Morning Routine Habits of Highly Successful People

I recently had a short conversation with one of my friends on a very important subject. The subject of “How to start your day to have a productive one?”

Personally how you start your day is extremely important, in my perspective this sets the tone for the rest of the day and can determine how efficient you can be and possibly how successful you are. In my humble opinion if you wish to be high achiever start thinking about adopting specific morning habits.

While it might not work for everybody, its important that you set your own habits. So here are some of the habits high achievers and successful people have in common:

• The Early rise: Iam a fan of waking up early. Having an early start and ahead of your day and before distractions set in can lead to higher productivity and time for personal growth activities.

• Planning a night before: One of my favorite routines is to plan my tomorrow the night before. Sitting down and mapping out a list of things you need to get done the next day is highly important (you might miss some of course 🙂 we all do) This way, when you wake up you know whats on the menu to do and can help you hit the ground running. Not only does this saves you time, but it also reduces stress because you don’t have to worry about forgetting anything important. You can plan your work schedule, when you will exercise, when you eat, when to call a customer, anything written down in your plan is an opportunity to achieving and finishing a task. That means scratching that of your list will give you more motivation to continue with minimal stress.

PS: Effectively and wisely use your calendar.

• Positivity: Wake up with a positive mindset. Not Easy I know but on a serious note try to think of the day as if it is the most important day of your life, your most proud day and it will be like that (with different flavors ofcourse). Be kind to yourself.

• Visualization: when you visualize your goals and success you help yourself stay focused on what’s important and gets you motivated throughout the day. simply while having your morning coffee and reading through your planned agenda of the day, imagine yourself actually doing the task, run a scenario in your head about the task, how would it start and how you are going to execute till finish line. This way your plan now has a script, you just need to press the play button when that calendar reminder item pops up on your laptop or mobile.

• Lastly in my humble opinion I believe having an extra curricular activity can really help you unplug and plug again to your daily motion. That can be meditation which is an awesome habit for some maybe not me. Exercising and playing sports works magically to many of the successful and highly effective achievers. Exercise is also a great way to start your day because it gets your blood flowing and gets you out of any potential morning grogginess. The key point here is to find a form of exercise you like.

My “How to Lead Effective Virtual Meetings” tips

BEFORE the Meeting:
Step 1: Decide on a Need and Objective
Step 2: Determine the Attendees and Draft an Agenda
Step 3: Define the Logistics and Schedule the Meeting

DURING Your Meeting:
Step 1: Welcome and Logistics Check
Step 2: Go through the Agenda
Step 3: Capture Effective Meeting Minutes
Step 4: Close with a Review

AFTER Your Meeting:
Step 1: Distribute Meeting Minutes
Step 2: Follow up on Actions

So to put this into perspective for everyone, here are my tips for every phase.

BEFORE the Meeting:
Tip #1 is to decide on the needs. This sounds straightforward but the first question you should ask yourself before setting up a meeting is do we really need to have this meeting? and think very very hard about that question and about whether you can write an email, set up a quick call or use some other channel instead of setting up a full official meeting.

Tip #2 is to define the objective, so every single meeting should have an objective associated with it. And the objective should be determined before you set up the meeting and not during.

Tip #3 is to assign a leader and every single meeting should have a designated leader who moderates the meeting and that leader is responsible facilitating the communication between all attendees.

Tip #4 is to manage your virtual logistics to ensure that everyone has access to the virtual collaboration tool that you’re going to use. In addition choose a time zone friendly time/date.

Tip #5 is to send the invites agenda and the reminders so send out the agenda ahead of time and include it in the calendar. It is always a best practice to include the agenda with the invite so that individuals have time to prepare.

DURING the Meeting:
Tip #1 Join Early: It’s always a good practice to join your virtual meeting a few minutes early allowing you to check that the tools are working correctly and gives you some time to make some adjustments if needed.

Tip #2 Go through a welcome note to catch everybody’s attention and welcome the joiners by their names if you can. You may wait for few moments for late comers which can be very important key people and keep the wait time as short as possible.

Tip #3 If you are to record the call ALWAYS ask for the attendees permission. This is a very sensitive point and its the right of the attendees to approve the recording.

Tip #3 Start with the objective, state the outcome. This makes sure that everyone’s on the same page as you kick start the meeting – then walk through the agenda and what you expect them to talk about or discuss

Tip #4 Remain on topic and and respect everyone’s time.

