Role Groups and Roles + Exchange 2010

An important concept you need to understand in order to appreciate RBAC is the relationship between role groups, roles, cmdlets (commandlets) and parameters.

The RBAC Triangle of Power

Before we end this article, let’s have a look at a graphical representation that summarizes how RBAC works.

Members of the Exchange team like to depict the workings of the RBAC with what they call the "Triangle of Power".

The Triangle of Power is made up of four main components: the Where, the What, the Who, and the Glue.

The Where or Scope represents the range over which a particular role assignment is supposed to apply, i.e., a single organizational unit, a single user, a group of users, or the entire organization.

The What or Role represents what your role can actually do. Exchange Server 2010 has 65 built-in roles that you can either use straightaway or build from.

The Who or Role Group, as we mentioned way back, is simply a collection of roles (which in turn are made up of cmdlets and parameters). You combine this with the Scope to come up with a complete Role Assignment.

Predefined Role Groups used in Exchange Server 2010 Role Based Access Control:

1. Delegated Setup - For admins who need to deploy Exchange 2010 servers that have been previously provisioned by a member of the Organization Management role group.
2. Discovery Management - For admins who need to perform searches of mailboxes for data that meet specific criteria as well as configure legal holds on mailboxes.
3. Help Desk - For admins who need to view and modify the Microsoft Office Outlook Web App options.
4. Hygiene Management - For administrators who need to configure the virus and antivirus features of Exchange.
5. Organization Management - For admins who need to have administrative access to the entire Exchange 2010 organization.
6. Public Folder Management - For administrators who need to manage public folders and databases on servers running Exchange 2010.
7. Recipient Management - For admins who need to manage Exchange 2010 recipients.
8. Records Management - For administrators who need to configure compliance features such as retention policies, message classifications, and transport rules.
9. Server Management - For admins who need to set server-specific configurations of transport, Unified Messaging (UM), client access, and mailbox features.
10. UM Management - For admins who need to manage UM-related server configurations, properties on mailboxes, prompts, and auto attendant configurations.
11. View-Only Organization Management - For administrators who need to view the properties of any object in Exchange.

http://technet.microsoft.com/en-us/library/dd298183.aspx
http://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/exchange-2010-role-based-access-control-part1.html

TeamViewer

TeamViewer connects to any PC or server around the world within a few seconds. You can remote control your partner's PC as if you were sitting right in front of it.

Download the client for this link:

http://www.teamviewer.com/en/download/index.aspx

You can install this software or just run it, afther that the software provide you an ID with a security password and you are able to take remote control for other computers:



Provide the ID and password to others persons and share your application.

SSL Diagnostics Version 1.1 (x86)

Download the Secure Socket Layer (SSL) troubleshooting tool for Internet Information Services (IIS).

A common problem for administrators of IIS servers is configuring and troubleshooting SSL enabled websites. To assist in administrators efforts, Microsoft has designed a tool - SSL Diagnostics - to aid in quickly identifying configuration problems in the IIS metabase, certificates, or certificate stores.

This tool allows users to review configuration information in a easy to read view mode or to run the tool silently with only the creation of a log file. During use, administrators can simulate the SSL handshake to find errors. They can also quickly "hot swap" certificates for testing purposes.

Overview

A common problem for administrators of IIS servers is configuring and troubleshooting SSL enabled websites. To assist in administrators efforts, Microsoft has designed a tool - SSL Diagnostics - to aid in quickly identifying configuration problems in the IIS metabase, certificates, or certificate stores.

This tool allows users to review configuration information in a easy to read view mode or to run the tool silently with only the creation of a log file. During use, administrators can simulate the SSL handshake to find errors. They can also quickly "hot swap" certificates for testing purposes.

These packages come in two forms: Express and Full. The express will only give the pertinent tools for administrators to use SSL Diagnostics while full install installs the same files with the appropriate documentation. Included in the full install is a SSL Frequently Asked Questions that can assist in the learning of SSL for administrators.

