Exchange 2013 built-in anti-malware: MS Filtering Engine Update process was unsuccessful in contacting the Primary Update Path

Issue: Exchange 2013 cannot download anti-malware updates

Event Viewer error:

MS Filtering Engine Update process was unsuccessful in contacting the Primary Update Path. Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate

·        Source: FIPFS

·        ID: 6027
·        User: Network Service
 

Exchange 2013 server:

·        The Exchange 2013 server has Internet access and can access path: http://forefrontdl.microsoft.com/server/scanengineupdate

·        Exchange installed on D: drive
·        Exchange 2013 CU9 (Multi-Role) on Windows 2012 R2

 

Exchange 2013 Malware Engine Updates Troubleshooting states:

“If the above will not resolve your issue check that "NT AUTHROITY\Network Service" has full access for the folder Program Files\Microsoft\Exchange\V15\FIP-FS\Data\Engines\amd64\Microsoft\bin, in case you have installed Exchange in different drive, you need to add "NT AUTHROITY\Network Service" on the drive itself.”
 

My ‘solution’:

·        Browse with File Explorer to D:\Program Files\Microsoft\Exchange\V15\FIP-FS\Data\Engines\amd64\Microsoft\bin

·        When accessing FIP-FS directory (and some other subdirectories) File Explorer displays a dialog box that prompts you with the following: You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder.

·        After clicking Continue you are able to browse directory contents

·        NTFS security permissions on D:\Program Files\Microsoft\Exchange\V15\FIP-FS\Data\Engines\amd64\Microsoft\bin show NETWORK SERVICE with appropriate permissions

After performing these steps anti-malware updates are being downloaded.

Event Viewer:

MS Filtering Engine Update process performed a successful scan engine update.
Scan Engine: Microsoft
Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate

·        Source: FIPFS
·        ID: 6033
·        User: Network Service


Links:

·        When you click Continue for folder access in Windows Explorer, your user account is added to the ACL for the folder

Exchange 2013 CU9 AD versions

MS has released Exchange 2013 CU9. Prepare Active Directory and domains is not required when upgrading from CU7 or CU8.

AD Versions table:

AD Versions in my lab env after installing Exchange 2013 CU9 with /PrepareSchema & /PrepareAD (ADSI Edit):

Schema naming context:

• CN=Schema,CN=Configuration,DC=demo,DC=lan
• Properties CN=ms-Exch-Schema-Version-Pt
• rangeUpper: 15312

Default naming context:

• DC=demo,DC=lan
• Properties CN=Microsoft Exchange System Objects
• objectVersion: 13236

Configuration naming context:

• CN=Configuration,DC=demo,DC=lan
• CN=Services
• CN=Microsoft Exchange
• CN=MailOrg
• Properties CN=MailOrg
• objectVersion: 15965

 

 

Test-OutlookConnectivity fails: Failed to find the probe result for invoke now request

In my Exchange 2013 lab environment (Exchange 2013 CU7 Multi-Role) cmdlet Test-OutlookConnectivity fails:

Test-OutlookConnectivity –ProbeIdentity 'OutlookRpcSelfTestProbe'
WARNING: An unexpected error has occurred and a Watson dump is being generated: Failed to find the probe result for invoke now request id 743eb01ee4f2436fa909a8206c029773 and probe workdefinition id 317. Failed to find the probe result for invoke now request id 743eb01ee4f2436fa909a8206c029773 and probe workdefinition id 317.

Time zone setting on server: (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna

After changing server time zone (& server reboot) to: (UTC -08:00) Pacific Time (US & Canada) cmdlet Test-OutlookConnectivity –ProbeIdentity 'OutlookRpcSelfTestProbe' runs successful:

The same warning may appear when running Invoke-Monitoring cmdlet and is also related to this time zone issue. For example: Invoke-MonitoringProbe -Identity OWA\OwaCtpProbe –Server server-name

This issue has been reported to MS. Don’t know when it will be fixed.

