so I mention it every time this comes up, sorry if this has been mentioned before. You can prevent this by setting either an identical legacyExchangeDN attribute or adding the old one as an additional email address in the format X500:[OldLegacyExchangeDN], the first of which ADMT seems to do in your scenario?

Old Binsby fucked around with this message at 01:19 on Jul 27, 2018

# ? Jul 27, 2018 01:17

Actuarial Fables: Jul 29, 2014; Taco Defender

I'm excited to mess this up in ways I didn't even know about.

Your explanation was really appreciated. ADMT isn't pulling across the legacyExchangeDN attribute, so I've had to add it in. I have the value set differently than it is in the old domain, so I'll try adding it as an email address and see how that works for us.

Anyone have a good technical resource for getting to know Exchange? I've been looking through technet and random tech-blogs for most of my info, but I'd appreciate a "Here's what's being used and how it's used when everything's working" kind of guide.

incoherent posted:

Welp. There is always migrationwiz https://www.bittitan.com/migrationwiz/mailboxes/. I think its like 5 dollars a mailbox last i checked, but they'll support you every step of the way..

e: They're up to $11.99 a seat??

Thanks for the link. If we end up even more over our heads we may hit them up.

Actuarial Fables fucked around with this message at 03:44 on Jul 27, 2018

# ? Jul 27, 2018 03:40

Old Binsby: Jun 27, 2014

Actuarial Fables posted:

I'm excited to mess this up in ways I didn't even know about.

Your explanation was really appreciated. ADMT isn't pulling across the legacyExchangeDN attribute, so I've had to add it in. I have the value set differently than it is in the old domain, so I'll try adding it as an email address and see how that works for us.

Anyone have a good technical resource for getting to know Exchange? I've been looking through technet and random tech-blogs for most of my info, but I'd appreciate a "Here's what's being used and how it's used when everything's working" kind of guide.

Thanks for the link. If we end up even more over our heads we may hit them up.

I forgot to link an article earlier, this blog explains what I said about X500-routing more in depth. I think it used to be hosted elsewhere, but it's the right one
technet is good for documentation purposes of powershell cmdlets and most basic procedures plus a general overview of things. There's a few hardcore technical articles, esp on older Exchange versions. Did you trawl through things like this? If you did and you need more details, the Exchange team blog is You Had Me At EHLO.... Though I can't think of a single overview post of Exchange that's got enough detail to be useful, a lot of (most) bits and pieces have been written about on there at some point. Some info (especially Client Access-related stuff) is very dated, but a lot is surprisingly relevant. There's a few good bloggers too. I like Andrew Cunningham when I stumble upon him, there's a few more but I forget their names.

# ? Jul 27, 2018 05:30

MJP: Jun 17, 2007; Are you looking at me Senpai?; Grimey Drawer

Is there a way to trace movements of a messageID once it's gotten Receive/SMTP and Deliver/Storedriv in Exchange 2010, particularly within a user's Outlook 2010 or 2013 mailbox? I have a user who reported that she's simply missing emails that she received, and that the Exchange tracking logs show as delivered normally, along with others, but it's AWOL from her Outlook 2013 or OWA mailbox. Another user has reported that an email with a tracking log delivery date of 9/11 at 4:21 PM only appeared in his Outlook 2010 and OWA mailbox on 9/12 at 4:23 PM. Again, that one shows 9/11, 4:21 as the tracking log report. I'm trying to ascertain if some action was taken between SMTP delivery and actual mailbox delivery.

# ? Sep 13, 2018 13:58

evobatman: Jul 30, 2006; it means nothing, but says everything!; Pillbug

Please someone sanity check my plan, because I want to know if I'm on the right track or about to make a huge mistake.

I have inherited an Exchange 2016 installation with about 1300 users and four servers, replicated 1-3 and 2-4, so that we at any time can take down one server for patching, maintenance, upgrade etc.

We have 5 research vessels around the world with anything from 128k-1mbit satellite links. These use cached exchange mode of course, but they are always complaining about slow email. They use shared accounts for the positions on board, such as "Captain", "Technician" and so on. These mailboxes are not used on-shore.

My plan is to put an Exchange server on each ship and to move the mailboxes for the ship positions to these servers. That way, big attachments are sent to the ship only once and then distributed to 40 clients, instead of 40 clients trying to download cat gifs from the onshore mail servers through the tiny tiny bandwidth that barely supports the ships telemetry data.

