RE: question about monitoring Exchange throttling.
Our goal was to proactively find users hitting the limits. Goal one would be to proactively help users hitting the limits to refine their email sending processes Orgrant them an exception to the throttling. The other goal would be to possibly help determine if an account could possibly be compromised. Thanks Kevin From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Wednesday, November 07, 2012 5:46 PM To: MS-Exchange Admin Issues Subject: RE: question about monitoring Exchange throttling. Huh. I've never seen a request like yours before. Have you looked at PromoDag? From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Wednesday, November 7, 2012 9:48 AM To: MS-Exchange Admin Issues Subject: question about monitoring Exchange throttling. Hi: We've recently implemented throttling at various parts of our email system, adding a per user limit for a max number of recipients per message, a limit for number of emails per minute you can submit, and a max number of recipients per day that you can send to. We can find out who is sending to the max recipients per message via the message tracking logs, but so far we haven't been able to determine how to find the users who are attempting to exceed the number of messages submitted per minute and the maximum daily limit of number of recipients. To get an estimate of total recipients I've been doing a powershell query of the tracking logs, dumping all the mailbox totals, then doing some massaging of the data in Excel. It gives you an idea of who might be hitting the recipient limit in 24 hours, but it would be nice if Exchange had a way to informing you. I tried turning up logging on our test system to see if it would spit out an error when a limit was hit by a user, but either it doesn't or I'm turning the wrong dial. How are others monitoring throttling? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: EXCHANGE 2010 SP1 upgrade to EXCHANGE 2010 SP2 rollup4.
Hi: We've got similar server hardware to yours in a 2 node DAG (MB role only) and did this exact process a few months ago. I believe the entire process for each node was just over the hour mark for each one. Kevin From: xyz [mailto:x...@minneapolis.edu] Sent: Thursday, November 01, 2012 7:56 PM To: MS-Exchange Admin Issues Subject: EXCHANGE 2010 SP1 upgrade to EXCHANGE 2010 SP2 rollup4. Greetings, We have a simple Two node DAG running W2K8 R2 SP1 and EXCHANGE 2010 SP1 rollup 4.3 and both are on strong HP G7 physical boxes with dual 6 core processors with 48 GIG RAM, so plenty of horsepower. We plan to upgrade each host to EXCHANGE 2010 SP2 and rollup 4 next week. One vendor I checked with indicates that each host will take up to 3 hours to upgrade so we should plan for a six hour project. That seems a bit high, but not sure. Does anyone have experience as to how long this upgrade will take with each host? Any other issues we should be aware of before we start this project upgrade? Thanks for any input. Dana --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: customize columns in GAL
When you click the TO: button...the global address list for the organization. I'm wondering about removing unpopulated columns. From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Thursday, June 28, 2012 7:04 PM To: MS-Exchange Admin Issues Subject: RE: customize columns in GAL What, specially, do you mean when you say the GAL? From: Sharp, Kevin [mailto:kevin.sh...@usask.ca]mailto:[mailto:kevin.sh...@usask.ca] Sent: Thursday, June 28, 2012 8:08 PM To: MS-Exchange Admin Issues Subject: customize columns in GAL Is there any way to remove fields/columns that you aren't using from the GAL.. Example the title field? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: internal spam
The accounts have been compromised…usually via a phishing attempt. So the entire process of the internal attack is with a valid authenticated acct. We have our SMTP services set to be authenticated…the problem is looking for a process that we can use to identify potential accounts that are sending volumes of email and hopefully stop it before the pile of email gets too large. Usually the attack sends thousands of email to valid and nonvalid email addresses…which of course we don’t notice until the pile of invalid email starts to pile up. I know..it is comical ☺. User education has helped, but like any good phishing attack, it only takes one bite to cause this problem. Thanks Kevin From: Mike Tavares [mailto:miketava...@comcast.net] Sent: Friday, February 24, 2012 4:26 PM To: MS-Exchange Admin Issues Subject: Re: internal spam 1 question just to clear up some confusion on my part. Are the actual accounts in question compromised? (as in someone has direct access to the mailboxes on your server?) or just compromised in the since that some spammer/hacker on the outside is spoofing an email address from your company that is a legit address? From: Sharp, Kevinmailto:kevin.sh...@usask.ca Sent: Friday, February 24, 2012 12:19 PM To: MS-Exchange Admin Issuesmailto:exchangelist@lyris.sunbelt-software.com Subject: internal spam I’m wondering how people are dealing with compromised accounts in Exchange sending large volumes of email…essentially an internal spam attack. Occasionally a phishing attempt will make it past our spam software, and of course the odd unsuspecting user ends up with a compromised account which makes a connection to the mail system via either a compromised PC or external connection. We notice this when the email starts piling up, and action can be taken then..but I’m wondering if there is some software or method that might have some more smarts. We’ve had numerous incidents but so far….not an easy way to distinguish a potential spam attack until after it happens, and the email starts piling up in the retry queue. I’ve looked at throttling policies and some of the transport filtering, not sure if that will help us much. What are others doing? Thanks Kevin Sharp --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: i-pod and i-phone weirdness
