Checking if Office 365 wave 15 upgrade went OK

Last month a big customer of mine had a postponed wave 15 upgrade. After the upgrade we wanted to check if everything was upgraded to version 15 via the portal. Unfortunately this is not possible. However you can check it via powershell.

First of all you'll need to check if your Office 365 Organization (tenant) is upgraded properly. You can do this by connecting to the MSOL via the MSOL powershell module.

Check your tenant status

1.      Install  Windows Azure Active Directory Module for Windows PowerShell

2.      Open Windows PowerShell (I prefer to do it from the runtime in a normal powershell session but you can also use the Windows Azure Active Directory Module for Windows Powershell directly)

3. Execute the following commands:

Import-Module MSOnline #for powershell v3 and v4 this step is not needed 

$cred = Get-Credential <global admin account Office 365>
Connect-MsolService -Credential $cred
(Get-MsolCompanyInformation).CompanyTags

You now should see that your tenant is version 15:

 Check your Exchange Online Organization status

The next step is to verify if Exchange online is upgraded to wave 15. For this you need to create a pssession to Exchange Online.

1.      From within the earlier created powershell session connect to Exchange online with the following commands:

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $cred -Authentication Basic -AllowRedirection

Import-PSSession $session

2.      Next get the organisation version with the following cmdlet:

 Get-OrganizationConfig | fl Name, Admindisplayversion, IsUpgradingOrganization

3.      You now should see the following information if your tenant is upgraded:

 

Note: If the AdminDisplayName says 15.0.* then your organization is upgraded.

Verifying mailbox version

The last step is verifying that all the mailboxes are upgraded properly to wave 15.

1.      Execute the following oneliner in the powershell session you created in the previous step:

Get-Mailbox -ResultSize unlimited | where {$_.MailboxRelease -ne "E15"}

            Note: This command retrieves all mailboxes that do not have the E15 mailbox version.

2.      If you do not get anything back you're all done :)

 

My best new features in Powershell v3 and v4

Powershell is getting more and more used. My love for this commandline and scripting environment goes back to 2007 when Exchange Server 2007 was released. I was always a pro automation guy. IMO you can't be a good professional if you don't know how to script.

Now with the new version 3 of Powershell, the Microsoft Team introduced lot of new features. Here is a list of some of my quick favorites.

Show-Command

Do you ever get lost in all available cmdlets? Well I do. In Powershell v3 a new cmdlet is introduced called "Show-Command". When you run Show-Command a graphical window appears where you can search for cmdlets, create predefined syntaxes and read the help of the cmdlet. Very cool and it makes your life as a scripter much easier.

Out-Gridview

With Out-Gridview you can export a table or list to a graphical window called the GridView. Within GridView you can then Filter your output to narrow your results.

Example syntax: Get-Process | Out-GridView

Easy insert

I always had problems inserting a cmdlet parameter after you created a oneliner. You couldn't do it. In Powershel v3 you now can. Just simply go to the place where you want to insert your parameter type - and the parameter name et voila.

Module Auto-Loading

You now can just type in the cmdlet of a module that is not loaded into the runtime. This is very handy if you forget to import de module.

As you can see below only two modules have been loaded:

Next I type (for example) the cmdlet Add-VpnConnection and I auto complete by hitting the TAB key.

Now when I type in get-module again, you can see the module where the Add-VpnConnection cmdlets resides is automatically added.

 

 

 
 

Thinking Out of the Box: Exchange 2013 and backup

What else do you want to do on a sunny Wednesday afternoon then to write an article about Exchange Server 2013 and backup ;). No really it was a pretty long time ago that I posted a useful article about Exchange so I thought, why not write something about backup.

Last weeks I received a lot of questions from colleagues and customers about backup and disaster recovery in the new Exchange Server 2013. These questions really seemed to focus on the fact that organizations still have a pretty old understanding about backup and recovery. All customers still want to have item level backup while their data usage is growing.

So I thought, this is a good opportunity to write an article about backup and disaster recovery (DR) with Exchange Server 2013 (Exchange).

