- Exchange Server 2013 databases unexpectedly fail over in a co-existence environment with Exchange Server 2007 - http://support2.microsoft.com/kb/2997209
- You cannot route ActiveSync traffic to Exchange 2007 mailboxes after you upgrade to Exchange 2013 CU6 - http://support2.microsoft.com/kb/2997847
- Hybrid deployment's centralized mail transport doesn't work (when you want to route all Internet bound emails - including users located in Office 365 to your on premise Exchange Server 2013) - http://nathennod.blogspot.com.au/2014/10/hybrid-deployment-route-all-emails.html
Friday, October 10, 2014
Exchange 2013 CU6 Beware!
Wednesday, October 08, 2014
Hybrid Deployment - Route all emails (including Internet bound email from Office 365 users) to On Premise
To perform this, during HCW, you would pick the option "Enable centralized mail transport" during the HCW wizard, i.e.:
The only problem is that, when an Office 365 user sends an email to any Internet recipient, it would fail with NDR - "5.7.1 Unable to relay". Further examining the NDR, it would seem that the On Prem Exchange Server (in my case - Exchange 2013 CU6) is rejecting the email relay.
The only article I can find that relates to this problem is here (http://community.office365.com/en-us/f/148/t/265897.aspx), but I couldn't find the receive connector named "Inbound from Office 365" on my Exchange 2013. See below:
So apparently, Exchange 2007 HCW creates a new receive connector called "Inbound from Office 365" and Exchange 2013 HCW just reconfigures the "Default Front End servername" receive connector with TLS authentication with Exchange Online Protection, as seen in the following HCW log entry:
[10/06/2014 13:36:21] INFO : Session=OnPrem Cmdlet=Set-ReceiveConnector -Identity 'ServerName\Default Frontend ServerName' -TLSCertificateName 'CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=USCN=*.company.com, O=Company Name' -TLSDomainCapabilities 'CN=MSIT Machine Auth CA 2, DC=redmond, DC=corp, DC=microsoft, DC=comCN=mail.protection.outlook.com, OU=Forefront Online Protection for Exchange, O=Microsoft, L=Redmond, S=WA, C=US:AcceptCloudServicesMail' START
With Exchange 2013 CU6, it seems like there is a bug that relay is not enabled on the "Default Frontend" receive connector.
According to the Microsoft engineer, it is a bug that has been highlighted to the product group.
So to fix the problem, I just need to issue the command and the problem is fixed:
Get-ReceiveConnector "ServerName\Default Frontend ServerName" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"
Monday, October 06, 2014
Exchange 2013 Hybrid Configuration Wizard Failing
HTTP Error 500.19 - Internal Server Error
Absolute physical path "C:\inetpub\custerr\C:\inetpub\custerr" is not allowed in system.webServer/httpErrors section in web.config file. Use relative path instead.
Screenshot here:
ActiveSync and AdminSIDHolder
The following log entry is observed in Exchange 2013:
Log Name: Application
Source: MSExchange ActiveSync
Date: 6/10/2014 6:27:44 PM
Event ID: 1053
Task Category: Configuration
Level: Error
Keywords: Classic
User: N/A
Computer: Exchange2013Server.company.com
Description:
Exchange ActiveSync doesn't have sufficient permissions to create the "CN=User Name,OU=IT,OU=Administration,DC=company,DC=com" container under Active Directory user "Active Directory operation failed on dc.company.com. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
".
Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchangeActiveSyncDevices" and doesn't have any deny permissions that block such operations.
Also, from exRCA:
Attempting the FolderSync command failed.
Exchange ActiveSync returned an HTTP 500 response (Internal Server Error)
There are two ways to fix this, either by passing security on AdminSIDHolder by granting the required ActiveSync permissions on it, or make the changes on every privileged user's (usually domain admin) AD account - but caveat is that the user might make the ActiveSync directory sync within the hour, or AdminSIDHolder will kick in the original settings again.
