Exchange Server Archives

SBS 2008 – Move Exchange Server Data – Failure: Cannot use SBS Wizard

Apr 142012

The other day I received a notification that one of my clients were running out of space on their SAS RAID Array which contained their Exchange 2007 mailbox data store database. While I have every plan to increase the size of this partition, I still have to temporarily fix things so we don’t run out of space. Technically, to put a temporary fix on this, I had to move the Exchange Server Data to another partition on the server which had plenty of space. Typically, this is very easy on Microsoft Small Business Server 2008. However, in this specific scenario we were getting an error when trying to run the wizard to move the data:

“You cannot use the Windows SBS Console to move the Exchange Server data. – You may have used the Exchange Server Management Console to perform advanced configuration tasks. For information about how to reconfigure move your data using the Exchange Server Management Console, see the documentation for Microsoft Exchange Server“

After receiving this error I went ahead and looked for the logs pertaining to the move wizards. The error log mentioned that configuration was altered from the default (which is acceptable since we have done some modifications to our Exchange config), and I also believe this is occurred due to both our “First Storage Group” and “Second Storage Group” already being hosted on different logical partitions. From what I have read, you cannot modify your Exchange configuration too heavily, nor have your different storage groups on different partitions for the wizard to work.

Since this happened, we have to move the Exchange data manually using the Exchange Management Console. These instructions will work for both Microsoft Windows Small Business Server 2008, and also Microsoft Exchange 2007 running on a standard Microsoft Windows Server (only if your not using any replication to other Exchange Servers). Please note that during this move, all move functions will require the database to be dismounted from the information store. Only Exchange 2010 (or later) supports live moving.

Instructions to move the Exchange database (First Storage Group – Mailbox Database):

Important: Always back up your server before doing heavy operations like this in case something goes wrong. To back Microsoft Exchange up, you have to have backup software that is “Exchange Aware” and can properly back it up.

1) Launch the Microsoft Exchange Management Console and locate the Database Management information – You should be able to find the Exchange Management console in your start menu. When opening it should prompt for a UAC (run as Administrator) privileges, grant it. If it does not prompt you to run as Administrator, right click on “Exchange Management Console” and select “Run as Administrator”. Once you have opened the console, expand “Server Configuration” and “Mailbox”.

Server Configuration -> Mailbox

2) Move Storage Group Path -First we need to move the “Storage Group Path” for the “First Storage Group” (which contains our Exchange Mailboxes). This will move the files that are related to logs, transaction files, etc… To do this, right click on “First Storage Group”, and select “Move Storage Group Path…”. Follow the wizard. Inside of the wizard, you will choose the new location in both the “Log files path” and “System files path”. Finally after you have specified the location, it will dismount the database and perform the move function.

Move Storage Group Path Wizard

3) Move Database Path – Now we need to move the actual database path of the “Mailbox Database”. This will actually move the Exchange mailboxes on our server to a new location. To do this, right click on “Mailbox Database” and select “Move database path…”. Follow the wizard. Inside of the wizard, you will choose the new location for the “Database file path”. Finally after you have specified the location, it will dismount the database and perform the move function.

Move Database Path Wizard

4) Move Public Folders (If desired) – If you desire, you can also move your “Public Folders” by performing the same steps for the “Second Storage Group” and the “Public Folder Database”. In my case, our public folders are very small, so I didn’t bother.

You have now moved your Exchange 2007 mailbox database.

If you need any assistance or help with SBS, please don’t hesitate to reach out. I provide SBS Consulting Services, more information can be found here: https://www.stephenwagner.com/2020/02/28/microsoft-small-business-server-migration-upgrade/.

Microsoft Small Business Server 2008 – An internal transport certififcate will expire soon.

Exchange Server, Small Business Server 1 Response »

Mar 112012

For the past 2 weeks I’ve been receiving notifications reporting that one of my clients SBS 2008 environments is about to have some Exchange certificates expire.

Please Note, I provide Small Business Server consulting services, more information is available here!