Configure Send As permissions when member of Recipient Management

Administrators who are members of the Recipient Management role group have administrative access to create or modify Exchange 2013 recipients within the Exchange 2013 organization.

However, by default, members of Recipient Management are not able to configure Send As permissions on mailbox level.

Solution: New-ManagementRoleAssignment -Role 'Active Directory Permissions' -SecurityGroup 'Recipient Management'

Exchange 2013 Update-MailboxDatabaseCopy with parameter -CatalogOnly fails

You want to only seed the content index catalog for a database copy. Steps according to Update-MailboxDatabaseCopy:

1.    Suspend-MailboxDatabaseCopy database\server

2.    Update-MailboxDatabaseCopy database\server –CatalogOnly

Error after executing Update-MailboxDatabaseCopy database\server –CatalogOnly:

WARNING: Seeding of content index catalog for database 'DB001' failed. Please verify that the Microsoft Search (Exchange) and the Host Controller service for Exchange services are running and try the operation again. Error: There was no endpoint listening at net.tcp://localhost:3863/Management/SeedingAgent-F5A3EDE0-93F6-4126-927B-5026D8E6661D12/Single that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details..

Solution: do not suspend the database when only seeding the content index catalog

Suspend-MailboxDatabaseCopy database\server is only required when seeding a database copy.

Outlook 2010 shows the same display name for different archives

There is an archive name issue with Outlook 2010 where the delegate archive shows the name of the primary mailbox owner:

Solution:

Exchange 2010 SP3 UR2 + Outlook 2010 SP1 or SP2 with Outlook 2010 hotfix package august 2013 (http://support.microsoft.com/kb/2817574/en-us) is required to solve the archive name issue:

1.       Install Outlook 2010 hotfix package

2.       Start Outlook 2010

3.       Outlook 2010 Autodiscover updates Outlook configuration but Outlook still shows the same display name for different archives

4.       Restart Outlook 2010 client

5.       Outlook 2010 shows correct archive names:

Note: this is also an issue with Outlook 2010 and Exchange 2013 CU2 with the same solution. I have not yet been able to test this with Outlook 2013 and Exchange 2013.

Martijn

 

Exchange 2013 CU2 Error: Windows Failover Clustering isn't installed

I installed two Mailbox Servers and created a DAG. No problems adding first server to DAG.

 

However, got an error while adding second server to DAG:

 

A server-side database availability group administrative operation failed. Error The operation failed. CreateCluster errors may result from incorrectly configured static addresses. Error: Windows Failover Clustering isn't installed on 'ex2013-server'

I got this error from both EAC and EMS. Actually, Windows Failover Clustering should be automatically installed when adding a DAG member.

Solution:

1. Windows PowerShell: install-windowsfeature failover-clustering
2. Add second DAG member again

Microsoft Exchange Health Manager service does not start automatically

I installed two new Exchange 2013 servers (1x CAS & 1x MBX) with latest CU2 (build 15.0.712.24).

Issue: Microsoft Exchange Health Manager service does not start automatically after reboot.

Event Viewer System log:

Event ID:      7000
Level:         Error
Description:
The Microsoft Exchange Health Manager service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Event ID:      7009
Level:         Error
Description:
A timeout was reached (30000 milliseconds) while waiting for the Microsoft Exchange Health Manager service to connect.

No problem manually starting Microsoft Exchange Health Manager service. When you set the service to ‘Automatic (Delayed Start)’ it starts fine after each reboot.

I've posted comments at http://blogs.technet.com/b/exchange/archive/2013/07/29/now-available-updated-release-of-exchange-2013-rtm-cu2.aspx

http://howexchangeworks.com/2013/08/exchange-health-manager-service-wont-start-automatically-after-installing-2013-cu2-v2.html#comment-3391 describes that recreating Health mailboxes may solve this problem. Recreating the Health mailboxes doesn’t fix the problem. Service has not been started after reboot. However, after some time (10-15 minutes) the service starts automatically.

So, this still seems to be an issue because the Exchange Health Manager service has not been started automatically after a reboot (only after 10-15 minutes).