1. AdminSIDHolder "fix"/bypass - http://daddyr.blogspot.com.au/2013/08/add-acls-to-adminsdholder-for-exchange.html
REM This user permissions
dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /G "MYDOMAIN\Exchange Servers:CCDC;msExchActiveSyncDevices"
REM Descendant msExchActiveSyncDevices objects
dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /I:S /G "MYDOMAIN\Exchange Servers:LCRPWPRCWD;;msExchActiveSyncDevices"
dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /I:S /G "MYDOMAIN\Exchange Servers:CCDC;msExchActiveSyncDevice;msExchActiveSyncDevices"
REM Descendant msExchActiveSyncDevice objects
dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /I:S /G "MYDOMAIN\Exchange Servers:LCRPWPRCWD;;msExchActiveSyncDevice"
2. Per user setting - but be quick! Setup ActiveSync within the hour - http://namitguy.blogspot.com.au/2010/09/exchange-2010-activesync-issue-or.html
- Launch ADUC and make sure Advanced View is enabled
- Right-click the user account and go to Properties
- Click the Security tab, then click Advanced
- Check the Include inheritable permission.... checkbox
- OK out of all the dialog boxes
- Sync your device
Sigh - Outlook Anywhere Exchange 2007 not playing nice with Exchange 2013
exRCA returned an error:
RPC
Proxy can't be pinged.
|
||||
|
To make the long story short, the authentication method for Outlook Anywhere has to be set to NTLM on both Ex2013 and Ex2007. Again, just like the previously mentioned ActiveSync and OWA virtual directory issues, I had to reconfigure Outlook Anywhere.
- Disable Outlook Anywhere (http://technet.microsoft.com/en-us/library/bb124537(v=exchg.80).aspx)
- Enable Outlook Anywhere - only performing the step under "To use the Exchange Management Console to enable Outlook Anywhere" (http://technet.microsoft.com/en-us/library/bb123889(v=exchg.80).aspx)
Event Type: Information
Event Source: MSExchange RPC Over HTTP Autoconfig
Event Category: General
Event ID: 3003
Date: 6/10/2014
Time: 10:50:51 AM
User: N/A
Computer: EXCHANGESERVER
Description:
The Outlook Anywhere authentication settings have been updated.
Old settings: Ntlm
New settings: Basic
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
This article provides an extremely friendly insight that I could not find elsewhere:
http://blogs.technet.com/b/rmilne/archive/2014/03/19/exchange-2007-2013-outlook-anywhere-coexistence.aspx
The parts that struck me was:
- Note the two different authentication settings that are listed. ClientAuthenticationMethod and IISAuthenticationMethods. For the detail oriented people out there, you saw that one was plural and the other singular.
- Client authentication, which is used to allow clients like Outlook 2013 to authenticate with Exchange is properly configured. The same consistent OA client authentication scheme should be deployed on legacy CAS and CAS 2013.
- Internet Information Services (IIS) authentication, which is used to allow Exchange servers to communicate MUST include NTLM auth.
Exchange 2007 OWA not playing nice with Exchange 2013 for redirection
As the customer was using ISA Server 2006, the first thing is to bypass that and change Exchange 2007 OWA into Forms Based Authentication (FBA). It was set to Basic Authentication previously to support ISA 2006 publishing.
Here comes the trouble, after logging in from OWA 2013, the following error message was displayed:
440 Login Timeout
We tried numerous things, including changing the authentication methods in IIS7 for OWA, but none worked.
The only way that we managed to get it working is to re-create the OWA virtual directories following the article (http://support2.microsoft.com/kb/941201). Only trouble is, although all the virtual directories were deleted and recreated successfully, the /OWA virtual directory would not come up! When the PowerShell cmdllet was ran, an obscure error message popped out (sorry I didn't have screenshot), basically saying that is has no access to Active Directory.
Did a few things and none worked (including forceing AD replication "repadmin /syncall"),
More Internet searching came out with this solution (http://blogs.dirteam.com/blogs/davestork/archive/2010/12/23/fixing-a-broken-owa-2010-virtual-directory.aspx) - but just as I was going to recreate the OWA container, I tried re-running the New-OWAVirtualDirectory cmdlet (not retyping it, just running the command history to repeat the command) and it worked.
I have no idea why only the /OWA virtual directory have this problem (/Exchange, /public/ and /exchweb had no such issue) - but I guess sometime button meshing does make sense.