Introduction

First of all you can divide backup primarily into two main concerns:

1. You'll probably need backup to perform a point in time restore based on a single item or complete mailbox.
2. In any enterprise production environment you'll need a solution that provides you a solution to recover your data in case of an emergency.

In the old days the solution to the first concern in Exchange was to buy and implement a backup solution that provided you single item backup and recovery. This feature enabled IT organizations within a company to restore a single or multiple items back into a user's mailbox in case the user accidently deleted the item.

The demand for this solution was high so everybody implemented it and performed well within the requirements. However a few years ago mail data demand began to grow and backup time windows began to shrink because of hypes like "The new way to work" and/or "Work/Life integration". These hypes created more flexible work times and therefore a shorter backup windows. Also users kept their e-mail into their mailbox until the end of times.

These developments began to create some challenges for IT organizations to handle backup of mail data within the boundaries of time provided.

When the years went by Microsoft optimized it's database structure and implemented new features in Exchange to cope with these problems. This resulted in even bigger mailbox databases, but the mindset of organizations concerning the backup of mail data did not change. Even today customers want to have single item backup in their Exchange environment. And when you ask the question, how many times did you use this functionality the past year, they can't give you a real answer.

The second concern is how you need to cope with outage and emergency and getting you're data back (Disaster Recovery or Emergency Recovery). To describe this concern I'll give you a short explanation about DR.

DR can best be divided into two objectives:

1. RPO (Recovery Point Objective) and
2. RTO (Recovery Time Objective).

 

RPO

RPO is the maximum tolerable period in which data might be lost from an IT service due to a major incident. In other words how much data (measured in time) is an acceptable loss in case of an emergency.

RTO
RTO is the duration of time in which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity. In other words in how much time does the service(s) need to be restored in case of an emergency.

So how does this all related to Exchange Server 2013? Well I will try to explain this in the following paragraphs.

Backing up Exchange Server 2013

Third party backup solutions

At the moment of writing this article the support of third party backup solution/providers to backup Exchange Server 2013 is marginal. The following table gives you a better understanding of the most common ("enterprise ready") backup solutions and their support of Exchange Server 2013.

Note: From a Microsoft statement all backup solutions need to make use of the Volume Shadow copy Service(VSS) in order to create a successful and consistent backup. For more information about these requirements click here.

	Solution	Supported?	Level
1.	Symantec NetBackup	Support from version 7.5.0.6.	Database
2.	Symantec BackupExec	Support from version 2012 Service Pack 2	N/A
3.	NetApp SnapManager	Supported in version 7 and higher	Database
4.	CommVault	Supported in version 9 and higher	Database
5.	VEEAM	No support. Support is going to be in version 7. Release date unknown	N/A
6.	HP Dataprotector	Support from version 8.	Database
7.	EMC Avamar/Networker	No support	N/A
8.	IBM Tivoly Storage Manager	No Support	N/A

 

As you can see there isn't much support from third party products for Exchange Server 2013 yet. Why suppliers of backup software don't have a solution yet is unclear. But the question is, is this a potential problem when you want your organization to move forward in implementing Exchange Server 2013? Personally I think not. Better saying, I personally don't think you'll need a third party backup solution at all! And why is that you say?

Well the explanation is pretty simple. In Exchange (of course if you design it properly) all features to eliminate both backup concerns are built into Exchange. In the next paragraphs I will go deeper into it, so keep on reading ;).

 

Exchange Item Restore

When you ask your customers or the management of your organization if it is really necessary to have their single items back from backup in case of a user error, they probably say yes. But if you ask them till what point in time, they most of the time don't have a direct answer. If you then ask them if they are comfortable to have a restore period of let's say 1 month for recoverable items they probably say that it is ok. You have to keep in mind restoring single items has limitations. In case of a single item restore (not possible yet in combination with Exchange Server 2013) this brings long backup times and probably performance loss.

Exchange however has the ability to keep deleted items for a specific period of time. This is called retention policies. By default all deleted item's (by means items that are removed from the users "Deleted Items" folder) are saved for 14 days. This means that users are able to restore them within 14 days themselves from within Outlook.