Tip #5 if anyone joins really late avoid repeating any information and carry on with your meeting.

Tip #6 Always type up a notes of any decisions or ideas that have been discussed in the meeting so that your team can have a quick reference to go back to.

Tip #7 Have a short review at the end

AFTER the Meeting:
Tip #1 Send the meeting minutes, distribute the meeting minutes to everyone who attended the meeting as well as anyone who missed it and any others who need to be informed such as other stakeholders.

Tip #2 Ask for updates. Follow up with your team on all the next steps including action items risks and issues that you listed and the meeting minutes and you sent after your meeting.

Tip #3 Document the latest status and track the status of all your action items drifts and issues that are assigned to your team.

How to know who restarted Windows Server 2012 R2

Good Day.

Today I am sharing with you the way to know who restarted your server 2012 R2. In big organizations there might be hundreds of servers that are up and running however restart jobs might be needed and maintenance windows should be scheduled. suppose that you receive a comment from an application owner saying that his server has been restarted and he needs to know who did the restart job or it was by accident.

There is something called as Shutdown event tracker. This will allow the admins to track why a user initiated shutdown or a restart. It also gathers the reason why the users restarted or shutdown the computer. More info about it is documented here.

To find out who restarted windows server, log in to the server. The below steps work on Windows Server Server 2012 R2. Launch the Event Viewer (type eventvwr in run). In the event viewer console expand Windows Logs. Click on System and in the right pane click Filter Current Log.

In the Filter Current log box, type 1074 as the event ID. This will filter the events and you will see events only with ID 1074.

We can now see the event with ID 1074.

Double click the recent event. In the event properties box, you can see who initiated the restart of server.

The process C:\Windows\Explorer.EXE (SRV00) has initiated the restart of computer SRV00 on behalf of user POP\hisham.mezher for the following reason: Hardware: Installation (Unplanned)
Reason Code: 0x4010002
Shutdown Type: restart
Comment:

Click Close.

Regards.

Hisham Mezher

How to Create Active Directory snapshots?

Good Day.

Today i have a new post for you that will help all AD administrators with issues similar to the one I faced recently which is comparing AD information between 2 time frames as some information was needed by the audit team.

The scenario is to take a scheduled active directory snapshots and restore AD database in offline mode so that you may compare the data you have.

Basically this tool creates a shadow copy of volumes that holds active directory data (Database and logs) using “Volume Shadow Copy Service (VSS)” running on server.

In order to create, view or restore AD snapshots, you need to be member of domain admin group or the enterprise administrator group.

Let’s go through the procedure for how we can create active directory snapshots.

1. Log in the domain controller as a domain administrator or enterprise administrator with appropriate permissions.
2. Right click on start button and select “Command Prompt (Admin)”. It will open up the command line interface.
3. In command prompt type ntdsutil and enter to open up the ntdsutil tool.
4. In next type activate instance ntds and press enter.
5. Then type snapshot and press enter.
6. Then type list all
7. It will list down all the snapshot created.
8. Then run command mount 2 ( this is the order number showing in list of snapshot and I needed to mount the one listed in number 2)
9. Then as it saying it successfully mounted to the C: drive with folder Snapshot {b616bdfc-6e38-482b-b150-0247155e64e7} mounted as C:\$SNAP_201807181211_VOLUMEC$\
10. Then enter quit command twice to exit from utility.
11. Now to connect with the mounted snapshot we need to execute followingdsamain –dbpath C:\$SNAP_201807181211_VOLUMEC$\Windows\WinSxS\amd64_microsoft-windows-d..rvices-domain-files_31bf3856ad364e35_6.3.9600.18476_none_8bd6131b174d5ba6\ntds.dit–ldapport 10000

    

12. “Go to server manager > tools > active directory users and computers”
13. In mmc right click on active directory users and computers option and select change domain controller option
14. In here type the domain controller name and the port. Then click ok the port should be 10000 ( the one we use with snapshot)
15. As we can see here it successfully connect with the instance.
16. now you have an offline copy of the AD database and you can look into the information you need.

Disconnect and unmount snapshot

In order to disconnect from the running instance, open the command line we left open and press CTRL+C

1. type ntdsutil to go in to ntdsutil utility
2. In next type activate instance ntds and press enter.
3. type snapshot and press enter.
4. type list all
5. This will list down all the snapshot created.
6. type unmount 2 (this is the snapshot number I mapped). This will unmount the snapshot.
7. enter quit command twice to exit.