Oh well, onward we go.
Friday, October 03, 2014
Exchange 2007 ActiveSync not playing nice with co-existence with Exchange 2013
Exchange 2013 does not seem want to proxy ActiveSync request for users still having mailbox on Exchange 2007. When testing Exchange Connectivity Test (https://testconnectivity.microsoft.com/), the error returned was:
An HTTP 500 response was returned from IIS7.
It seems that it's Exchange 2007 at fault here. The only way to fix it is to recreate the ActiveSync virtual directory on Exchange 2007, using the following PowerShell commands:
Remove-ActiveSyncVirtualDirectory -Identity "EXCHANGEServer\Microsoft-Server-ActiveSync (Default Web Site)" -Confirm:$false
New-ActiveSyncVirtualDirectory -WebsiteName "Default Web Site" -InternalUrl "https://webmail.company.com/Microsoft-Server-ActiveSync" -ExternalAuthenticationMethods Basic -InternalAuthenticationMethods Basic
The Exchange 2007 Microsoft-Server-ActiveSync virtual directory must be corrupted along the way.
Exchange 2013 - Problems Relocating Log Path
move-databasepath "DatabaseName" -LogFolderPath "G:\BiggerExchangeLogs\"
The PowerShell would start and then awkwardly dump me back to the prompt without any message.
So I did some searching and came up with the following solution:
Dismount-Database –identity "DatabaseName" -verbose
Move-DatabasePath –identity "DatabaseName" –logFolderPath
ROBOCOPY
Mount-Database –identity "DatabaseName" –verbose
Dismount-Database –identity "DatabaseName" -verbose
Although the article is to fix another bug in Exchange 2010, it worked perfectly in Exchange 2013 CU6 for this purpose.
Source: http://blogs.technet.com/b/timmcmic/archive/2010/10/04/exchange-2010-move-databasepath-results-in-an-invalidoperationexception-when-mount-points-are-utilized-for-storage.aspx
Wednesday, October 01, 2014
Fido what?
Nope, this has nothing to do with Fido Dido.
I've been working on this Exchange 2013 Hybrid deployment when I came across this when accessing OWA from IE11/Win8.1.
After I sign on (Exchange 2013 FBA), OWA briefly loads and then crashes with the following error message:
X-OWA-Error: ClientError;exMsg='fidoCallback' is undefined;file=https://owa.company.com/owa/:1 X-OWA-Version: 15.0.995.29 X-FEServer: EXCH-SVR X-BEServer: null
Scouring the Internet, I could not find any reference to "fidoCallback" relating to OWA, but there were some other suggestions relating to Office 365 OWA crashing in similar fashion (but no reference to fidoCallback):
- Clearing the cache (d'oh - first thing that anyone would try)
- Reset IE's security setting to default (under Advanced tab, not Security tab)
- Try InPrivate browsing
- Make sure "Enable XMLHTTP Support" is enabled
Thursday, September 04, 2014
HOST Files Shortcut!
Basically, create a Windows shortcut to:
notepad c:\windows\system32\drivers\etc\hosts
And then change the Properties > Shortcut tab > Advanced > Run as Administrator:

Voila!
It's just one of those stupid things that I should have done long ago.
Source: http://www.howtogeek.com/howto/6540/stupid-geek-tricks-create-a-shortcut-to-quickly-edit-your-hosts-file/
Wednesday, August 27, 2014
Another Printer Tip! Extend Brother starter toner life
Reset the low toner message for HL Series printers
2. Turn off printer
3. While holding down the GO button, turn printer back on
4. When all four LEDs light up release GO button. All LEDs will turn off
5. Press the GO button 2 times. The 3 LEDs (toner, drum, paper) will light up solid
6. Press the GO button 5 times
7. Paper light will be blinking
8. At this point the toner end-of-life condition has been reset. Close front door.
*Also, just a reminder, timing is important here so don’t pause between button presses*
Monday, August 11, 2014
Lenovo Thinkpad T440p
I have pretty much narrowed down the brand to:
Lenovo - thanks to it's Thinkpad reputation
Asus - heard a lot of good things and price point advantage over others. But decided against it after speaking to Funj - failure rate is quite high.