Below is an example of the event log:

Source: MSExchangeTransport
Category: TransportService
Event ID: 12017
User (If Applicable): N/A
Computer: server.domain.local Event Description: An internal transport certificate will expire soon. Thumbprint:ZOMGZOMGZOMGZAOMGZOMGZOMGZOM, hours remaining: 46 Event Log Name: Application Event Log Type: warning Event Log Date Time: 2012-03-08 13:15:36

Now upon initial research, apparently we were supposed to just be able to run the “Fix My Network” wizard inside of the SBS Console. Running this during the warnings, and after the certificate actually expired did absolutely nothing. The wizard was unable to detect the certificate had expired. It did report something to do with issues with an SMTP connector, however everything was working, and when trying to fix that, the wizard errored out and could not complete. I also read another article that running the “Setup my internet address” my fix the issue, but however it did not.

I decided to take a look at all the certificates currently install and also in use. To view the certificates installed, go to “Start”, then “Run”, type in “mmc.exe” and hit OK. Click on “File”, then “Add/Remove Snap-in”. Inside of this window, highlight “Certificates” and move to the right (hit the button with the arrow). Another window should open, select “Computer Account”, and follow through with the wizard. Once the certificates open, expand “Personal” and “Certificates” underneath it.

In my environment I noticed that there were two certificates that were identical, only difference being expiration. I had a feeling that the proper certificate existed on the server, however for some reason it was using an older one that it should not be. Keep in mind, this specific server was migrated from another (SBS 2008 to SBS 2008 Migration to new hardware).

To confirm they were identical, I opened up a Exchange Shell (find it in the start menu, and right click and “Run As Administrator”). I typed in “Get-ExchangeCertificate | FL”. The output confirmed that the certificates were the same and performed the same function.

ONLY PERFORM THIS if exchange is using the wrong certificate and you have two certificates which are the same, only with different expiration dates. If you do not, you are experiencing another problem and these instruction either won’t help you, or make your problem worse.

I decided to switch Exchange over to the new certificate:

1) Get the thumbprint of the newer certificate, it will be provided when you run “Get-ExchangeCertificate | FL”. Make sure the services and information match the certificate that is about to expire.

2) With the Exchange Shell still open type in “Enable-ExchangeCertificate thumbprint -Services SMTP,POP,IMAP” (sub in the thumbprint where it says thumbprint).

3) It will ask you to confirm, click ok.

4) Delete the old certificate, but make sure you back it up first. Export the old expiring certificate using the Certificate view inside of mmc.exe (what we did above). Export it (with extended data) so it can easily be re-imported if any issues occur. If you do need to restore it, inside of the Certificate view in mmc.exe, simply right click, re-import, and use the “Enable-ExchangeCertificate” (shown above) to re-activate it.

Hope this helps!

Renew Exchange 2010 Certificates – Event ID: 12017 & Event ID: 12018

Exchange Server, Microsoft 25 Responses »

Mar 102012

Wow, what a horrible weekend it has been dealing with all these certificate expirations (both clients, and my own). Ton’s of articles on the internet, however tons don’t cover what you do if you have your own certificate authority and DON’T want to use a self-signed certificate. Also, all the tutorials on the net use the Shell, I rather use the GUI…

When it comes time to renew your certificate, you’ll be seeing these in your Event Viewer:

Source: MSExchangeTransport
Category: TransportService
Event ID: 12018
User (If Applicable): N/A
Computer: server.domain.com Event Description: The STARTTLS certificate will expire soon: subject: server.domain.com, thumbprint: ZOMGZOMGZOMGZOMGZOMGZOMGZOMGZOMG, hours remaining: 664. Run the New-ExchangeCertificate cmdlet to create a new certificate.

Source: MSExchangeTransport
Category: TransportService
Event ID: 12017
User (If Applicable): N/A
Computer: server.domain.com Event Description: An internal transport certificate will expire soon. ZOMGZOMGZOMGZOMGZOMGZOMGZOMGZOMG, hours remaining: 664 Event Log Name: Application Event Log Type: error

Anyways, first off, DO NOT use this tutorial if your running “Microsoft Small Business Server”, there is a better, easier, and more automated way to perform this on SBS (I won’t be covering that in this blog post, I will however make another one to explain the procedure). Depending on you’re environment, this may or may not be the best way or the right way to do this. In my environment, I have 1 server that acts as a Domain Controller and a Certificate authority, and a second server that is running Microsoft Exchange 2010.

You take your own risk if you perform the instruction in this blog post.