So to for fill the need to restore single items you can simply use or extend the retention policy for recoverable items. This is done on the database. You'll however have to keep in mind that you'll need to calculate this in your mailbox storage requirements design.

The advantage of this approach are numerous:

• It saves you a lot of time to backup single items with any software;
• It saves you storage in case of snapshot backups on storage level;
• It saves you storage on your backup tapes;
• It saves your IT Helpdesk the burden to answer call's about restore of single items;
• And last but probably the most important, users don't have to call the IT department anymore. They can do it themselves! And that means, one step forward in pissing of users ;).

Exchange HA and Site Resiliency

Great! And what about Disaster Recovery I hear you say? Well Exchange has a built-in solution for that to. It will require you to think well about your design so I only describe the features and technologies needed to achieve the goal.

Since Exchange Server 2010 there is a new thing called Database Availability Groups  or DAG's. DAG's are the successor of the pain in the ass Continues Replication Cluster (CCR) which was available in Exchange Server 2007. Exchange Server 2013 the use of DAG's is continued and improved. With a DAG you can create High Available passive copies of your mailbox databases over up to 16 Exchange Mailbox Servers. The advantage of a DAG is that (although MS Cluster Services is still used on the background) the configuration is relatively simple. You'll need however extra storage for every copy of the database. It is also possible to divide your DAG's over separated Data Centers to ensure services continue to be available and data loss is kept at a minimum. This tackles your direct HA requirement.

But what if for whatever reason your active database gets corrupted? Are my passive copies then also affected? Uhhh yes they probably are. The reason for this is that each copy of an active database in a DAG is seeded (kept up-to-date) by using transaction log shipping. If corruption is inserted in a database the log will simply be played into a copy too.

But don't worry there is a solution for this and that's called "lagged copies". In every DAG you can create next to regular HA copies a Lagged Copy. A lagged copy simply means that you tell Exchange to insert a lag (delay in time) before it commit's changes to the database. Therefore if data gets corrupted in a database the lag will ensure the corruption is not directly in the lagged copy.

The use of Lagged Copies are there since Exchange Server 2007. And therefore also in Exchange Server 2010. However lagged copies where a bit hard to handle in Exchange Server 2010. Also if the organization needs a 0 day RPO it was simply not possible because the logs where gone if all "normal" copies of the databases where not there anymore and therefore the mail queue was empty.

In Exchange Server 2013 this issue is solved by a feature called Safety Net. Safety Net is the successor of the Transport Dumpster and is a layer that is not a part of the databases or the DAG. What Safety Net does is when a transaction is required (incoming or outgoing mail for example) it holds the message until the message is delivered in all the copies (including the lagged copy) of the databases in a DAG.

This all basically means that without any backup software you can tackle item level restore and you can reach a 0 day RTO and RPO together. Of course your design needs to be right and you'll need enough data centers and servers to do the job for you.

Accreditations

A special thanks to Martijn Moret (Data Management Consultant at PQR, @MMMoret) to provide me a table of all backup providers and their support of Exchange Server 2013.

Updates

09-07-2013: Updated support matrix for Symantec NetBackup and HP Dataprotector
09-08-2013: Updated support matrix for Symantec BackupExec

Microsoft Support Lifecycle. Hoe zit dat ook alweer?

Hoe zit dat nou ook alweer met de product lifecycle support van Microsoft producten? Deze vraag heb ik de laatste tijd regelmatig gekregen. Om deze reden bij deze een quick refresh.

Het support lifecycle beleid van Microsoft producten is eigenlijk heel simpel:

• 10 jaar ondersteuning (5 jaar algemene ondersteuning en 5 jaar uitgebreide ondersteuning) op het ondersteunde service pack niveau voor zakelijke- en developer producten en desktop besturingssystemen.
• 5 jaar algemene ondersteuning op het ondersteunde service pack niveau voor consumenten producten, multimedia producten en hardware.
• 3 jaar algemene ondersteuning voor producten met een jaarlijkse verschijning (Bijvoorbeeld Money, Encarta, Picture It!, Streets & Trips)

Wat houdt dit dan eigenlijk in? Als voorbeeld:

Windows Server 2003 is op 28-5-2003 gelanceerd. Voor de (basis) support betekent dit dat deze verloopt op 13-7-2010. Echter is het laatste service pack voor dit OS uitgekomen op 10-4-2007. Wat inhoud dat de uitgebreide support verloopt op 14-7-2015.