System requirements

Supported Operating Systems: Windows 2000, Windows NT, Windows Server 2003, Windows Server 2003 R2 (32-Bit x86), Windows Server 2003 Service Pack 1, Windows Server 2003 Service Pack 2, Windows XP Professional Edition

This update includes fixes from customer reported issues as well as expand functionality including creation of self-sign certificates. For more information, please visit the IIS Diagnostics home page.

http://www.microsoft.com/download/en/details.aspx?id=674

How to??

with this tool you can check the SSL version that you client are using:

Nonpaged Pool Memory

what distinguishes Paged Pool and NonPaged Pool memory? The first difference is that Paged Pool is exactly what its name implies - it can be paged out. The NonPaged Pool cannot be paged out. Drivers use the NonPaged Pool for many of their requirements because they can be accessed at any Interrupt Request Level (IRQL). The IRQL defines the hardware priority at which a processor operates at any given time (there's a link to a document covering Scheduling, Thread Context and IRQL's in the Additional Resources section at the end of this post).

Getting back to our Pool Resources, it is important to remember that these resources are finite. The table below outlines some sample maximum values for Paged / NonPaged Pool on x86 systems that are not configured with the /3GB switch in the system's boot.ini file. We'll cover /3GB and its effects on memory in a future post. We'll also cover Kernel Changes to Windows Vista separately. It's important to note that x64 systems don't suffer from the same Virtual Address Space limitations!

Windows 2000

System RAM	NonPaged Max	Paged Max	Paged Max (TS)
512 MB	131 MB	264 MB	160 MB *
1024 MB	212 MB	268 MB	160 MB *
1536 MB	256 MB	340 MB	160 MB *
2048 MB	256 MB	340 MB	160 MB *

* If Terminal Services is installed on Windows 2000, Paged Pool is lowered down to 160 MB unless a registry change is made to the server to set the Paged Pool Size to its maximum value (see below).

Windows 2003 SP1

System RAM	NonPaged Max	Paged Max
512 MB	125 MB	184 MB
1024 MB	202 MB	168 MB
1536 MB	254 MB	352 MB
2048 MB	252 MB	352 MB

On Windows 2003 systems, Terminal Services are enabled by default.

On both Windows 2000 and Windows 2003, the HKLM\System\CurrentControlSet\Control\Session Management\Memory Management\PagedPoolSize value can be set to 0xFFFFFFFF (or resetting the value to 0) to ensure that the Virtual Address Space used for Paged Pool is maximized.

Also - here's the theoretical maximums for pre-Vista Operating Systems:

Region	IA-64	x64	x86
Process Address Space	7152 GB	8192 GB	2 to 3 GB*
Paged Pool	128 GB	128 GB	470 to 650 MB
NonPaged Pool	128 GB	128 GB	256 MB

http://blogs.technet.com/b/askperf/archive/2007/03/07/memory-management-understanding-pool-resources.aspx


For server runing Exchange 2003

The following table displays the matrix of evaluations used by the Exchange Server Analyzer to determine whether this value is out-of-bounds for a specified Exchange server. If the conditions in the following table are matched, a warning is displayed.

Operating System	Boot.ini Setting	Current Non-Paged Pool is
Microsoft Windows 2000 Advanced Server	/3GB	100 MB or more
Microsoft Windows 2000 Server or Advanced Server	None	200 MB or more
Microsoft Windows Server™ 2003	/3GB	100 MB or more
Microsoft Windows Server 2003	None	200 MB or more

The PoolNonpagedBytes key value is the size, in bytes, of the kernel memory non-paged pool. This is an area of physical system memory for objects that cannot be written to disk even when they are not being used. This value for this key is the last observed value. On a healthy Exchange server, unless a backup or restore is occurring, there should be no more than 85 MB of non-paged pool memory being used.

http://technet.microsoft.com/en-us/library/aa996269%28EXCHG.80%29.aspx

Schedule free bussy

Outlook 2003 and 2007

Outlook 2007 will look for a Client Access Server to view free/busy info. Exchange 2003 uses public folders to publish free/busy info.

To force Outlook 2007 to look for Public Folder based Free/Busy information you need to hack the registry:

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Options\Calendar
Value Type: DWORD
Value Name: UseLegacyFB
Values:0 or not set (default behavior which is to use the Availability Service) or 1 (use Public Folder based Free/Busy information)

Special Considerations for Working with Client Permissions

For outlook 2003

MS recomendation:

By default:

For outlook 2007:

· Si ambos usuarios no están, usen PFadmin para reparar los permisos, al agregar o modificar permisos, también corrige problemas.