I want to add a fifth server to our onshore servers to replicate the datastores from the vessels.

The ships have their own domain controllers that are replicated to shore, good ESX hosts, SCCM secondary site and pretty much decent prerequisites for having good infrastructure, besides bandwidth. Let's assume that getting the server software on board the ship won't be an issue.

Am I on the right track here, or is this going to be a disaster? What possible pitfalls/consequences are there?

I have previously worked with oil rigs where they had their own mail server on each rig, and that seemed to work fine. However they were pretty fixed in position and had 4+mbit lines.

# ? Sep 14, 2018 07:48

Old Binsby: Jun 27, 2014

MJP posted:

Is there a way to trace movements of a messageID once it's gotten Receive/SMTP and Deliver/Storedriv in Exchange 2010, particularly within a user's Outlook 2010 or 2013 mailbox? I have a user who reported that she's simply missing emails that she received, and that the Exchange tracking logs show as delivered normally, along with others, but it's AWOL from her Outlook 2013 or OWA mailbox. Another user has reported that an email with a tracking log delivery date of 9/11 at 4:21 PM only appeared in his Outlook 2010 and OWA mailbox on 9/12 at 4:23 PM. Again, that one shows 9/11, 4:21 as the tracking log report. I'm trying to ascertain if some action was taken between SMTP delivery and actual mailbox delivery.

I'm not 100% sure what state exists between SMTP delivery (hitting the StoreDRV event) and 'actual' mailbox delivery. Actually I'm pretty sure those are the same, but do you mean the user fetching the message through outlook by that last bit? If so, a few things may have happened in the mean time. A server side mailbox rule may have moved or deleted/moved the message, a delegate may have done the same, it would be weird but there's probably a set of retention policy rules out there that can also do the same haphazardly, but that's all quite unlikely. Usually if a message is gone, the client misbehaves or the user fat finfered.

if it's enabled (not out of the box) you can search mailbox audit logs. Admin audit logs will contain things admins did as well as users with full access permission, delegates are seperately logged and finally you can see what the owner does if you also enable that. I'd try that for these two mailboxes specifically using something like

code:

set-mailbox -identity [the user missing things] -auditEnabled $true -auditDelegate @{add='move','harddelete','movetodeleteditems'}`
	-auditAdmin @{add='move','harddelete','movetodeleteditems'} -auditOwner @{add='move','harddelete','movetodeleteditems'}

Which things you audit may need a little finetuning but this shows when any mail item was moved, deleted, and removed from the deleted items. If it happens again, you can search the audit logs where the message went.

If you want to find the historical missing messages instead of waiting on new ones, they're probably in the dumpster or purged messages part of the mailbox at this point if they were deleted (which I suspect because it's usually the case) or in a random folder because the user messed up. The user may or may not be able to see them but you definitely can using new-mailboxsearch. You may need to add yourself to the Search Mailbox role group before this works, that role is not assigned to anyone by default because it grants unlimited access to search through and create copies of any and all mailbox data in scope (!!so keep the scope small and/or ditch the permissions after you're done, your data security officer will thank you)

code:

new-mailboxsearch -name 'any name' -sourcemailboxes 'DN or email address of user missing messages' `
	-searchquery 'subject:"[subject fragment, no wildcards]"' -loglevel Full -targetmailbox [an admin mailbox you can access]`
	-searchdumpster -startdate (get-date).adddays(-4) -enddate (get-date)

I was lazy with start/end date but locales are a hassle, usually YYYY-MM-DD works but I recall it not working for KQL-enabled things. If it doesn't, write the date in all formats you can think of being enabled in your domain). After it runs, the target mailbox will have a new root level folder with the results and a summary CSV. That's the nicest part of it, there's a lot of information about the whereabouts, read/deleted/modified/etc status of each item in the source mailbox. I've found things misplaced by admin assistants or cats or whatever quite often using this.

# ? Sep 14, 2018 12:16

Old Binsby: Jun 27, 2014

evobatman posted:

Please someone sanity check my plan, because I want to know if I'm on the right track or about to make a huge mistake.

I have inherited an Exchange 2016 installation with about 1300 users and four servers, replicated 1-3 and 2-4, so that we at any time can take down one server for patching, maintenance, upgrade etc.