 

Wat is dan het verschil tussen basis en uitgebreide support? De onderstaande tabel geeft de verschillen (fases) tussen basis en uitgebreide support weer: 







































Hoe kan ik erachter komen wanneer een product uitgebracht is en wanneer de support verloopt?
Hier heeft Microsoft de "Lifecycle Support Database" voor ontwikkeld. Deze is te benaderen via http://support.microsoft.com/lifecycle/search/

Interessant weetje
Wist je dat de uitgebreide ondersteuning van  Exchange Server 2003 en Windows XP verlopen op 8 april 2014? Je hebt dus nog een jaar de tijd om weer support te krijgen door te upgraden.

IMHO: Coolest changes in Exchange Server 2010 since going RTM

Moments before being replaced by it's successor Exchange Server 2013 i want to share my thoughts about the IMHO coolest changes in Exchange Server 2010 since it's release on October, 8th 2009.

Off course lot's of improvements where made to make Exchange Server 2010 an even better product then it already was, i will not deny this. In a blog however, i think, you need to describe the most noticeable and biggest improvements. Therefore my top ...

1. Office Outlook 2003 support (SP2)
Although Office Outlook 2003 was supported since the RTM of Exchange Server 2010, it had some struggles getting it to work with Exchange Server 2010. This was al because of the RPC/TCP connections that Outlook 2003 is relying on. For some reason Exchange Server 2010 could'n handle these connections properly which related in view update problems when using an Outlook 2003 client. Microsoft tried to fix it in several Update Rollups and even in Service Pack 1, but the problems stayed. Since Service Pack 2 however we (Me and my collegeas at PQR) didn't find any big problems, concerning this issue, anymore. There are still some minor issues with the calender and icons in the address book but no real big problems.

Therefore i think this is THE biggest improvements since going to RTM. It kept us advising customers going to Exchange Server 2010 and upgrading the Office Outlook client at a later stage.

2. Hybrid Configuration Wizard (SP2)
I have always been a great fan of Public SAAS services. Especially Microsoft Office 365. In my humble opinion going hybrid should always be a consideration when talking to customers and creating a business case for a new Messaging Environment and even more.

Why you ask? In some cases it could enable customers to split functionality of e-mail to fit the needs of different types of users. I did some projects for big healthcare companies who wanted to provide the "caring" people a corporate e-mail address but not wanted to wast expensive internal IT resources. In these cases going hybrid was the perfect way to go. Providing internal users an on-premises mailbox and providing the less e-mail relying "caring" users an Office 365 Kiosk mailbox which is federated with the on-premises Exchange organization.

Configuring a full hybrid solution however was, until Service Pack 2, a pretty time consuming and intensive thing to do. You manually needed to configure about 75 steps. Since Service Pack 2 you still need some configuration (no it's not easy), but the introduction of the Hybrid Configuration Wizard definitely made it easier.

Therefore it's on number 2 in my list.

3. Introduction of the "New-MailboxRepairRequest" cmdlet (SP1)
Before it was always a struggle in dealing with database corruption. You either needed to:
1. Take the corrupt DB offline and manually repair, defrag and check it which was very time consuming if you had large DB's, or;
2. Create a new DB and move all mailboxes to the new DB which would cost you temporary storage utilization, or;
3. In a DAG solution create a new DB and perform a reseed action which was very time consuming, or;
4. Restoring the DB from the latest proper backup.

Therefore this new feature introduced in Service Pack 1 deserves a good spot on my list.

4. The ability to soft-delete mailboxes after move completion (SP1)
Can you remember this great functionality in Exchange Server 2007, where you could move a mailbox and set the move-mailbox cmdlet to hold-on the source mailbox in case something went wrong during the mailbox move? Well i used it quite often and was pretty stunned that this option was not available anymore in Exchange Server 2010.