1) Start the renewal process

We need to generate a renewal request. Load up the Exchange Console, and select the “Server Configuration” on the left. It should load up your Exchange Certificates on the lower half of your screen. Look for your certificate that is about to expire. To get the details on the certificates, simply double click and it will load the info, if you’re unsure of which certificate it is, use the thumbprint provided in the Event viewer, and compare it to the Thumbprint on the “Details” tab of the certificate. Once you find it, highlight it and select “Renew Exchange Certificate…” on the action pain to the right.

Renew Exchange Certificate

2) Create renewal request Wizard

This will open the certificate renewal request wizard (as shown below):

Certificate Renewal Request Wizard

Simply choose a file name and location to save the request. It’s easiest just to save it on your desktop. After, hit “Renew”. This will generate the certificate renewal request.

3) Copy certificate request to clipboard

Locate the file you created above inside of Windows Explorer. Right click on this file and select “Open”, or “Open With”. When prompted, uncheck the “Always use the selected program to open this kind of file” option, and select “Notepad” as the program to open the file with. Example below:

Open with Notepad

This will open the certificate request. Now highlight all the text and copy it to your clipboard. Example below:

Certificate request in Notepad

4) Submit certificate request to certificate authority using web interface

Now we submit the request! Log on to your certificate authority web interface. On the first screen, we will select “Request a certificate”, as shown below:

Request

Then select “advanced certificate request”, as shown below:

Advanced certificate request

And now, choose “Submit a certificate request by using a base-64 encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.”, again example below:

Finally, we are going to populate the request. Inside of the “Saved Request:” text box, paste your request from your clipboard (which we copied to your clipboard above), then for “Certificate Template:” choose “Web Server”. Example is below:

Now select Submit! On the next page that loads, simply select “Download certificate” and save it to a location you’ll remember.

5) Install certificate on Exchange

We now have a certificate that’s ready to be installed. Go back to the Exchange console where we left off. Inside of the certificate list, you should see an item that has a status that says something about a pending request. Highlight this request, and on the Action Pane, select “Complete request”. I could be wrong on what this says as I can’t remember and did not take screenshots.

A wizard should open up, in this wizard simply point it to the new certificate (the file we just saved at the end of step 4, shown above). Follow the instructions.

6) Assign Services to Certificate

Now that the certificate is installed, we need to assign which services will use it. The new certificate should also now be in the list of certificates inside of Exchange. Highlight the new certificate, right click, and select “Assign Services to Certificate”. Example below:

Assign Services to Certificate

Once the wizard opens up, follow through and when actually prompted for the services check everything except for “Unified Messaging”. Finish the wizard.

7) Delete old certificate

Now we are almost done. Go back to the certificate list inside of Exchange and look for the old certificate that is going to expire. Highlight it, right click, and select “Remove”.

You’re Done!

BlackBerry Enterprise Server – Attachment Server not found

BES (and BES Express), Exchange Server 11 Responses »

Nov 102010

Hi guys,

I come to you today to tell you a little story about a struggle I’ve been having with BES and users who are receiving the “Attachment Server not Found” error message on their handhelds.

For a few weeks now, a few users have reported issues with opening attachments, EVERYTHING else works perfect. I updated BES, checked everything, still couldn’t find out what was wrong. The only thing I had to go on, was a few very odd log entries inside of ASCL log file.

Example of entries in ASCL log:

[10000] (11/10 18:22:53.234):{0x21B0} [thr:0x21B0] CHALogic::_group_of_extensions_t::add_server_extensions(0) – no data
[10000] (11/10 18:22:53.236):{0x21B0} [thr:0x21B0] CHALogic::_list_of_servers_t::Add(0,…) – no need to add empty STRINGS_SET
[10000] (11/10 18:22:53.236):{0x21B0} [thr:0x21B0] CHALogic::_group_of_servers_t::AddServer(0,…) – _preferred.Add() failed with rc=1007
[10000] (11/10 18:22:53.244):{0x22AC} [thr:0x22AC] CArznDelayedAttachmentResultVisitor::Uninitialize() – begin
[10000] (11/10 18:22:53.245):{0x22AC} [thr:0x22AC] CArznSocket::Close() – m_connectSocket = 0xFFFFFFFF, after
[10000] (11/10 18:22:53.245):{0x22AC} [thr:0x22AC] CArznDelayedAttachmentResultVisitor::Uninitialize() – end
[10000] (11/10 18:22:53.245):{0x22BC} [thr:0x22BC] CArznSocket::Close() – m_connectSocket = 0xFFFFFFFF, after
[10000] (11/10 18:22:53.248):{0x22C8} [thr:0x22C8] CArznDelayedAttachmentResultVisitor::Uninitialize() – begin
[10000] (11/10 18:22:53.248):{0x22C8} [thr:0x22C8] CArznSocket::Close() – m_connectSocket = 0xFFFFFFFF, after

