Exchange - where email goes to die - The Something Awful Forums

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

You turn it off with GPO

If you have a spam gateway that sends spam to the recipients junk folder, does turning the junk folder off in GPO stop the email from being sent there?

# ¿ Dec 4, 2013 21:38

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 17:51

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

I think it only turns off client side filtering

Is turning it off in GPO the same thing as turning it off in the Outlook options?

I tested it by turning it off in Outlook and waiting for a spam email to hit my gateway that sends it to the user's junk email and it came to my inbox instead :sigh:

# ¿ Dec 5, 2013 20:19

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

yes it's the same so I guess it does turn off that folder completely.

Yeah bummer. Wish you could leave the folder working but just disable the secondary spam check. We've already had several instances where legitimate email is considered a pass at the spam gateway only to still end up in the junk folder because Outlook considered it spam. That second check is kind of a bitch.

# ¿ Dec 5, 2013 21:34

kiwid: Sep 30, 2013

I have a weird issue with our Exchange 2003 server. We're in the process of a staged migration to Office 365 and we've successfully migrated about 50 users. However, I went to go migrate a new user today which was successful, however, now when some people (not all) email her that are still on the 2003 box, they get an NDR as follows:

quote:

Your message did not reach some or all of the intended recipients.

Subject: test
Sent: 2/5/2014�11:14 AM

The following recipient(s) could not be reached:

��[redacted]�on�2/5/2014�11:14 AM
��The e-mail address could not be found. Perhaps the recipient moved to a different e-mail organization, or there was a mistake in the address. Check the address and try again.The MTS-ID of the original message is:c=US;a= ;p=[redacted];l=[redacted]
��MSEXCH:MSExchangeMTA:First Administrative Group:ENTERPRISE

However, she still receives the email. So an NDR is generated to the senders but she still receives the email. This is only happening when sending to this person and only from a certain few senders.

What the gently caress is going on? I've been Googling for like the past 2 hours.

# ¿ Feb 5, 2014 17:20

kiwid: Sep 30, 2013

Will Styles posted:

^^ Have you tried having users clear their cache in Outlook?

Yeah, the issue still occurs using OWA too.

# ¿ Feb 5, 2014 19:50

kiwid: Sep 30, 2013

I appear to have fixed my issue by deleting the user's exchange attributes, deleting the users on premise mailbox and then creating a new empty mailbox. I then started the Office 365 migration again to re-link the user via the targetAddress and whatever else it does. No data loss because the account is already migrated to Office 365, it's just the link is broken via the X400 address or some poo poo. There is like a million different reasons this NDR happens and it's not very fun to Google so hopefully this helps any one else in this position.

# ¿ Feb 5, 2014 21:12

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

I have to migrate from premise exchange 2010 to o365, never moved from that to that - any words of wisdom? Can I use the powershell things

2010 to o365 is much easier. We're still on 2003 so we got stuck doing staged migration and it's been a hassle, mainly cause it randomly doesn't work. Otherwise it's pretty straight forward. If you have any say in it though, I'd recommend just upgrading 2010 to 2013 server instead of going with o365.

As for powershell, you are very limited in the commands you can do but yes there are some powershell commands available to you.

Our problem is that we have a lot of users with a lot of large PST files. The only way to import these in o365 is directly through Outlook and it's loving terrible. With a 2013 server I believe there is a powershell command to directly import a PST.

# ¿ Feb 6, 2014 21:22

kiwid: Sep 30, 2013

Bob Morales posted:

Speaking of moving to hosted exchange - what do you guys do for all your network devices that send out email notifications etc? I don't want to buy a mailbox for UPS's, a mailbox for switches, a mailbox for our wifi units....

Keep some internal mail server with a different name or something? notifications.xyz.com?

I think (haven't tried it), you can just do this through o365 mail enabled contacts which don't require a license (just mailboxes require a license). However, what we do is just setup our SPF records to allow both our o365 account and our public ip allowed to send as. Then we setup a simple smtp relay on the internal network.