Luckily Microsoft also noted this and restored a similar function back in Service Pack 1. It's not the same feature but you are able to restore a soft-deleted mailbox, by using the MailboxRestoreRequest cmdlet's, in case a move request went wrong.

5. The ability to place archive mailboxes on a different DB (SP1)
Although i was never a big fan of how Microsoft looks at archiving, the biggest new thing and also the biggest shortcoming in the RTM of Exchange Server 2010 was the location of the archive mailbox in the same DB as the production mailbox. In my opinion and many with me it didn't make sense at all. Since Service Pack 1 you can place archives of archive enabled users to a different database. This makes more sense.

I still think that "Microsoft" archiving is no real archiving. Compared to Enterprise Archiving products like Symantec Enterprise Vault or Commvault Archiving, you are limited to retention policies based on time and it only moves the item to another location. It also is quite expensive, considering an Enterprise CAL and Office Professional Plus is required. Enterprise Archiving Products are, besides cheaper, way more sophisticated then Exchange Archiving. You can for example create different archiving policies based on attachment sizes or else. Enterprise Archiving products also have better understanding of how to use storage more efficiently by using technologies like single instance storage, compression and de-duplication. Which al can save you a lot of storage at the end.

Still, if you want to go for Exchange Archiving, this feature deserves a spot in my list.

6. Cross-Site Silent Redirection for OWA(SP2)
One of the cool new things introduced with Service Pack 2 is the Cross-Site Silent Redirection. With this option you can redirect CAS request to a better servicing CAS server in another AD Site. You can also create SSO experience with this feature.

7. Mailbox Auto-Mapping (SP2)
Some love it, others hate it. Personally i love it. If a user has full-control permissions on a mailbox, the mailbox is automatically added to the users Outlook profile when logging into Outlook by using the autodiscover service combined with the Auto-Mapping feature. In my experience this saved a lot of IT admins and Service Desks a lot of incidents to help users adding all the mailboxes when a profile became corrupt or else.

Well these where my 2 cents for now ;)

Why Office 365 is no option in a European Tender

Maybe you recognize is scenario. A local government company is merged from three other local government companies to be more (economical) effective. These three local companies however all run a separate IT infrastructure. The next logical step is of course to integrate these separate IT infrastructures into one new IT infrastructure. The most common decision is to create a new "greenfield" IT infrastructure where the IT services of all three companies will be merged into one new platform.

Goodbye MCM! Hello MCSM!

As most of you all know is that the Microsoft Certified Master (MCM) program is coming to an end. The last MCM rotation for Exchange Server is hold on November, 15. But what happens to the program and what do you need to do to get certified? This post gives you an overall view of what is going to change and what you'll need to do to be in the program.

Unable to on-board and off-board mailboxes in an Exchange HybridConfiguration

This blog post describes the situation where you are unable to move an Exchange Online (Office 365) mailbox to an on-premise Exchange 2010 server in a hybrid configuration.

If an Exchange Online mailbox is created via the Exchange 2010 Management Console, the ExchangeGUID of the MS Online Mailbox is not properly set in the remote-mailbox configuration of the Active Directory user object. In most cases this is no problem at all, but if you want to move an MS Online mailbox from the cloud to your on-premises Exchange 2010 server the process fails with the error "Exception has been thrown by the target of an invocation.".

Exchange Server 2013 – A first glimpse – part 1

On 11 july 2012 Microsoft Released the long expected preview version of Exchange Server 2013 (also known as Exchange 15). In this multipart blog I will try to show you a glimpse of what's new in Exchange Server 2013.

• In part 1 I will describe the new features and changes that this new version of Exchange is going to offer;


• In part 2 I will guide you through the installation of Exchange Server 2013;


• In part 3 we will have a deeper look into the management of Exchange Server 2013.

Could not bind port 80 on TMG with Windows Server 2008 R2 SP1

During a new implementation of a reverse proxy solution for Exchange Server 2010 OWA based on a Threat Management Gateway 2010 server. I encountered an issue where I couldn't bind port 80 for redirection to port 443. The server where i tried to install and configure TMG on was a Windows Server 2008 R2 SP1 machine.