I spent a few days googling the error “Attachment Server not found”, and came across numerous KB articles that wanted us to try this, try that, bla bla. Everything was configured properly, and the service was running. So all of these did not apply to me!

Finally I took a LONG hard stare at the errors in the ASCL log shown above, and put 2 and 2 together and realized it probably had something to do with TCP/IP communication. I finally STOPPED the attachment service, opened a command prompt and issued:

netstat -ano |find /i “Listening”

Even though the Attachment server runs on 1900, 1999, and 2000 (I could be wrong if it’s those specific ones), but even after stopping the service I noticed that there was still something listening on 2000. I used the PID issued by the -o switch on netstat, opened task manager, showed all tasks from all users, and changed the view settings to show the PID column.

BAM! Turns out some other piece of software was listening on 2000. Go Figure!

To Resolve this:

1) Log on to the BlackBerry Administrative Web Site

2) Under “Servers and components”, except the Solution topology, expand Domain, Server View, Server_Name, and select “Server_Name_AS_11”

3) Select “Edit Instance”, and then proceed to change the port (in my case, 2000 was conflicting, so I changed 2000, to 2001).

4) Restart the server!

You’re now good to go!

Install Exchange 2007 SP2 on SBS 2008

Exchange Server, Small Business Server No Responses »

Aug 312010

For those of you who have tried installing Exchange SP2 on SBS 2008 but have had it fail during its initial steps, this blog post is for you!

Microsoft has created a tool that you can download and install which permits you to install Exchange SP2 on SBS 2008.

For more information on the procedure and to download the tool please see:

http://support.microsoft.com/kb/974271/

I cannot stress enough on the importance of a backup in case things go wrong. I have performed this at numerous client locations, most successful; however in one instance while SP2 was installing, the update failed and totally removed Exchange from SBS 2008. This was unrecoverable and a full restore from a backup would have been needed (thankfully this was the configuration of a new server so we just restarted the implementation).

How to extract your domain certificate to use Exchange ActiveSync on your Windows Mobile Device

Exchange Server, Windows Mobile No Responses »

Aug 202010

If you’ve tried configuring your Windows Mobile device to connect to your exchange server, but have been receiving errors on the lack of a certificate issue, this may help.

Keep in mind it’s always best to contact your local IT department to find out if they have an easier way of doing this, or a better way.

If your desktop computer at work is joined to the domain, chances are you have a certificate installed that authenticates various systems on your network. By extracting this certificate and installing it on your Windows Mobile device, chances are this will solve your issues.

Keep in mind that if your IT department did not generate your Exchange SSL cert from the domain certificate authority this won’t work.

Now let’s get started…

Open Internet Explorer
Press the “Alt” button to expose the menu
Select “Tools” then “Internet Options”
Select the “Content Tab”, and hit the “Certificates” button.
Select the “Trusted Root Certification Authorities”.
Now look through the list and look for something that may contain your Company’s name in it, or the name of one of your network servers.
Once you find this, click once to highlight, and select the “Export” button.
Go through the wizard and leave all defaults. At the very end where it asks you to choose a file, save it on your desktop and call it “cert.cer”.
Copy this file to your Windows Mobile Device (using a Memory Card, or a Sync function).
On your Windows Mobile device, use the File Explorer to browse to the location where you saved your cert.cer file, and select it to run. It should say “You have successfully installed a certificate”.

Now go ahead and configure your Exchange account and chances are it should work!

Keep in mind that some carriers lock down devices to avoid the installation of untrusted certificates. I haven’t run in to this issue, but I have heard about it happening. If this is the case, you will need to do some research on your phone and find a way to bypass this security block.

Newer Entries