Best Regards.

Hisham Mezher

How to reduce the size of the pagefile.sys (Virtual Memory) on Windows Server

Good Morning Folks.

Today iam sharing with you this short procedure on how to reduce to reduce the size of the pagefile.sys (Virtual Memory) on Windows 8 or Windows Server 2012.

This morning I faced an issue with very low disk space on one of my production servers and couldnt access the server to restart exchange services, i couldnt even reach the log files to delete some old files. i could only login to the system and manage to reduce the size of the huge pagefile.sys to get access to the server.

Here is how to do this.

1. On the Keyboard Press the WindowsKey + X then click System in the popup menu or right click my computer and go to advanced properties.
2. click Advanced system settings. Administrator permission required You might be asked for an admin password or to confirm your choice.
3. On the Advanced tab, under Performance, tap or click Settings.
4. click the Advanced tab, and then, under Virtual memory, tap or click Change.
5. Clear the Automatically manage paging file size for all drives check box (if you have it set by default to automatically manage)
6. Under Drive [Volume Label], click the drive that contains the paging file you want to change.
7. click Custom size, enter a new size in megabytes in the Initial size (MB) or Maximum size (MB) box, tap or click Set, and then tap or click OK.

Note

Increases in size usually don’t require a restart for the changes to take effect, but if you decrease the size, you’ll need to restart your PC.

Regards.

Hisham Mezher

Protect DNS zones against accidental deletions

Good Day.

Today I am sharing with you the procedure to protect you DNS zones from accidental deletions. Its always a best practice to protect DNS zones from being deleted accidentally, this is a high risk issue for AD admins.

Note: After these steps, you will not be able to delete or change the scope of replication for the DNS Zone unless you first unprotect the zone from accidental deletion.

There are couple of ways to prevent DNS zones accidental deletions.

• DNS Zones stored in the Domain Partition:

Open Active directory users and computers with advanced view.

Go to Active Directory Users and Computers \ Domain Name \ System \ Microsoft DNS \ DNS Zone name, Right click and select properties, Select the Object Tab.

Note: The above flag will only be visible in Active Directory Users and Computers if you have stored the DNS Zone in the Domain Partition. You can check where your DNS Zone is stored in DNS Management UI. As an example, the below screenshot shows the replication scope set as “All domain controllers in this domain (for Windows 2000 compatibility)”

However powershell is an amazing tool to administer DNS especially when having complex environments with hundreds of DNS zones:

 

• Enumerate all DNS Zones not protected from deletion in the Domain partition: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “CN=MicrosoftDNS,CN=System,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Select name,protectedfromaccidentaldeletion | out-gridview
• Set the protect from accidental deletion flag: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “CN=MicrosoftDNS,CN=System,DC=domain,DC=lab ” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Set-ADObject –ProtectedFromAccidentalDeletion $true

Now we can use the above for both domain and forest wide partitions.

• DNS Zones stored in Domain wide application partitions:
  • Enumerate all DNS Zones not protected from deletion in the domain application partition: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “DC=DomainDnsZones,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Select name,protectedfromaccidentaldeletion | out-gridview
  • Set the protect from accidental deletion flag: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “DC=DomainDnsZones,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Set-ADObject –ProtectedFromAccidentalDeletion $true

 

• DNS Zones stored in Forest wide application partitions:
  • Enumerate all DNS Zones not protected from deletion in the Forest Wide application partition: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “DC=ForestDnsZones,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Select name,protectedfromaccidentaldeletion | out-gridview
  • Set the protect from accidental deletion flag: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “DC=ForestDnsZones,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Set-ADObject –ProtectedFromAccidentalDeletion $true

 

• Check the protect from accidental deletion flag:
  • Forest wide application partition: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “DC=ForestDnsZones,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $True} | Select name,protectedfromaccidentaldeletion | out-gridview
  • Domain wide application partition: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “DC=DomainDnsZones,DC=domain,DC=lab” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $True} | Select name,protectedfromaccidentaldeletion | out-gridview
  • Domain Partition: Get-ADObject -Filter ‘ObjectClass -like “dnszone”‘ -SearchScope Subtree -SearchBase “CN=MicrosoftDNS,CN=System,DC=domain,DC=lab ” -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $True} | Select name,protectedfromaccidentaldeletion | out-gridview

 

All the above is needed when following Microsoft active directory risk assessment procedures.