We have 5 research vessels around the world with anything from 128k-1mbit satellite links. These use cached exchange mode of course, but they are always complaining about slow email. They use shared accounts for the positions on board, such as "Captain", "Technician" and so on. These mailboxes are not used on-shore.

My plan is to put an Exchange server on each ship and to move the mailboxes for the ship positions to these servers. That way, big attachments are sent to the ship only once and then distributed to 40 clients, instead of 40 clients trying to download cat gifs from the onshore mail servers through the tiny tiny bandwidth that barely supports the ships telemetry data.

I want to add a fifth server to our onshore servers to replicate the datastores from the vessels.

The ships have their own domain controllers that are replicated to shore, good ESX hosts, SCCM secondary site and pretty much decent prerequisites for having good infrastructure, besides bandwidth. Let's assume that getting the server software on board the ship won't be an issue.

Am I on the right track here, or is this going to be a disaster? What possible pitfalls/consequences are there?

I have previously worked with oil rigs where they had their own mail server on each rig, and that seemed to work fine. However they were pretty fixed in position and had 4+mbit lines.

The performance gain in bandwidth will be smaller than you think because Exchange can be quite lazy deduplicating. Also, you're introducing new traffic like the overhead that Safety Net incurs and replication traffic from the ship-based server to shore. That's traffic that wasn't there before, and a 128k-1Mbit line won't support a DAG (which needs a stable ~gigabit link on paper, and you can do it on less but not on a laggy, unstable ship based satellite connection). I doubt it's a sane plan, but I may be wrong. Gut feeling is pessimistic because your plan reminds me of a global maritime shipping company that I heard discuss over beers once. They were doing the same at a much bigger scale than you're planning, except they stuck an isolated Exchange server on each ship. Keep it simple: One ship, one Exchange farm, one AD forest, one domain. I remember because they were phasing out the local Exchanged 5.5 on each ship and integrating them companywide in tyool 2013.

Old Binsby fucked around with this message at 12:45 on Sep 14, 2018

# ? Sep 14, 2018 12:41

Thanks Ants: May 21, 2004; #essereFerrari

evobatman posted:

Please someone sanity check my plan, because I want to know if I'm on the right track or about to make a huge mistake.

I have inherited an Exchange 2016 installation with about 1300 users and four servers, replicated 1-3 and 2-4, so that we at any time can take down one server for patching, maintenance, upgrade etc.

We have 5 research vessels around the world with anything from 128k-1mbit satellite links. These use cached exchange mode of course, but they are always complaining about slow email. They use shared accounts for the positions on board, such as "Captain", "Technician" and so on. These mailboxes are not used on-shore.

My plan is to put an Exchange server on each ship and to move the mailboxes for the ship positions to these servers. That way, big attachments are sent to the ship only once and then distributed to 40 clients, instead of 40 clients trying to download cat gifs from the onshore mail servers through the tiny tiny bandwidth that barely supports the ships telemetry data.

I want to add a fifth server to our onshore servers to replicate the datastores from the vessels.

The ships have their own domain controllers that are replicated to shore, good ESX hosts, SCCM secondary site and pretty much decent prerequisites for having good infrastructure, besides bandwidth. Let's assume that getting the server software on board the ship won't be an issue.

Am I on the right track here, or is this going to be a disaster? What possible pitfalls/consequences are there?

I have previously worked with oil rigs where they had their own mail server on each rig, and that seemed to work fine. However they were pretty fixed in position and had 4+mbit lines.

I would encourage the use of webmail, with a separate system for distributing large files to people onboard vessels.

# ? Sep 14, 2018 12:42

evobatman: Jul 30, 2006; it means nothing, but says everything!; Pillbug

Whenever I get complaints about Outlook performance, I ask "Does it work in webmail? Does it work in our VDI? Then it's not a problem", but users and reasons.

Putting each ship in their own domain is in my long-term plans, after we get control of the mess of three half-migrated domains we currently have, so that's for next year.

Isolated exchange servers will have to do, all the ships have veeam onboard anyway, so they'll have to rely on that for backup.

So I currently have mail1.company.com-mail4.company.com, behind the load balancer visible as mail.company.com. If I understand correctly, I should set up shipmail1.company.com-shipmail5.company.com as independent servers that are not tied to the onshore servers, or the load balancer.

Is it the reasonably feasible to move the CaptainShip1@company.com mailbox to the shipmail1.company.com mailserver, and then have him receive his mail there?