Exchange 2013 Management Shell: The WinRM client cannot process the request because the server name cannot be resolved

After installing Exchange 2013 CU2 on a server it was not possible to start Exchange 2013 Management Shell.

Cause: someone configured a proxy with no exceptions

netsh winhttp show proxy:

Proxy Server(s): proxy.contoso.local:8080
Bypass List: (none)

 

Solution:

netsh winhttp set proxy proxy-server="http=proxy.contoso.local:8080" bypass-list="*.contoso.local,<local>"

Note: Use "<local>" to bypass all short name hosts.

 

Exchange 2010 Database Copy Failed with high Copy Queue Length and no log files

I recently noticed the following after creating an Exchange 2010 (SP2) Database Copy (Exchange DAG across two datacenters and two AD Sites):

·         DB Copy Status: Failed. Error: The required log file <nr> for <DB> is missing on the active copy

·         High Copy Queue Length
·         DB Copy (.edb file) was created but no log files

Solution:

1.       Remove passive DB Copy
2.       Delete DB & log files from disk
3.       Force AD replication between AD Sites
4.       Dismount active database
5.       Delete all E0*.log files
6.       Mount database
7.       Create DB Copy

 

STOP: c00002e2 Directory Services could not start

After a hardware problem (storage) in my virtual lab environment my Windows 2008 R2 Domain Controller VM did not start. When booting the VM I got a BSOD with a STOP error:

STOP: c00002e2 Directory Services could not start because of the following error: a device attached to the system is not functioning.

Error status: 0xc0000001.

Please shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information.

This was my only Domain Controller and no backup so I had to solve this problem.

Troubleshooting steps:

1.    Boot into Directory Services Restore Mode (F8)

2.    NTDSUTIL:

·         activate instance NTDS

·         files

·         Error: Could not initialize the Jet engine: Jet Error -501. Failed to open DIT for AD DS/LDS instance NTDS. Error -2147418113

·         quit

3.    ESENTUTL /g C:\Windows\NTDS\ntds.dit

·         ESENTUTL result: successful (no DB corruption)

4.    ESENTUTL /p C:\Windows\NTDS\ntds.dit

·         ESENTUTL result: successful (no DB corruption)

5.    Event log:

·         Error 1003: Active Directory Domain Services could not be initialized. The directory service cannot recover from this error. Restore the local directory service from backup media. Error value: -501 JET_errLogFileCorrupt, Log file is corrupt

·         Error 465: NTDS (2156) Corruption was detected during soft recovery in logfile C:\Windows\NTDS\edb.log. The failing checksum record is located at position END. Data not matching the log-file fill pattern first appeared in sector 6697 (0x00001A29). This logfile has been damaged and is unusable.

·         Error 454: NTDS (2256) Database recovery/restore failed with unexpected error -501.

6.    Rename edb.log to edb.log.old and restart system

·         Result: same STOP error

Solution to this problem: rename all *.log files in C:\Windows\NTDS folder and restart system.

Exchange 2010 SP2 UR4 mailbox move issue

Exchange 2010 SP2 UR4 mailbox move to another DB on the same server with newly created databases gives warning/error:

The Microsoft Exchange Mailbox Replication service completed request <mailbox> with warnings.
Warning: Failed to clean up the source mailbox after the move.
Error details: MapiExceptionUnexpectedMailboxState: Unable to delete mailbox. (hr=0x80004005, ec=2634)

The mailbox has been moved and can be accessed. I think this is a bug which MS should solve.

See also http://social.technet.microsoft.com/Forums/da-DK/exchange2010/thread/6043b74f-a41e-4674-b2b1-08c3b1a3afbd

Exchange 2010 SAN Certificate Mismatched Address

Obtained an Exchange 2010 SAN Certificate from a Windows 2008 R2 Enterprise Root CA in a test environment.

When accessing OWA with IE I got a warning:

Mismatched Address

The security certificate presented by this website was issued for a different website's address

Cause: the Common Name of the certificate should also be part of the Subject Alternative Name field.