# ¿ Feb 6, 2014 21:24

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

ok so actually i'm going from '07 to o365 not 2010. looks like I will have to do "staged migration" too right... so what do you mean "randomly doesn't work" do you mean I just need to babysit the mailboxes as they get transferred?

also did you do SSO

Yeah you basically have to baby sit them. Sometimes the migration will fail for no reason at all and then corrupt something and users that email that person will get NDRs, even though the email still goes through. I've been able to fix this every time by just re-starting the migration over and over until it finally completes successfully (I've had to do this 4 times on one mailbox once). Then I remove their local exchange attributes (removes the targetAddress link to the new migrated mailbox so they won't get new mail), delete the on-premise mailbox then create a new empty on-premise mailbox and start the migration again. The migration will relink the account to o365 via the targetAddress attribute and everything works out, but it's loving stupid.

We didn't do SSO, we just did directory sync with password sync. I wanted to do SSO but my boss wouldn't ok a server for it.

kiwid fucked around with this message at 19:41 on Feb 8, 2014

# ¿ Feb 8, 2014 19:38

kiwid: Sep 30, 2013

Haha, importing a 13gb PST file directly to the online archive of a user. Day 2: still going.

We have a 60mbit upstream too.

The best part is that it completely locks up Outlook so the user is stuck using OWA until it's done.

Microsoft does not provide a way to import this via PowerShell and their PST capture tool requires Outlook 2010 (which we are not licensed for).

# ¿ Feb 10, 2014 21:58

kiwid: Sep 30, 2013

TKovacs2 posted:

I'm pretty certain you can do this via PowerShell, at least with an on-premesis setup. I imported a ton of PST's via PowerShell when we upgraded to Exchange 2010 from 2003 and setup online archiving.

Just not certain they directly went to the Online Archive. I think they did. At worst, I imported them into the users inbox and them ran the mailbox maintenance manually to force messages older than our retention period into that online archive.

PM me if you'd like a copy of the scripts I used.

Nah it's definitely doable with on-premise servers using new-mailboximportrequest cmdlet but that isn't available to office 365 users. You can even go directly to an online archive with the -isarchive switch.

# ¿ Feb 11, 2014 02:08

kiwid: Sep 30, 2013

Day 3: Archive import failed with unhelpful error message.

I'm now drag and dropping folders.

Such an innovative revolutionary system.

# ¿ Feb 11, 2014 15:50

kiwid: Sep 30, 2013

Day 6: PST archive still transferring, it's now on the sent items so we're getting close. :shepicide:

Meanwhile, these are all the different errors we've been getting doing the "official Microsoft recommended way" of importing PST files to an online archive on some of our other users (scanpst doesn't change anything).

# ¿ Feb 14, 2014 15:00

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

I have a question about Office 365 but not specifically Exchange... Not sure if there's a better thread for this. Anyway: I'm getting Office 365 for email but I want to do single signon with AD, so I understand I need AD federation services. Documentation says something about a network load balancing server... do I need that? We have 2 domain controllers but only 15 users.

No, you could technically just point it to the one DC, but if that DC goes down, so does SSO. However, I think you should look at using an ADFS proxy so you could also put the load balancing on the same server I think.

kiwid fucked around with this message at 18:52 on Feb 19, 2014

# ¿ Feb 19, 2014 18:48

kiwid: Sep 30, 2013

NevergirlsOFFICIAL posted:

Hey turns out I can just use directory sync instead of adfs.

That's what we did.

# ¿ Feb 19, 2014 21:02

kiwid: Sep 30, 2013

carlcarlson posted:

Does anyone have any suggestions for dealing with mail archiving and legal discovery? I don't have any kind of regulations that I need to keep up with, but what I do have is a fuckload of PST files organized by month.

Outlook is so lovely and clearly is not capable of handling or indexing this much data. I downloaded a trial version of Looken that indexed for 3 days straight, then poo poo the bed this morning and dumped it's index files, so now I'm back to square one for indexing 40+ PSTs.

Exchange 2013 has both online archives and legal hold/discovery.

We've uploaded all our user's PST files (which there was a loving lot of) into online archives.