Best Regards.

Hisham Mezher

 

Windows Best Practices Analyzer for Active Directory

Good Day

Today I am sharing with you the procedure to run best practice analyzer BPA for Activedirectory directory services (BPA for AADS). Starting with Windows 2008 R2, Microsoft introduced BPA for Active Directory that is included as part of the operating system. The tool analyzes many of the most common issues that we typically run into while administering active directory environments.

To access BPA, go to server manager, click on ADDS node, scroll down the panel.

Windows Best Practices Analyzer for Active Directory

To run a BPA scan click Task -> Start BPA Scan on the right. You can select one or more domain controller then start scan.

You can monitor the progress from the below notification window.

Once the scan completes, you’ll see the results. Each result gives you the server having the issue, a severity level, the name of the issue and an overall category.

When you select an issue, a description of the issue is shown below with a link to more information and remediation steps from Microsoft.

How to run BPA with PowerShell:

First get the available BPA models. Use the cmdlet Get-BpaModel

Get-BpaModel

Now you can run the BPA on one of the model ID. Use the Invoke-BPAModel cmdlet. For instance to run BPA on Directory services execute the cmdlet

Invoke-BPAModel “Microsoft/Windows/DirectoryServices”

To run BPA on all roles execute the cmdlet

Get-BPAModel | Invoke-BPAModel

How to run BPA remotely:

Connect to remote server using

Enter-PSSession Computername –Credential Username

Then run the Invoke-BPAModel

Retrieve results from BPA:

Use the cmdlet Get-BPAResult

Get-BpaResult “Microsoft/Windows/DirectoryServices”

You can also filter the results

Get-BpaResult “Microsoft/Windows/DirectoryServices” | where severity –eq Warning

thats all folks.

Hope this helps you.

Regards.

Hisham Mezher

Outlook client error – Your automatic reply settings cannot be displayed because the server is currently unavailable. Try again later.

Good Day Folks.

Today I am sharing with you a new problem we are facing with some of our outlook clients. some users are reporting the below message when trying to set Out of Office and look for mail tips.

Your automatic reply settings cannot be displayed because the server is currently unavailable. Try again later.

If I log into OWA Outlook Web Access, (Options > Set Automatic Replies) I could set it up and it worked fine.

The approach you can take is to check the first 2 requirements for EWS.

1. You are logged in, or authenticated against your domain.

2. If you are accessing web pages via a proxy server, the name of the Exchange server should be added to the Proxy Exceptions list.

Assuming you have met the two requirements above, the nest step is to test the connectivity to the right URL.

1. Open Outlook > In the task bar (in the system tray) > Hold down CTRL and Right Click the Outlook Icon > Select Test E-mail AutoConfiguration.

2. Enter your details > Use AutoDiscover > Test.

Note: Here I got the following error message;

Autoconfiguration was unable to determine your settings

This was because the client I was on, could not resolve autodiscover.my-domain-name.com.lb once that was rectified I could get further.

3. In the first section Locate the URL that is being used for OOF, and make a note of it.

4. Open your web browser and make sure you can open that URL. (Note: It will redirect to Services.wsdl that is normal).

Note: If you are asked for logon credentials, you are NOT authenticated against the domain.

5. At this point mine started working. My problem was the lack of DNS resolution, if you find another fix drop me a line and Ill update this article (link at the bottom of the page).

and the problem is resolved.

Regards,

Hisham Mezher

CI fails after Installing Exchange2013 – KB4036108-x64-en

Good Day;

Last month Microsoft released the latest set of Cumulative Updates for Exchange Server 2016 and Exchange Server 2013 and they are now available on the download center. These releases include fixes to customer reported issues, all previously reported security/quality issues and updated functionality.

I usually wait for at least a month to install the security patch and i follow standard procedures to test the patch on my test environment and then i wait for one week to see if any issues were reported before deploying on production.

yesterday i tried to execute the patch Exchange2013-KB4036108-x64-en on my CU17 exchange environment and immediately after the reboot i found out that all my databases had their CI in failed state.