SAN Cert example:

CN: webmail.contoso.com

Subject Alternative Name field:
webmail.contoso.com
autodiscover.contoso.com

Exchange Server 2013 Preview

Exchange Server 2013 Preview is available now!

Exchange 2010 SP2 OWA Dutch translation issue part 2

Update: MS released the newest version of the Exchange 2010 language pack on 5/22/2012 which solves the issues as described in this blog. See Exchange 2010 Service Pack 2 Language Pack Available for Download.


In a previous blog I wrote about an Exchange 2010 SP2 OWA Dutch translation issue.


This issue is described in The word "Globale Adreslijst" in Dutch is displayed unexpectedly in breadcrumb and navigation pane in OWA in an Exchange Server 2010 SP2 environment.

Solution: install Exchange 2010 SP2 Language Pack Bundle on Exchange 2010 CAS Servers.

Important:

• Exchange 2010 SP2 Language Pack Bundle is ONLY for people with the Dutch OWA problem. No one else should install it.
• This Language Pack Bundle is only intended for Exchange 2010 CAS role to solve the OWA Dutch translation issue. So, install this Language Pack Bundle only on Exchange 2010 CAS or Multi-Role Servers. Don't install this LPB on Exchange 2010 Mailbox or HUB Transport Servers.
• If you have already installed this Language Pack Bundle on Exchange 2010 Mailbox Servers or Multi-Role Servers it will probably generate errors in Application Log (Active Directory entry for mailbox <name> contains an invalid locale for attribute MsExchUserCulture: nl-NL,en-US). Microsoft is working on a fix for this. Summary, if you have:
• CAS Server: installing LPB and no error events
• CAS/HUB Server: installing LPB and no error events
• CAS/HUB/MBX Server: installing LPB and error events (MS will provide a fix)
• MBX Server: installing LPB and error events (MS will provide a fix)

Remarks:

• All Exchange services will be stopped and disabled during installation of Exchange 2010 SP2 Language Pack Bundle. For DAG members follow directions in Installing Update Rollups on Database Availability Group Members.
• Installation takes about 20-30 minutes per server.
• See also What's new with Exchange 2010 languages support?

Install Exchange 2010 SP2 Language Pack Bundle:

1.       Download Exchange 2010 SP2 Language Pack Bundle
2.       Run LanguagePackBundle.exe

What do we see: the wrong translation ‘Globale adreslijst’ has been replaced with ‘E-mail’.

However, this translation is different from the original translation. With Exchange 2010 RTM/SP1 the OWA Dutch interface shows ‘Berichten’ instead of ‘E-mail’. I’ve asked Microsoft about this and for some reason they chose ‘E-mail’ instead of ‘Berichten’ as the original translation.

Forefront Protection 2010 for Exchange Hotfix Rollup 4 and Kaspersky scan engine update errors

After installing FPE 2010 Hotfix Rollup 4 Kaspersky scan engine was not updating.
Event Viewer errors:

Event Type:        Error

Event Source:    GetEngineFiles
Event Category: Engine Error
Event ID:             6012
Description:
Microsoft Forefront Protection encountered an error while performing a scan engine update.
   Scan Engine: Kaspersky
   Error Code: 0x80004005
   Error Detail: Description: An error occurred while loading the scan engine.

Event Type:        Error

Event Source:    GetEngineFiles
Event Category: Engine Error
Event ID:             6019
Description:
Microsoft Forefront Protection encountered an error while performing a scan engine update.
   Scan Engine: Kaspersky
   Error Detail: An error occurred while testing the scan engine.
 