Toshiba - next to IBM Thinkpads, Toshiba is well known for it's reliability and high engineering as well
Sony - they do make great laptops, but too bad Sony decided to drop the Vaio line and stop making/developing the Vaio product line.
So, it's down to Lenovo vs Toshiba. Went around the usual suspects (TGG, JB, DSE) and play around with a few. Everyone has high regards of the Lenogo Yoga Pro 2, and it looks great on paper. Super high res screen, thin, 8GB RAM/256GB SSD, nice keyboard. Seems to tick all the boxes....until I tried typing on it. All is well until I try to hit the backspace. What a disappointment. Why did Lenovo had to shrink the backspace key down to a non standard size. I keep missing it and hitting the "\" key instead. Eliminated!
Next up, the Toshiba Kirabook - it's very MacBook Air like, and even has a super high res display. All boxes are ticked as well. But I thought about it again and I am going to get a workhorse and will need to survive the abuse of a consultant, so I decided against getting a Ultrabook.
Back to square one - Lenovo Thinkpads. I have always wanted an IBM Thinkpad back in the days, so this seems like a good compromise.
Now here comes the headache - for around $2000 dollars, there are several Thinkpads to choose from. namely:
- T440 - eliminated because the highest resolution was 900 lines - lame.
- T440s - eliminated because although it's lighter than T440p, it's so much more expensive (almost $2.4K speced up)
- X1 Carbon - eliminated because the screen was too high of a resolution and apparently the keyboard is not as good as the T440 series
- T440p - finally decided on this. 1080p screen, backlit keyboard, 16GB/256GB SSD, ultrabay for 2nd hard drive, Ultra dock.
- T440p = p for powah! Better CPU choices, more upgradability
- T440s = s for slim, but costly and uses slower CPUs (mobile series)
- T440 = entry version, almost identical to T440p but not as sturdy (no carbon fiber base), and standard 900 lines display.
Das Keyboard 4 Professional MX Brown
Not too bad huh?
The keyboard is built like a tank, which is how I like all my things to be - unbreakable (Although Sean would disagree with my Volkswagen choice)....
Wednesday, February 19, 2014
Windows 8 / 8.1 Memory Problems
So slightly related to the last post, after fixing the Immersive Shell DCOM issue, my computer BSODed once more, but this time with slightly different error code "MEMORY_MANAGEMENT", which prompted me to think this might be a hardware issue.
Finally came across this - http://windows.microsoft.com/en-au/windows7/diagnosing-memory-problems-on-your-computer and true enough, one of my 2 x 8GB Corsair Vengeance C9 1600 DIMM units is faulty. Got it replaced with PLE and fingers cross hopefully no more BSODs!
Wednesday, February 12, 2014
The following article saved my bacon. There are various of other articles, but the this is the correct one, as it points you to change the permission on the following registry key.
HKEY_CLASSES_ROOT\AppID
Some other article points you to HKEY_CLASSES_ROOT\ClsID but that doesn't work.
Here is the article:
http://www.eightforums.com/performance-maintenance/11951-numerous-event-id-10016-errors-win-8-pro-64-bit.html
Tuesday, November 09, 2010
W2–Still Home Alone + Chairs.
Week 2 and still home alone. Manage to clean out the study room so one more room to go (kids’ room).
Managed to sort out all the great kitchen stuff that Chris left me. Washed them and organized them into proper storage location.
Sat: went out with the guys to Cash and Carry – man it’s massive! It’s located inside the industry area in Canning Vale, just across the road from Halliburton’s office in Perth. It’s basically a massive warehouse of household stuffs. If you buy them in bulk then some items can be really cheap.
Note: You need to own a small business or be RAC member to get in.
Sun: cooked breakfast and lunch. Found out that I don’t have a knife yet to used scissors to cut up the bacon bits hehe. Had to stand to eat on the counter – I have zero chairs.
Went out to see Raymond who is so nice to give me his old TV cabinet. It ended a lot bigger than I got but lucky the Euro’s door can swing wide open. Thanks Raymond!