The following post will guide you thought the issues i had and give you a solution to this problem.

Offloading mailboxes from Exchange Online to on-premise Exchange Server 2010

When a user mailbox is created in Exchange Online by the "Create Remote Mailbox" feature in Exchange Server 2010 and the mailbox of this user needs to be moved back to the on-premise Exchange 2010 environment, it will end up in the error "Exception has been thrown by the target of an invocation.

This was clearly a bug in Exchange Server 2010 SP2.

DirSync: Preparing all UPN's required or not?

Everyone who implemented a hybrid office 365 Exchange Online configuration probably have read the deployment guide for Office 365.

In that guide you will read that you need to make some preparations to your Active Directory.

Change the UPN of a federated user after user has been synced to Office 365

Microsoft strongly recommends to make sure all UPN's needed in Office 365 to be set correctly before doing the initial DirSync.

However in some cases you may want to change the UPN after the initial DirSync anyway, for example:

•  When you're companies history lacks correct user registration (names are not correct);


•  When a user changes their lastname when he/she get's married and wants to use that name when logging in.

In this case it is possible to change the UPN of the user in the federated domain. However again this is not recommended. Here is how you do it.

Five things to reconsider when designing Exchange Server 2010

Five things you don’t do when designing a new Exchange Server 2010 environment.

When it comes to designing a new Exchange Server 2010 environment, a lot of techies think that this isn’t so hard. They just think “Let’s put some servers and install some Exchange roles on it and the job is done”. Especially when installing these servers in a virtual environment like VMware or Hyper-V these things happen. Techies often think hey it’s virtual, therefore my design boundaries are unlimited. Well wrong, wrong, wrong thinking.

Running 64-bit Powershell scripts via SCCM

It kind off started worrying me a bit when i was deploying SCCM 2007 R3 and i wanted to run several power shell scripts that needed to install some Windows Features. I just didn't want to work. Finally after several days, several reinstallations of my test VM, etc, etc i got it working and this is how to do it:

Creating a wildcard webserver certificate with your internal CA

It is possible to create a wildcard webserver certificate using your internal Enterprise CA based on Windows Server 2008 R2. To do this you need to have a Enterprice CA with the webserver template deployed.

The question you'll probably ask yourself is "Why do i need this?". Well the answer is simple. You probably don't want to use this certificate in a production environment, but you can use it for testing purposes without having you to buy a expensive commercial wildcard certificate. Espessially when the test results are having you deciding that a wildcard certificate is not the way to go.

Aanmaken SSL certificaat voor Outlook Web Access via Shell

Om gebruik te kunnen maken van OWA, is het aanbevolen om gebruik te maken van een commercieel SSL certificaat met mobiele ondersteuning. De CSR die aangemaakt wordt in de komende stappen kan gebruikt worden tijdens de aanvraag bij een willekeurige SSL leverancier. Bijvoorbeeld www.sslcertificaat.nl. Hier wordt vervolgens gekozen voor een Comodo Mobile SSL Certificaat.

Libraries in Windows 7

Although this feature in Windows 7 is very handy in accessing your files easy there are some downsides on this feature when deploying it in your organization.

1. If you use the Library feature in Windows 7 on remote files/folders, it requires indexing on the file/folder server which is only supported in Windows Server 2008(R2) or on Windows Server 2003 with Desktop Search 4.0. This is because the library feature needs to have a indexed source folder in order to know where your files are located. To have your Windows 7 client do this, will mean that you need to have 24*7 access to these folders and that's usually not the case.What you can do to have it work is to enable offline folder synchronization on the share you will need to access. This will make a offline copy of the share on the Windows 7 client, so that your client can do the indexing on the folder. Unfortunately this means that you will need a time to time replication to your share on your NAS device.In my understanding i have never seen a third party NAS device with CIFS sharing that can index on your file/folders and have Windows understand it.


2. The library feature is not deploy-able via a GPO. This makes the Central Management of Libraries in Windows 7 a hard one. The philosophy behind Libraries i think is that it's a user feature. If users know what the advantages of properly set libraries are, they will need to create and manage them there own.