------------------------------------------------------------------------------------------------------------------------------------------------------

Algunos testeos q están buenos:

Test configuration on outlook 2007

# While Outlook 2007 is running, hold down the CTRL key, right-click the Outlook icon in the notification area, and then select Test E-mail AutoConfiguration.

# Verify that the correct e-mail address is in the box next to E-mail Address.

# Clear the check boxes next to Use Guessmart and Secure Guessmart Authentication.

# On the Test E-mail AutoConfiguration page, verify that the check box next to Use AutoDiscover is selected, and then click the Test button.

Enable TST

# In Outlook 2007, on the Tools menu, click Options, click the Other tab, and then click Advanced Options.

# On the Advanced Options page, select Enable logging (troubleshooting), and then click OK.

# Restart Outlook 2007, and then try to view free/busy information for another user.

# In Microsoft Windows, click Start, click Run, and then type %temp%.

# In Windows Explorer, open the olkdisc.log file and locate the files in the olkas directory.

SSL services in exchange 2007

On exchange 2007 there are many client protocols as 2003 as well, when import a cert on the CAS or HUB server, we are able to co consolidate or associate those with all services (pop3, imap4,smtp,owa).

For a clients outlook express and SMTP we must take care with the configuration, by default there is a receive connector for a clients:





On the client:

We are using an internal PKI and in order to request a new SMTP certificate using the Exchange Management Shell use the following cmdlet:

New-ExchangeCertificate –GenerateRequest –Path c:\cert.req –SubjectName “cn=relay.apatricio.local” –FriendlyName “Internal Relay Certificate” –PrivateKeyExportable:$True

Now, let’s request the certificate created using the Certification Authority webpage:

1. Logged on Exchange Server open the http:///certsrv, where is your server which hosts the Certification Authority.
2. Click on Request a Certificate link.
3. Click on advanced certificate request.
4. Click on the second link which is Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
5. Open the file C:\cert.req which was created by New-ExchangeCertificate cmdlet and copy the content.
6. Paste the content of that file into the Base-64-encoded certificate request field in the webpage.
7. On the same page, select Web Server in the Certificate Template field and then click the Submit button.
8. On the new page, click on the Download Certificate link and save it in the C:\ root of the Exchange Server.

Let’s import the new certificate, to do that use this cmdlet:

Import-ExchangeCertificate –Path:C:\certnew.cer

Note:
The file name and path is just an example, you have to use the file name and path that you have used in the previous step.

Time to enable the new imported certificate to be used by the SMTP service using the Exchange Management Shell. To enable it we just need to copy the Thumbprint that was shown when we imported the request in the previous step and use this cmdlet:

Enable-ExchangeCertificate –Thumbprint -Services SMTP

You will be prompted to change the default SMTP certificate, just type in N and hit enter.

Use get-excgangecertificates | fl PS to see the current services attached on the cert:

More information:

http://technet.microsoft.com/en-us/library/aa997231%28EXCHG.80%29.aspx

For enable logging:

Information Store and Log sequence numbers

Event 514 on our exchange server means that the logs sequence is consume and when is completed, all Exchange databases will dismounted.

Information Store (6768) XXX: Log sequence numbers for this instance have almost been completely consumed. The current log generation is 933000 (0x000E3C88) which is approaching the maximum log generation of 1048559 (0x000FFFEF), there are 115559 (0x0001C367) log generations.

So the maximum log generation is 1048559 (0x000FFFEF) and remains 115559 logs to consume, so ig we find on the APP eventvwr the event number 214, we can estimate how many logs our Exchange use by day and we can estimate how many days we have until to have this problem.

Exchange 2007 supports 2 billion log files (2147483628) which is 7fffffec in hexadecimal.

Notice that if you miss the ESE 514 warning your databases will dismount and generate the following events:

Event ID: 1159
Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Description: Database error 0xfffffdf9 occurred in function JTAB_BASE::EcEscrowUpdate while accessing the database "First Storage Group\Mailbox Store (SERVER)".

Event ID: 9518
Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Description: Error 0xfffffddc starting Storage Group Path_of_Storage_Group on the Microsoft Exchange Information Store. Storage Group - Initialization of Jet failed.

More info.
http://support.microsoft.com/kb/830408

Solution:

One of the common solution is dismount all database that are part of storage group, move out all logs and CHK file, mount all databases, CHK file and transaction logs will create starting in 0.

1--


2--


3--


4--


After that, all incremental backup are unusable, so run a full backup after this procedure.