# ¿ Mar 10, 2014 16:15

kiwid: Sep 30, 2013

That thing is the size of an SSD.

# ¿ Mar 12, 2014 17:25

kiwid: Sep 30, 2013

metallyca posted:

I was under the impression though that when you run Exchange setup it automatically did this anyway.

Yeah it definitely does do this. When I was messing around with it in my lab, I intentionally didn't run the commands and the setup realizes this and runs it anyway.

# ¿ Mar 17, 2014 21:13

kiwid: Sep 30, 2013

So we're still in the middle of a staged Office 365 migration and I'm now moving the equipment and rooms to resources on Office 365. We're migrating from 2003 so we didn't have resource mailboxes before, they were actual users in AD and user mailboxes. So, instead of migrating I just created new resources on the Office 365 console and now I want to delete the resource users from our AD. What will happen to calendar items that these users are already scheduled for? Will they disappear or stay for legacy?

# ¿ Mar 26, 2014 13:10

kiwid: Sep 30, 2013

wintermuteCF posted:

Suggestions?

http://exchangeserverpro.com/exchange-2010-free-training-videos/

Unfortunately, he hasn't done an Exchange 2013 course yet but I emailed him and he's working on one apparently.

edit: Also, if you don't have one already, look into a subscription here: http://www.cbtnuggets.com/

# ¿ Mar 27, 2014 16:31

kiwid: Sep 30, 2013

Maybe one of you PowerShell gurus can help me here. I need to run this command on all my resources:

code:

Set-MailboxFolderPermission -identity "Head Office - Boardroom:\calendar" -User default -AccessRights LimitedDetails

So, I can get my resources by running a command like:

code:

Get-Mailbox -RecipientTypeDetails RoomMailbox

and then piping it to the Set-MailboxFolderPermission command, right? But how do I target only the calendar like the first command?

# ¿ Mar 27, 2014 22:01

kiwid: Sep 30, 2013

Nitr0 posted:

$test = get-mailbox -recipienttypedetails roommailbox | select-object name
Set-MailboxFolderPermission -identity "'$test':\calendar" -User default -AccessRights LimitedDetails

Any ideas?

code:

PS C:\WINDOWS\system32> Set-MailboxFolderPermission -Identity "${rooms}:\calendar" -User default -AccessRights Reviewer

The specified mailbox "      " doesn't exist.

PS C:\WINDOWS\system32> $rooms

Name
----
Head Office - Boardroom
Head Office - Food Products
Head Office - Trading
Head Office - Fish Bowl
Head Office - Lunch Room
Head Office - Blue Room
Head Office - Computer


PS C:\WINDOWS\system32>

# ¿ Mar 31, 2014 13:51

kiwid: Sep 30, 2013

Gyshall posted:

I think you need to pipe the command - not use the variable. If you're using the variable you might need a for-each { statement or something.

gently caress powershell sometimes man
code:
Get-mailbox -recipienttypedetails roommailbox | set-mailboxfolderpermission -user default -accessrights limiteddetails

Yeah I ended up doing a foreach.

code:

$rooms = Get-Mailbox -RecipientTypeDetails RoomMailbox | Select-Object name

foreach ($r in $rooms) {
    Set-MailboxFolderPermission -Identity "$($r.name):\calendar" -User Default -AccessRights Reviewer
    Set-CalendarProcessing -Identity "$($r.name)" -AddOrganizerToSubject $true -DeleteComments $false -DeleteSubject $false -BookingWindowInDays 180 -MaximumDurationInMinutes 43200
}

# ¿ Mar 31, 2014 16:36

kiwid: Sep 30, 2013

We're about to finalize our Office 365 migration but we have a lot of fragmentation when it comes to servers, software, robots, etc., that were relaying anonymously through our Exchange 2003 SMTP server. I know I'm going to forget about some of our stuff that's setup to email alerts and poo poo so what is the best way to resolve this? Should I retire the Exchange 2003 server and put in an SMTP relay on that IP address to send to an Office 365 smart host and then just monitor the logs to see what is still sending, or should I do something else?