This was very weird as from the information supplied from Microsoft only says the below:

About this update: A security issue has been identified that could allow an attacker to run programs and access data on a computer running Microsoft® Exchange Server 2013 CU16. You can help protect your computer by installing this update from Microsoft.

checking the services mmc it appeared that the “Microsoft Exchange Search Host controller”: service is in disabled mode.

The solution was to enable the service back and starting it. this resolved the CI issue immediately. However on my production environment this was not the case and I had to go through fixiing the CI manually.

This is how i did it.

First Run the below command to check CI status:

Get-MailboxDatabaseCopyStatus * | ft -auto

In order to rebuild the failed content index you need to stop the search services on the mailbox servers. Note that this may impact searches for other healthy databases, and the rebuilding process can also create a significant load on the server, so you may wish to do these steps outside of normal business hours.

Stop the below services:

• Microsoft Exchange Search Host Controller
• Microsoft Exchange Search

Navigate to the location of the content index for each database.

or you can run the below command:

Delete the folder. Repeat the same steps to delete the folder for all other failed content indexes. Then start the search services again.

The content indexes will be rebuilt, which can take quite a while to complete depending on the amount of data in the databases.

Eventually you should find that your content indexes are healthy again.

Regards;

Hisham Mezher

 

 

Migration from Exchange 2010 to Exchange 2016

Good Day Exchange engineers.

Today  I am sharing with you the procedure on how to migrate your old exchange 2010 environment to exchange 2016.

Executing Summary

Microsoft Exchange Server 2016 brings a new set of technologies, features, and services to Exchange Server. Its goal is to support organizations as their work habits evolve from a communication focus to a collaboration focus. At the same time, Exchange 2016 helps lower the total cost of ownership when we deploy Exchange 2016 on-premises.

This document will cover all project steps we took to migrate Group Med Services messaging system from Exchange 2010 to Exchange 2016.

Exchange 2016 key benefits in compare to exchange 2010 more info here

• Smarter inbox

Exchange 2016 helps you get more done through faster search and an inbox that is more personalized, more helpful, and more intelligent.

• Simplified architecture

A simplified architecture, originally forged in the cloud, combines the mailbox and client access roles, so it’s easier to plan and scale your deployments. Streamlined coexistence with Exchange 2013 means easier upgrading.

• Security and compliance

Data loss prevention (DLP) in Exchange Server 2016 includes more in-the-box sensitive information types. And enhanced auditing enables better reporting and easier integration with third-party tools.

• Better collaboration

With its new approach to attachments that eliminates versioning headaches, plus other enhancements, Exchange Server 2016 makes working together on documents easier.

• Mobile productivity

Exchange Server 2016 powers the latest Outlook experiences on phones, tablets, desktops, and the web so you can get more done, wherever you are.

Overview

Before starting it’s important to state that a key architectural change has been made in Exchange 2016. Exchange 2010 had 3 separate roles; Client Access, Hub Transport, Mailbox and Unified Messaging.

In Exchange 2016 only a single role is used, the Mailbox role. This contains all necessary components required for a full and complete email system.

There are some best practices and recommendation before implementing /deployment/migration, so in this document we are going migrate Exchange 2010 to Exchange 2016 while having coexistence.

Below are the main phases to follow:

• Assessment of existing Exchange 2010 environment and documentation phase
• Plan & Design Phase
• Define the Preferred Architecture phase
• Verify the Exchange Dependent Components Compatibility
• POC Phase
• Build & Integration Phase
• Pilot Migration
• Production deployment.
• Stabilization and Documentation
• Decommission
• Transition and Operations

Planning

As mentioned earlier there are some major changes on the Architectural of Exchange 2016, in Exchange 2010 we have 3 separate servers’ roles: Mailbox, Client Access, and HUB Transport & Unified Messaging. In Exchange 2016 Microsoft introduced only one server role, which contains all components.

As per Microsoft before migrating we have to follow up some best practices such as:

• Exchange Server Sizing

As exchange 2016 with only one role from the box, hardware sizing is the most critical part of deployment. We can use the Exchange 2016 server requirement calculator https://gallery.technet.microsoft.com/office/Exchange-2013-Server-Role-f8a61780 , which will give us a full hardware requirement view for our existing environment.