BTW, I'm having a consultant finalize the setup and installation of this when it's time, I'm not risking taking down mail for the whole company by checking one wrong box or putting in a wrong certificate somewhere. This is in the basic planning stages for now.

# ? Sep 14, 2018 13:02

Old Binsby: Jun 27, 2014

to be sure: the one domain/ship thing wasn't exactly a recommendation but what happened with early 00's satellite connections and mergers&acquisitions. The big cargo hauling ships were able to do limited centralized Exchange (I think it was actually cloud, so only client traffic on the link -- i.e. your current situation) only a few years back which is why they abandoned the local Exchange

# ? Sep 14, 2018 13:29

MJP: Jun 17, 2007; Are you looking at me Senpai?; Grimey Drawer

Old Binsby posted:

I'm not 100% sure what state exists between SMTP delivery (hitting the StoreDRV event) and 'actual' mailbox delivery. Actually I'm pretty sure those are the same, but do you mean the user fetching the message through outlook by that last bit? If so, a few things may have happened in the mean time. A server side mailbox rule may have moved or deleted/moved the message, a delegate may have done the same, it would be weird but there's probably a set of retention policy rules out there that can also do the same haphazardly, but that's all quite unlikely. Usually if a message is gone, the client misbehaves or the user fat finfered.

if it's enabled (not out of the box) you can search mailbox audit logs. Admin audit logs will contain things admins did as well as users with full access permission, delegates are seperately logged and finally you can see what the owner does if you also enable that. I'd try that for these two mailboxes specifically using something like
code:
set-mailbox -identity [the user missing things] -auditEnabled $true -auditDelegate @{add='move','harddelete','movetodeleteditems'}`
	-auditAdmin @{add='move','harddelete','movetodeleteditems'} -auditOwner @{add='move','harddelete','movetodeleteditems'}
Which things you audit may need a little finetuning but this shows when any mail item was moved, deleted, and removed from the deleted items. If it happens again, you can search the audit logs where the message went.

If you want to find the historical missing messages instead of waiting on new ones, they're probably in the dumpster or purged messages part of the mailbox at this point if they were deleted (which I suspect because it's usually the case) or in a random folder because the user messed up. The user may or may not be able to see them but you definitely can using new-mailboxsearch. You may need to add yourself to the Search Mailbox role group before this works, that role is not assigned to anyone by default because it grants unlimited access to search through and create copies of any and all mailbox data in scope (!!so keep the scope small and/or ditch the permissions after you're done, your data security officer will thank you)
code:
new-mailboxsearch -name 'any name' -sourcemailboxes 'DN or email address of user missing messages' `
	-searchquery 'subject:"[subject fragment, no wildcards]"' -loglevel Full -targetmailbox [an admin mailbox you can access]`
	-searchdumpster -startdate (get-date).adddays(-4) -enddate (get-date)
I was lazy with start/end date but locales are a hassle, usually YYYY-MM-DD works but I recall it not working for KQL-enabled things. If it doesn't, write the date in all formats you can think of being enabled in your domain). After it runs, the target mailbox will have a new root level folder with the results and a summary CSV. That's the nicest part of it, there's a lot of information about the whereabouts, read/deleted/modified/etc status of each item in the source mailbox. I've found things misplaced by admin assistants or cats or whatever quite often using this.

This is weird - the Exchange Shell says new-mailboxsearch isn't recognized as a cmdlet/function/etc. If I run get-command -noun *search* it returns only new-adminauditlogsearch, new-mailboxauditlogsearch, and test-exchangesearch.

# ? Sep 14, 2018 16:15

Submarine Sandpaper: May 27, 2007

they're changing that one for prem/offprem iirc. Try search-mailbox

# ? Sep 14, 2018 16:35

Will Styles: Jan 19, 2005

MJP posted:

This is weird - the Exchange Shell says new-mailboxsearch isn't recognized as a cmdlet/function/etc. If I run get-command -noun *search* it returns only new-adminauditlogsearch, new-mailboxauditlogsearch, and test-exchangesearch.

You need to be a member of the discovery management role group to run that command, it's not available to Org Admin by default. Add yourself to that role group and then relaunch the powershell window.

# ? Sep 14, 2018 16:36

Old Binsby: Jun 27, 2014

Will Styles posted:

You need to be a member of the discovery management role group to run that command, it's not available to Org Admin by default. Add yourself to that role group and then relaunch the powershell window.