Here are some of the appliances I bought from Retravision, and got a great money saving tip from Raymond. Bargain and shop around. Always do price match. I got the fridge down from 988>900>789.
Look at the awesome white LEDs!
Got this washing machine got a good deal too! 8KG for 700.
Decided to “Asian out” (as in chicken out) and bought Samsungs instead of local brands No Japanese branded appliance anywhere to be found.
Oh and I had to get a Dyson:
It’s a Dyson DC23. These Dyson are crazy man – they suck suck and suck (in a good way) all the dirt off the carpet. The tank was nearly full from just a room! If you got carpets, go get one. AUD800.
Getting into rhythm now, Sat = shopping, Sun = laundry + clean house.
Monday, November 01, 2010
Engrish: Samsung Edition
So when me and Sean was trying to install the Samsung washing machine, this piece of instruction came up:
Look closely on the lower left hand corner. Sean was actually confused as he only recognize the Malay word “tikus” but he can’t remember what “papan” was. So he asked me “how come they mixed Thai and Malay in the same sentence?”
Talk about globalization and the level on English worldwide.
Week 1–Home Alone
That’s Wye home shopping with me.
So I moved into the new place last Saturday. AF and Fiona was nice enough to help me shift in and had a short tour of the (empty) house.
Sleeping alone is creepy. Sleeping alone in a new country is even more creepier. I kept psyching myself that there is no ghost in the house. Or as AF puts it, “Australia where got ghost one.”
You can argue that I have sleep in hotels before, but there are actual human beings next door, or at least a lift down. But this is suburbia at it’s finest – i.e. quiet. And the house being a single storey bungalow does not help either.
Interesting fact about property terms:
- House = bungalow
- Villa = quad / 6 semi-detached houses
- Apartments = condo/mid cost apartment
- Units = low cost flat
Only have 3 things in the house now:
- 1 x Ikea single bed
- Samsung 8KG Top Loader Washing Machine
- Samsung 511L Fridge
As hermit as it gets.
Skype + IRC?
Hey guys did you know that you can issue IRC like commands in Skype? OK if you don’t know what’s IRC then you are probably born > 1990.
How awesome is that. Anyone wanna feel how it feels to be kick or kick/banned? hehe.
Extracted From https://support.skype.com/faq/FA10042/What-are-chat-commands-and-roles
/add [Skype Name]
Adds a contact to the chat.
/alertsoff
Disable message alert notifications.
/alertson [text]
Allows you to specify exactly what needs to appear in a chat for the chat to pop up. For example, your name.
/call [Skype Name]
Starts a Skype call.
/clear
Removes the chat history entirely. Cannot be undone.
/clearpassword
Remove the password security.
/find [text]
Finds specific text in a chat.
/get allowlist
Details people with access to the chat.
/get banlist
Details people banned from the chat.
/get creator
Details the person who created the chat.
/get guidelines
See the current chat's guidelines.
/get options
Details active options for current chat.
/get password_hint
Get the password hint.
/get role
Details your role in the chat.
/goadmin
Puts a Creator tag next to the chat creator's name.
/history
Loads the complete chat history into the active chat window.
/htmlhistory
An HTML file of the chat history opens up in a browser window.
/info
Details number of people in chat and maximum number available.
/kick [Skype Name]
Eject chat member.
/kickban [Skype Name]
Ejects chat member and prevents them from rejoining chat.
/leave
Leave current chat – unavailable if you are a chat’s creator.
/me [text]
Your name will appear followed by any text you write.
/set allowlist [[+|-]mask] ..
Members allowed in the chat.
/set banlist [[+|-]mask] ..
Members banned from the chat.
/set guidelines [text]
Set a chat’s guidelines.
/set options [[+|-]flag]
Sets options for this chat, see below for more info.
/set password [text]
Create a password (no spaces allowed).
/set password_hint [text]
Create the chat's password hint text.
/setpassword [password] [password hint]
Create a password and password hint for the chat.
/setrole [Skype Name] MASTER | HELPER | USER | LISTENER
Allows you to set a role to each chat member. A description of roles is given below.
/topic [text]
Changes the chat topic.
/whois [Skype Name]
Provides details about a chat member such as current role.