FPE Console:

Solution:

If running FPE on Windows 2003:

1.       Windows Explorer: turn on ‘Show hidden files and folders’

2.       C:\Documents and Settings\All Users\Application Data
            Rename ‘Kaspersky SDK’ (for example: rename Kaspersky SDK to Kaspersky SDK OLD)
3.       Update FPE engines

If running FPE on Windows 2008:

1.       Windows Explorer: turn on ‘Show hidden files, folders, and drives’
2.       C:\ProgramData\
           Rename ‘Kaspersky SDK’ (for example: rename Kaspersky SDK to Kaspersky SDK OLD)
3.       Update FPE engines

Simplify the Outlook Web App URL

Simplify the Outlook Web App URL describes Exchange 2010 SP2 OWA redirection.

I have the following comments regarding Simplify the Outlook Web App URL:

·         Section “Use IIS Manager to simplify the Outlook Web App URL when SSL is required”: I think MS means: Use IIS Manager to simplify the Outlook Web App URL when SSL is required at the Default Web Site? If so, step 12 says: In SSL Settings, clear Require SSL but SSL should not be cleared if you require SSL at the Default Web Site.

·         When configuring Require SSL (clear Require SSL) & Redirection settings at Default Web Site, the settings are propagated to lower-level directories. The steps to enable SSL on all sub dir’s (except OAB & PowerShell virtual dir) and disable redirection on all sub dir’s are not explicitly mentioned.

·         The following table contains default OWA SSL & Redirect settings (after installing new Exchange 2010 SP2 CAS Server):

Default IIS Settings E2K10 SP2 CAS Server	SSL Settings	HTTP Redirect
Default Web Site	[x] Require SSL	[ ] Redirect requests to this destination: <> Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
aspnet_client	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
Autodiscover	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
ecp	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
EWS	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)

Exchange	[x] Require SSL	[x] Redirect requests to this destination: /owa Redirect Behavior: [ ] Redirect all requests to exact destination [ ] Only redirect requests to content in this directory Status code: Found (302)
Exchweb	[x] Require SSL	[x] Redirect requests to this destination: /owa Redirect Behavior: [ ] Redirect all requests to exact destination [ ] Only redirect requests to content in this directory Status code: Found (302)
Microsoft-Server-ActiveSync	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
OAB	[ ] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
owa	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
PowerShell	[ ] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
Public	[x] Require SSL	[x] Redirect requests to this destination: /owa Redirect Behavior: [ ] Redirect all requests to exact destination [ ] Only redirect requests to content in this directory Status code: Found (302)

Rpc	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)
RpcWithCert	[x] Require SSL	[ ] Redirect requests to this destination: < > Redirect Behavior: (options greyed out) [ ] Redirect all requests to exact destination [x] Only redirect requests to content in this directory Status code: Found (302)

By default only Exchange, Exchweb & Public virtual dir are redirected to /owa. However, after enabling redirection at the Default Web Site and disabling at owa virtual dir you get in a loop and it’s not possible to restore the default configuration (only Exchange, Exchweb & Public virtual dir redirect to /owa):

·         When I enable redirection for default web site, the owa site inherits the redirection.

·         When I remove the redirection from owa it removes it from exchange, exchweb and public sites as well.

·         If I add redirection back to exchange, exchweb or public sites it gets copied to owa site as well.

·         See also comments at http://briandesmond.com/blog/redirecting-owa-urls-in-exchange-2010/

After some research I found a much easier way to get owa redirection working by using Custom Error Pages:

IIS Manager (Windows 2008 R2):

·         Default Web Site, Error Pages, Add...

·         Add Custom Error Page

o   Status code: 403.4

o   (*) Respond with a 302 redirect

o   Absolute URL: https://webmail.domain.com/owa

By using Custom Error Pages there is no need to configure IIS SSL & Redirect settings and things don’t get messed up.

 

When using https://webmail.domain.com users will see the default IIS7 Welcome page. To redirect https://webmail.domain.com to https://webmail.domain.com/owa:

·         Create a default.aspx in the root directory (C:\inetpub\wwwroot\default.aspx) with one line:

o   <% Response.Redirect("https://webmail.domain.com/owa") %>

·         IIS Manager:

o   Default Web Site, Default Document

o   Move Up default.aspx to the top of the list

If you have any comments or questions, please let me know.