# ¿ Apr 9, 2014 17:11

kiwid: Sep 30, 2013

nexxai posted:

Rather than watching the logs, set up a transport rule that forwards a copy of every message from that smart host to your mailbox so that you get notified immediately rather than having to manually check logs (if this isn't breaking any compliance rules for your company, of course).

Ah, yeah that makes more sense.

Next question. I have a company that builds a lot of our custom web applications that wants to be able to send password resets from a @ourdomain.com email address. I've never done this before for external use. Should I just modify our SPF record to allow them as a sender and tell them to use their own SMTP server or should I somehow give them access to send through our Office 365 account?

# ¿ Apr 10, 2014 13:26

kiwid: Sep 30, 2013

When someone creates their own distribution groups in their contacts by adding people or groups from the GAB, those groups are a snapshot of how they were at that time and not live, right?

For example, if someone creates their own distribution group that includes groups from the GAB and then we delete people from the real groups which propagate to the GAB, the other person's distribution list is not updated with the current group membership, am I correct?

# ¿ Apr 16, 2014 15:19

kiwid: Sep 30, 2013

Does the email attribute become completely useless when you migrate to Office 365?

Talking about this:

That field doesn't seem to control anything. Office 365 seems to look at only the proxyAddresses attribute and completely ignores this one. So can anyone tell me why we'd still need to fill in this field?

# ¿ Apr 17, 2014 16:43

kiwid: Sep 30, 2013

Calidus posted:

How much time should I budget for a Exchange 2007 to Exchange 365 Cutover Migration? How idiot proof is this process?

How many mailboxes?

We took 3 months to do a staged migration but my help desk is retarded and does one at a time. With a cutover we probably could have done it in a few weeks. The biggest slow down to the process is pointing everyone's Outlook at Office 365. With SSO and good documentation you could delegate that process to your users, do the cutover migration and tell everyone to repoint their Outlook or use OWA.

# ¿ Apr 22, 2014 19:51

kiwid: Sep 30, 2013

Bob Morales posted:

Gmail itself only allows you to send 25MB attachments

https://support.google.com/mail/answer/6584?hl=en

Same with Exchange Online/Office 365

http://technet.microsoft.com/en-us/library/exchange-online-limits.aspx

# ¿ Apr 22, 2014 19:53

kiwid: Sep 30, 2013

Calidus posted:

Only 20 mailboxes, so could I possibly do it over a weekend?

Yeah I'd say so, you can do a lot of prep work prior to the actual migration (dir sync, etc.) so that all you have to do is the actual migration step and mx record move. Keep in mind though that the speed of migrations also depends on your upload speed and the size of the current mailboxes.

# ¿ Apr 23, 2014 20:44

kiwid: Sep 30, 2013

Regarding Office 365, if a user uploads their picture for their Outlook/Lync profile, that's internal only, right? Never will an external user see this picture unless a user sends them a vcard or something? Or am I wrong?

# ¿ Jun 20, 2014 19:44

kiwid: Sep 30, 2013

Can someone quickly explain DKIM to me? I've only ever messed around with SPF.

Let's say I have a domain example.com that sends mail out of office 365 in addition to mandrill for transactional relay.

Using SPF, I'd have to ensure that office 365 and mandrill were both in my SPF, otherwise I'd have problems. Now with DKIM, if the provider doesn't support it (office 365), I can still use a domain key for mandrill without risk of my mail from office 365 not working, right?

# ¿ Jul 29, 2014 03:01

kiwid: Sep 30, 2013

Thalagyrt posted:

DKIM is orthogonal to SPF. Mail will never be blocked due to DKIM. It's only used to give you a rep boost. SPF explicitly states "These mail servers can send for this domain" and you block mail that doesn't match. DKIM is a bit different - you put a signature on a message and the receiver can verify the signature against your published keys. A receiver will typically give a negative spam score to a message with a valid DKIM signature. So, say on a system where you block mail with a score of 5 or higher as spam and give -5 points to a DKIM signed message, a message might be scored at 6 normally and blocked as spam, but that same message with a valid DKIM signature would be scored at 1 and passed as clean mail.