Welp, this is what I meant but I formulated it the wrong way round. Do this ^^^^ or the alternative (which is what I meant to say): add the Search Mailbox role to the Org Management role group in ECP. You could/should make a custom role assignment with a less broad scope for the users in question and not the whole org but it's probably not worth the headache right now if you've never done that before. If/when an internal audit rolls around the compliancy people may ask you to consider doing that because it's in the booklet they read on administrating Exchange admins. Tell them you can still read anyones mail but sure.

# ? Sep 14, 2018 17:51

no pubes yet sorry: Sep 11, 2003

I'll take this to a new thread if it makes more sense -

We are on-prem Exchange 2010, moving to 2016. We have been using SourceOne for archiving and would need to upgrade it as well if we decide to stay with it for archiving due to compatibility issues.

We have looked at some cloud providers and some are pretty good and have some decent features but we don't really need it to be in the cloud or have a recurring monthly cost.

We don't have an enormous amount of mailboxes (200ish). Cloud is fine but we didn't go to O365 specifically because the cost isn't justifiable (yet) so per mailbox would need to be low if it were recurring.

# ? Sep 27, 2018 21:14

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

I've got a barracuda archiver box. It's about 4k or so. it will work with on prem and o365 should you need to pivot.

# ? Sep 29, 2018 02:27

Serfer: Mar 10, 2003; The piss tape is real

Just wanna give a shoutout to Lucid8's DigiScope for helping me rip the mail from this hosed up non-sp1 on-prem exchange 2010 run by an absentee admin to office 365 with no trouble at all.

Especially after his 9 year old UPS (dual power supply server with both leads plugged into the same UPS) welded some part of itself and kept turning off and on, over and over (it started the day before we took possession of the company, in a bit of kismet).

# ? Oct 11, 2018 06:34

Dans Macabre: Apr 24, 2004

who here knows about enforcing SMIME for all email on exchange online

# ? Oct 16, 2018 17:27

Teabag Dome Scandal: Mar 19, 2002

This thread doesn't seem too active but I'm losing my goddamn mind because my boss seems to think an email from Microsoft is phishing when it seems like it is a legitimate error that a message was rejected because it was suspected as being spam. The rejected email is claiming the users computer was hacked and they have screenshots/etc of their porn browsing habits. The rejected email appears to have been sent by the user to the user according to the Microsoft email. We use O365 for our exchange hosting so any undeliverable notifications SHOULD come from them but my boss thinks it isn't legitimate due to it coming from a *.onmicrosoft.com email address which I know is a real address since I've gotten emails from it before. To my eye the headers appear legitimate.

I don't know poo poo all about Exchange or anything but to me what appears to be happening is someone is using my orgs SMTP server to send an email to my user as that user. Not knowing much about O365 Exchange my assumption is you would need a valid login to even attempt to send an email through our SMTP server and if we're getting to the point where the SMTP server is rejecting the email that would mean their login was compromised? I don't know how else he would be getting this rejection email from Microsoft. Am I off my rocker here? What else could be going on?

# ? Nov 2, 2018 18:11

Submarine Sandpaper: May 27, 2007

it's probably just spoofed, from user to user is an attack we get often.

# ? Nov 2, 2018 18:18

Old Binsby: Jun 27, 2014

without knowing the details, I�d say err on the side of caution and assume phishers are getting pretty good at forging believable headers. Sure, they shouldn�t be able to add X-[hosted exchange] internal ones but I�ve seen scary good fakes lately

# ? Nov 2, 2018 18:46

Teabag Dome Scandal: Mar 19, 2002

Submarine Sandpaper posted:

it's probably just spoofed, from user to user is an attack we get often.

The headers don't look spoofed though, and it would be the weirdest phishing I've ever seen. The error email doesn't have instructions on doing anything and looks exactly like what I would expect down to our internal mail hops. I wouldn't be shocked to see the email trying to extort money coming through, but I am shocked that an email with the extortion came through as an attachment exactly as if it had been rejected by the server.

Old Binsby posted:

without knowing the details, I�d say err on the side of caution and assume phishers are getting pretty good at forging believable headers. Sure, they shouldn�t be able to add X-[hosted exchange] internal ones but I�ve seen scary good fakes lately

Its got the X-[hosted exchange] internal ones too.