• Updating Existing Environment

Before introducing the Exchange 2016 into Existing environment we have to make sure that the update Exchange 2010 Service Pack 3 with Update Roll up 11 at least is installed or we have to install it prior deploying Exchange 2016. However we found that the environment is already at roll-up 18

• Directory Service Requirements

In Exchange 2016 Microsoft recommended first time minimum support Forest Functional Level and Domain Functional Level is now Windows 2008 or above. In our environment these levels are windows server 2008 R2.

• Updating Outlook Clients

Exchange 2016 support outlook 2010 and above on Windows.

All version of Outlook 2016 and Outlook 2013 are supported, Outlook 2010 is supported with the latest updates (KB2965295). In our environment we have updated versions of outlook 2010 and couple of users with outlook 2013.

• Naming Services

Before implementation we have to document the names used by the clients to access the Exchange. In Coexistence with Exchange 2010, 2013 and Exchange 2016 allows sharing of the same HTTPS names for autodiscover, OWA, ActiveSync and other services, which will make the transition very easy. In our environment we found that the no publishing is done for OWA or ActiveSync and that only internal clients will connect through OWA or outlook clients. However we will prepare the environment to be able for later publishing options.

• Hardware Sizing for Exchange 2016

As per Recommended by Microsoft we have to prepare Hardware configuration for Exchange 2016, and make sure you have to run the sizing calculator.

I will recommend to go for Physical hardware if not or some business decision you are choosing

Virtualization then you have to follow up the guidance for Exchange 2016 in Virtualization under this link https://technet.microsoft.com/en-us/library/jj619301(v=exchg.160).aspx

• Assessment Existing Exchange 2010 environment

This is the very important part of any of the project phase we have to do the existing/legacy environment assessment, which will give us exact details of the old environment and very beneficial for the planning and designing phase of the project. Also it will give us chance to clean up the non-required data from existing 2010 environment.

I shall follow the below list of some easy tools and scripts to do the exchange 2010 assessment.

• Exchange 2010 Architecture Report

We can use following PowerShell script which will give us Architecture details.

Exchange 2010 Architecture Report https://gallery.technet.microsoft.com/office/Exchange-2010-Architecture-9368ff56

• Generate Exchange Environment Reports

Generating Exchange environment report is one of the best steps to upgrading/migrating your existing Exchange environment. There are multiple ways to generate your Exchange environment report but i will suggest user Steve Goodman’s PowerShell which will give you a good overview of your environment. This script generates a HTML report and can be scheduled and emailed. The script can be found under the link https://gallery.technet.microsoft.com/office/Generate-Exchange-2388e7c9

• Exchange Best Practices Analyzer

The Exchange Best Practices Analyzer programmatically collects settings and values from data

Repositories such as Active Directory, registry, metabase and performance monitor. Once collected, a set of comprehensive ‘best practice’ rules are applied to the topology. The Microsoft Exchange Best Practices Analyzer is designed for administrators who want to determine the overall health of their Exchange servers and topology. The tool scans Exchange servers and identifies items that do not conform to Microsoft best practices. You can download from here: Exchange Best Practices Analyzer https://www.microsoft.com/en-us/download/details.aspx?id=22485

Preparing the server for Exchange 2016

Assuming you are installing your exchange 2016 server on a physical server with windows server 2016 Os (make sure you install all required and latest windows updates)

• Software requirements

Exchange 2016 latest version

Microsoft .NET Framework 4.5.2 (Offline Installer)

Unified Communications Managed API 4.0 Runtime

• Prerequisites

Open Windows PowerShell and run the following command to install the Remote Tools Administration Pack.

Install-WindowsFeature RSAT-ADDS

Now we need to install prerequisite for installing the Exchange Server 2016, on our windows server 2016 Launch the Windows PowerShell (run as administrator). Run the following command to install the required Windows components. You must restart after the server to complete the installation process.

Install-WindowsFeature NET-Framework-45-Features, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation

• Extend the Active Directory schema

Before you install Microsoft Exchange Server 2016, you need to extend the active directory schema and prepare your Active Directory forest and its domains. Mount the Exchange Server 2016 installation Media. Launch Command Prompt (run as administrator) and navigate to path where setup files are present. Once you successfully enter the below command, the prerequisite analysis and extending AD schema steps should shows the status as Completed.

You can run the PowerShell command Get-ADInfo.ps1 or Get-ADForest for getting the Active Directory information of the current forest. Since, we already have the Exchange Server 2010 environment and we need to check the current Exchange schema version before applying the any update. For that you can use the one liner, which is created by Exchange Server MVP Michael B Smith.