Awesome, well explained. Thank you.

# ¿ Jul 29, 2014 03:26

kiwid: Sep 30, 2013

Next question. We're a small/medium business (300ish networked users) but we are a global company that deals with people and businesses all over the world. This has caused us to have a lot of issues with phishing attempts from third world countries, and some being successful and losing us hundreds of thousands of dollars.

A while ago we setup a rule to delete all incoming email from our own domain that wasn't send from one of our relays via IP address. However, in an effort to consolidate our SMTP relays and outsourced application email, we are giving the Mandrill service a go and getting rid of the internal relays. In addition to Mandrill, we also use MailChimp for marketing email. One problem we're now encountering is that we're finding it difficult to manage our "external senders" rule. The problem is that Mandrill and MailChimp change their mail server IPs on a regular basis so every so often I "dig TXT spf.mandrillapp.com" for a list of Mandrill's sending IPs and "dig TXT spf1.mcsv.net" for a list of MailChimps IPs and update accordingly.

Now, before I go through the hassle of writing a program to alert us when one of these change, is there any better way to do this? Here is the rule:

# ¿ Jul 29, 2014 14:11

kiwid: Sep 30, 2013

Thalagyrt posted:

That really sounds like a job for SPF. If you're filtering inbound email with SPF, then the SPF check phase should catch "Huh, this email came from a hosting company in Brazil, not from one of our trusted relays" and drop the email. That rule shouldn't even be necessary if your spam filtering setup is working properly... Maybe I'm missing something - I deal with on premises Exchange - but that's how it works for our setup. Anyone trying to spoof my domain as a sender will just get dropped via SPF.

We have high confidence spam going into quarantine (with option to allow users to manage their own quarantine) and regular spam going into junk email. I can't remember exactly what happened since it was over a year ago but a user still got a phishing attempt and then proceeded to wire over $100k to a bank account in Russia. Whether it was marked as spam and she retrieved it from one of those two locations manually, I can't remember.

# ¿ Jul 29, 2014 15:42

kiwid: Sep 30, 2013

Thalagyrt posted:

If the message fails SPF it should be outright dropped, not quarantined. Any mail claiming to be from your domain that's not actually from your domain will fail SPF and thus should be dropped.

Oh, let me do some testing then as I might not need the rule any more. We've only recently turned on SPF so that rule might be for nothing. Thanks.

# ¿ Jul 29, 2014 16:58

kiwid: Sep 30, 2013

I put our rule into Test mode without policy tips and then tried to send an email from our domain from an SMTP server that is niether in our SPF nor in our external senders rule and it comes in just fine...

Here is a screencap showing that a hard fail (our spf record uses -all) should be triggered.

Maybe Office 365 is just a giant piece of poo poo? I don't know.

# ¿ Jul 29, 2014 19:24

kiwid: Sep 30, 2013

Does Exclaimer Mail Disclaimer work on Office 365? The website really only says Exchange 2007-2013 from what I see.

# ¿ Aug 6, 2014 19:21

kiwid: Sep 30, 2013

I just got off the phone with "Microsoft" regarding a support ticket with Office 365. Their reasoning that the SPF hard fail option doesn't block mail (it gives it a SCL of 5) is because too many people have incorrectly configured SPF records. I mean, that's why SPF has the option to soft fail, but what ever. So their official solution is that we need that transport rule to mimic SPF.

# ¿ Aug 25, 2014 18:40

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 17:51

kiwid: Sep 30, 2013

Is there any way to figure out why an email get's categorized as spam in Office 365?

I'm receiving email from a certain domain that always goes into my junk email folder. Yes, I could just add the domain to my safe senders, but I wanted to find out why it's getting triggered as spam. Looking at the headers, they even have a correct SPF record so the headers has Received-SPF: Pass, yet for some reason, the email is getting a SCL of 5. The email also appears to have a DKIM-Signature header.

# ¿ Aug 27, 2014 16:08

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Exchange - where email goes to die

«‹›2 »