The actual phishing part of it is extremely obvious phishing for bitcoins but that is as an attached copy of the email to the rejection email notification. My user didn't even look at it because most of the time people don't send emails as attachments much less phishing emails. A pdf or word document sure but an .eml file? I don't know what they're trying to do if the email from Microsoft not instructing me to do anything is part of the phishing attempt. I don't know what the goal would be. Make a really official looking microsoft email saying their phishing email is spam to do what? Change his password without providing a fake link? I've gotten rejection notifications exactly like this when the server thought a spam email I was forwarding to my boss was actual spam. I'm just very confused.

# ? Nov 2, 2018 20:18

Old Binsby: Jun 27, 2014

i just reread your first post and what probably happens is you�re NDR spammed more or less. You said your org gets bounce messages resulting from messages addressed to your org, and sent from it as well?

I may be a bit off still but it�s a known spamming method to forge the sender so instead of Hacker Z a return path address pretending to be some company X trying to reach company Y is used. Doesn�t need to be watertight because the smart spammer sends it to someone that doesn�t exist so as to get refused even before anti-spam detection rejects it. The message can�t be delivered, the receiver Y (hosted exchange) rejects your message and sends an NDR to the return path domain X which os the actual target. The headers will look legit because they are, the mail is sent from the rejection point and that�s a legitimate microsoft owned mail server. There are plenty ways to prevent the NDR for a message you never sent from reaching you and ideally they work but... They don�t always I guess. That O365 NDRs can helpfully attach the original message, at least cross tenant this seems to happen (i don�t recall exactly right now) is the cute bit. Now you have the spam when you�re concerned someone missed a VITAL MESSAGE.

anyway maybe this isn�t it and i�m way off but I�ve seen this and thought about it for a bit reaching the above conclusion, please correct logic blunders, i am prone to making those and e-mail is hard

Old Binsby fucked around with this message at 10:55 on Nov 3, 2018

# ? Nov 3, 2018 10:51

Maneki Neko: Oct 27, 2000

I'm curious how people's experiences with OWA/activesync redirection in Exchange hybrid have been.

Outlook is great about dealing with changes, but it seems like it's the mobile clients responsibility to deal with activesync redirection and most of them seem pretty bad at it from the migrations I've done, to the point where it's generally better to just remove/readd the account. OWA redirection also seems to take a bit to notice that the mailbox has moved.

Is that in line with other people's experiences?

# ? Nov 6, 2018 18:55

JBark: Jun 27, 2000; Good passwords are a good idea.

Maneki Neko posted:

I'm curious how people's experiences with OWA/activesync redirection in Exchange hybrid have been.

Outlook is great about dealing with changes, but it seems like it's the mobile clients responsibility to deal with activesync redirection and most of them seem pretty bad at it from the migrations I've done, to the point where it's generally better to just remove/readd the account. OWA redirection also seems to take a bit to notice that the mailbox has moved.

Is that in line with other people's experiences?

When I migrated our company from onprem to 365, exactly 1 phone (an iPhone) handled the activesync change notification and updated itself correctly. The other 40 or so phones (iPhones/Android/WinMo) had to be manually updated. I have no idea how that one phone managed to work. At least with Android and iOS, almost all the phones were fine with just a simple server name change. The WinMo phones had all sorts of bizarre issues, like the account not even being displayed under the list of configured accounts, but saying it already existed when trying to add it back in, so they had to be factory reset.

Edit:
This is the doc I read beforehand, and we met all the requirements just fine.
https://docs.microsoft.com/en-us/exchange/activesync-settings

# ? Nov 8, 2018 07:39

devmd01: Mar 7, 2006; Elektronik
Supersonik

Good lord I just had a 2016 upgrade from CU9 to CU11 that was very painful...I was fighting it for two weeks. Thankfully we only use them for on-prem ECP edits for syncing to O365, and smtp relay out for on-prem applications.

The final item I found and fixed was that both mailbox databases managed to get corrupted on each server behind the load balancer. I never even though to check the databases since we don't have any user mailboxes on them, but when the system mailboxes can't mount, good luck getting into the exchange control panel, you'll just get HTTP500 errors galore.

# ? Nov 8, 2018 14:02

itskage: Aug 26, 2003

I have a database that dismounted with corruption messages. ESE had then been trying to replay logs, and failing (single copy here). Messages started late night Friday. I restored back to a Friday AM point, and replayed the logs. Everything seems fine and my state goes from dirty to clean. I can mount the database successfully but after 2~5 mins it dismounts again.