Navigate to the exchange 2010 installation files folder and execute the below:

Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms

• Prepare Active Directory

Next step is to prepare the Active Directory. The Account used to run the schema update and AD preparation must be a member of Enterprise Admins and Schema Admins. In the same command prompt that you launched, run the below command by replacing organization name with a name.

Setup.exe /PrepareAD /OrganizationName:”<organization name>” /IAcceptExchangeServerLicenseTerms

You have now prepared your server to install Exchange Server 2016.

After applying the schema update we can check the version number again

Installing Exchange Server 2016

Once we have completed the Exchange Server 2016 pre-requisites on server now we can start the installation of Exchange Server 2016 mailbox role with below command:

After setup has completed restart the server before doing any configuration on Exchange Server

2016. Once installation complete open Exchange Administrative Center.

When launching EAC via local host we are getting the certificate error because we have not installed the SSL certificate, just click on “continue to this website to access” the EAC

After successfully login we can see the all legacy mailboxes under the recipients.

• Updating Autodiscover (SCP)

After installing Exchange 2016 successfully, update the Service Connection Point for AutoDiscover. To do this, use the Set-ClientAccess command from Exchange Management Shell.

Go to the Exchange Management Shell, and type this command:

Set-ClientAccessService -Identity E2016 -AutoDiscoverServiceInternalURI https://autodiscover.yourURL.com/Autodiscover/Autodiscover.xml

Next, update the settings of Outlook Anywhere. To do this, go to EAC, and click on servers on the left hand side. This will open up the list of servers. Click the Edit icon and a pop-up will open. Choose the Outlook Anywhere option, and update the DNS lookup and IMAP4 settings with the name of the new server.

Once you’ve configured the settings, run IIS RESET. To do this, go to your command prompt and run the command iisreset. This will stop and restart IIS services.

The next step is to configure your Receive Connector to relay email applications. To configure this, go to the mail flow option in your EAC, click on a connector, and edit it.

Next step is to create a new database to host the user’s mailboxes. The new database is to be on a separate data drive following the hardware recommendations for RAID configurations.

In our case the drive E will host all databases.

Create a new database as below:

Under EAC go to servers > databases and create new database by clicking the + sign:

Type the DB name and choose the server to host the database. Also make sure to change the file path to the proper folder names.

Once that’s done, update the OWA directory. Exchange 2016 supports acting-as-a-proxy for 2010, so both the versions can coexist using the same URLs. Now, change the OWA and autodiscover URL to Exchange 2016, to ensure all URLs go through Exchange 2016. Use the below script to do that.

$Server  = “Exchange2010”

$HTTPS_FQDN = your_URL

Get -OWAVirtualDirectory -Server $Server | Set -OWAVirtualDirectory -ExternalURL $null

Get -ECPVirtualDirectory -Server $Server | Set -ECPVirtualDirectory -ExternalURL $null

Get -OABVirtualDirectory -Server $Server | Set -OABVirtualDirectory -ExternalURL $null

Get -ActiveSyncVirtualDirectory -Server $Server | Set -ActiveSyncVirtualDirectory -ExternalURL $null

Get -WebServicesVirtualDirectory -Server $Server | Set -WebServicesVirtualDirectory -ExternalURL $null

Enable -OutlookAnywhere -Server $Server -ClientAuthenticationMethod Basic -SSLOffloading $False -ExternalHostName $HTTPS_FQDN

Lastly, update the DNS, so it points to autodiscover and OWA. Under DNS Manager, change the record to ensure that it points to the new exchange 2016 URL name you specified in the above script.

• Configure Receive Connector

Next step is to configure the receive connector on Exchange 2016 as per Exchange 2010. Default and client connector are already created. Open the Exchange Admin Center select mail flow tab and select receive connectors.

Click on + sign it will give you a new wizard for new receive connector, give the name of the connector and select “Frontend Transport” from Role and select “Customize” from the type.

Next we will select the Network and default port will be 25 for SMTP

Next we have to choose IP addresses that the receive connector will accept mail.

Once complete you can see the connector in EAC.

Now click on edit for newly created receive connector and select the security tab and select the “Externally secured” from authentication and select Exchange servers and Anonymous users from permission groups.

Testing Exchange 2016 functionality

Before we can move namespaces and mailboxes across to Exchange Server 2016 we need to do test the new server is fully functional.

I created some mailboxes in Exchange 2016 and test the email flow, i sent email from my Exchange 2010 admin account to Exchange 2016 admin it work fine.

Updating the Exchange 2010 Virtual Directory URLs

As you know Exchange 2016 can support as a proxy for Exchange 2010 servers. It means that it is easy to allow Exchange 2010 and Exchange 2016 to co-exist using the same URLs to accessing the services. Now we can move the autodiscover.test.com from Exchange 2010 to Exchange 2016, along with this we have to change the DNS so that Https client traffic will go via Exchange 2016 to Exchange 2010 servers.

Update Internal DNS records and switching External HTTPS Connectivity

We need to update the internal DNS record to direct traffic internally at the Exchange 2016 server, we need to change internal DNS records so that both the autodiscover name and HTTPS namespace are configure with the new IP address (Exchange 2016).

Client will not be immediately redirect to use the Exchange 2016 server as the proxy for client access, as soon as client can access the server retry login and client access to ensure no issues exit. If internal client can access works fine than update the external HTTPS publishing.

Change Mail Flow Routing

As we tested Exchange 2016 can receive mail and delivered to Exchange 2010 users, default Exchange 2016 is already configured to receive email from the Internal using Anonymous permissions on the default receive connector.

Also we have to ensure that inbound mail flow is not interrupted before moving on to migrating.

On exchange ECP go to send connector and adjust the send connector to Internet to allow the new exchange 2016 in the senders list to external websense relay.

Next step is to make changes outbound mail flow and allow to Exchange 2016 take the outbound email flow rather than via Exchange 2010 server. We have to make sure firewall rules allow the Exchange 2016 server IP address to initiate connections to Internet hosts on TCP port 25. Once ensure that the Exchange 2016 server is allowed to relay outbound mail, than we are ready to update the Send Connector.  In my case I have Juniper firewall, I logged in to the firewall interface and created new rule to allow port 25 between the local subnet and especially exchange 2016 IP to the email relay server which in my case is websense. Then I went to websense and added the exchange 2016 IP to authorized mail senders and added the exchange 2016 server to inbound list of servers allowed to receive emails.

Tested with external addresses and internal addresses all email traffic went successful and delivered to both ends.

Creating New Offline Address Book (OAB)

As part of the installation of Exchange 2016, a new offline address book was created and set the default. Now we want to create new OAB so that i will remove old Exchange 2010 OAB.

Open the PowerShell and type below command

New-OfflineAddressBook –Name “OABEX16” –AdressLists “\Default Global Address List”

Assigning an OAB in Exchange 2016

Open Exchange 2016 ECP with Administrator account.

Click on “Servers” and select “Databases” select database you want to assign the OAB

Click on “Edit” and Click on “Client Setting”

Click on Browse

Select the new OAB, which we just created.

Migrating the Pilot Mailbox

We do have number of methods that can be used to migrate mailboxes from Exchange 2010 to

Exchange 2016, such as Exchange Admin Center

Open ECP select recipients and select migration tab, then click on + sign and select move to a different database

Select the mailboxes which you want to migrate.

Give the Batch name and select the target database and select other required options.

Select the recipients which will get the notification after complete the Job and select preferred option to complete the batch.

Once finish it will sync

Second easy option to use the Power Shell to migrate the mailboxes. Open PowerShell and type below command, as i have multiple mailbox so i’m using export csv option.

Import-CSV “C:\Move.CSV” | Foreach (New-MoveRequest _identity $_.Identity –TargetDatabase MDB01)

Now you can monitor the move request with command Get-MoveRequestStatistics

If you want you can check the Exchange 2010 EMC for mailbox hosting database and servers.

Once moved pilot users, now i have Exchange 2010 and Exchange 2016 users, before moving forward i will check the client end functionality. From Exchange 2016 i sent email to Exchange 2010 and getting smooth delivery vice versa its working.

Also i verify the Outlook calendar whether availability is working or not, and found its working as expected vice versa.

This means my end user are not having any issues.

Please bare in mind that it is very important to assign a certificate for IIS, SMTP services and preferable to have the certificate from an authorized CA however for testing purposes you can generate a certificate from your internal CA.

Thats it for today, hope to see you soon in another post.

Regards;

Hisham Mezher