My errors in the event viewer go like this in reverse order:

quote:

At '11/19/2018 4:34:45 PM' the copy of database 'Users' on this server was unexpectedly dismounted. The error returned by failover was "There is only one copy of this mailbox database (Users). Automatic recovery is not available.". For more specific information about the failures, consult the event log on the server for other "ExchangeStoreDb" events.

quote:

At '11/19/2018 4:34:45 PM' the Exchange store database 'Users' copy on this server detected corruption on the active copy of the database. To help identify the specific failure, consult the Event log on the server for other storage and "ExchangeStoreDb" events. Service recovery was attempted by failover to another copy, which was unsuccessful in restoring the service. Error: There is only one copy of this mailbox database (Users). Automatic recovery is not available.

quote:

Microsoft Exchange Information Store worker process (8436) has encountered a fatal database exception (Microsoft.Isam.Esent.Interop.EsentLVCorruptedException: Corruption encountered in long-value tree

quote:

The mailbox with mailboxguid "" caused crash or resource outage on database (GUID="").

So the thing is that that guid is no longer in this database. I had corruption issues with it about three weeks ago and it was getting quarantined. The owners of that shared mailbox were doing some really dumb thing and making folders for every correspondence and sub folders in those for every conversation, so over the last 4 years the size of it had ballooned to something like 38000 folders. It was insane. OWA doesn't even load the tree past 10000.

After flipping out, I cleaned all of that up by archiving the parts they needed to keep to PST from backups, and then on the live mailbox deleted out all of the folder trees. We got it down to some 800 folders that still needs to be cleaned up. From there I ran the mailbox repair requests on it, and migrated it to another database. It has been fine since.

Except now it's doing this to the database it used to be in. At this point I guess I just need to run eseutil /p and have it try to repair the whole database? I'm assuming since this is dismounted it should be safe to run without stopping any services? Or will I need to take down the exchange services (and the other mailboxes) while it runs? What happens to the mail that's coming in while this is dismounted and running?

I've been trying to avoid the eseutil /p since it says to expect an hour per 3-5 GB, but at this point I don't think there's much else I can do? Any comments would be appreciated before I run this thing.

itskage fucked around with this message at 23:08 on Nov 19, 2018

# ? Nov 19, 2018 23:05

Thanks Ants: May 21, 2004; #essereFerrari

I'd have approval to open a per-incident support case in place before you start anything

# ? Nov 20, 2018 00:01

itskage: Aug 26, 2003

Thanks Ants posted:

I'd have approval to open a per-incident support case in place before you start anything

This would have been a great way to CYA. But I figured worst case we'd be rolling back to before the weekend and the most we'd lose is a bunch of junk mails.

I ran the utility anyway. It took about 5 hours but everything is looking so far so good. I immediately kicked off a full back up. Supposed to defrag, but I am hoping I can save that downtime for the long weekend.

# ? Nov 20, 2018 07:24

evobatman: Jul 30, 2006; it means nothing, but says everything!; Pillbug

I'm gonna need to ask a stupid question, and I will also remind you that I am the most senior Microsoft engineer at my organization.

My predecessor set up a 4 node Exchange setup at our HQ, which works fine. However we have a research ship on the other side of the world with only a 1mbit satellite uplink. I want to give the ship its own server, so that only the server will communicate with HQ instead of 40 clients trying to download their emails through the satellite at once, and so the people onboard can use it for internal emails. The ship has its own domain controller and SCCM secondary site.

We have tried recommending people to use Thunderbird with IMAP for lighter traffic and using webmail, but because of politics it HAS to be Outlook.

I have set up the server and run setup.exe on the Exchange ISO, but after there I'm pretty much stuck. I'd prefer not to mess around on my own too much, since I don't want to accidentally take down email for the whole organization. I can find tons of guides on how to set up a new exchange server, but practically nothing on adding one to my existing setup with certificates, send/receive connectors and so on.

Anyone got any good tips for guides on how to do that?

# ? Dec 15, 2018 10:48

Adbot: ADBOT LOVES YOU

# ? Apr 26, 2024 08:10

Old Binsby: Jun 27, 2014

the MS one is reasonable to start but maybe you've found it. It covers more general usage than you niche scenario but you don't want to tightly integrate them with your org anyway (i think?).
https://docs.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/configure-mail-flow-and-client-access?view=exchserver-2019

# ? Dec 16, 2018 21:17

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

«‹›97 »