As an addendum to this problem, removing the device via OWA does not always fix the issue. The device does not show up when running the activesyncdevicestatistics command either. It is like the user is stuck in limbo on a single device. Kevin From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Thursday, August 11, 2011 2:58 PM To: MS-Exchange Admin Issues Subject: i-pod and i-phone weirdness Hi: Following a migration from 2007 to 2010, we are getting periodic reports of i-devices (phones, pods, and pads) not being able to get email via activesync...they just quit working. (they worked after the migration). The user can use another i-device to connect, other people can use the failing i-device to connect to their email accounts via activesync, but the original user cannot connect to their account using activesync on the failing device. Removing the device from OWA's mobile configuration seems to fix it, but I'm wondering what the road block might be. Any ideas? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
Exchange SSL offloading
Hi: I'm wondering if anyone would like to share their words of wisdom of using SSL Offloading with Exchange 2007 and 2010 using a cisco content switch nlb device. Our current configuration is two exchange 2007 cas/hubs with legacyname.domain.ca and two exchange 2010 cas/hubs with the primaryname.domain.ca. Using IP stickiness everything appears to work properly, redirection works. However...we've had to enable SSL offloading on the cisco side to implement a SSO from a web application. Now we're using https to the content switch, and http:// to the cas/hub servers (on the 2010 side only). We're doing a cookie insert on traffic from the application, and if the traffic is outlook anywhere, it is in theory supposed to use ip stickiness. When I go to test this...Office 2010 appears to be able to connect via outlook anywhere , but outlook 2007 and 2003 prompt for a password. SSO works , OWA works, client access array works, but outlook anywhere doesn't appear to work. We're currently testing with a wildcard certificate. *.domain.ca .The wildcard cert worked before enabling the SSL offloading, so at this point I'm not sure if this is a configuration issue on the content switch or a certificate issue? Thoughts? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: Exchange SSL offloading
Name Server CertPrincipalNameTTL -- ---- EXCH 1 EXPR 1 WEB 1 Not sure what I should be seeing here? If I do a | fl, I can see each of the EXCH, EXPR, and WEB values. DistinguishedName: CN=EXCH,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Organization Name,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=test,DC=domain,DC=ca -Original Message- From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Wednesday, June 22, 2011 4:31 PM To: MS-Exchange Admin Issues Subject: RE: Exchange SSL offloading What does get-outlookprovider say? Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -Original Message- From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Wednesday, June 22, 2011 6:09 PM To: MS-Exchange Admin Issues Subject: Exchange SSL offloading Hi: I'm wondering if anyone would like to share their words of wisdom of using SSL Offloading with Exchange 2007 and 2010 using a cisco content switch nlb device. Our current configuration is two exchange 2007 cas/hubs with legacyname.domain.ca and two exchange 2010 cas/hubs with the primaryname.domain.ca. Using IP stickiness everything appears to work properly, redirection works. However...we've had to enable SSL offloading on the cisco side to implement a SSO from a web application. Now we're using https to the content switch, and http:// to the cas/hub servers (on the 2010 side only). We're doing a cookie insert on traffic from the application, and if the traffic is outlook anywhere, it is in theory supposed to use ip stickiness. When I go to test this...Office 2010 appears to be able to connect via outlook anywhere , but outlook 2007 and 2003 prompt for a password. SSO works , OWA works, client access array works, but outlook anywhere doesn't appear to work. We're currently testing with a wildcard certificate. *.domain.ca .The wildcard cert worked before enabling the SSL offloading, so at this point I'm not sure if this is a configuration issue on the content switch or a certificate issue? Thoughts? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: question regarding autodiscover
Just got the 2010 environment up, so all users are still on 2007, so preferably they keep using the 2007 cas/hubs while I work on the 2010 servers. Thanks kevin -Original Message- From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Tuesday, June 21, 2011 11:03 AM To: MS-Exchange Admin Issues Subject: RE: question regarding autodiscover What do you want them to pick up? Please explain your topology a little. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -Original Message- From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Tuesday, June 21, 2011 12:57 PM To: MS-Exchange Admin Issues Subject: question regarding autodiscover A question about autodiscover If you are in a scenario where you are in an upgrade scenario...and some users are picking up the exchange 2010 servers CAS/HUBs from the autodiscover SCP from ADis there a way to prevent this? Is this controlled by autodiscoverserviceinternaluri? Thanks kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
tracking offending spam machines
Hi: If a machine gets infected and sends email as an authenticated exchange user, is there an easy way to identify where the offending machine is? Back in Exchange 2003 you could identify the Exchange version, client IP, etc. of connections but I've never found a way to do this with message tracking on exchange 2007 or 2010. Ideally if we know whose account has been compromised, is there a way to determine where the email was sent from if they are using an outlook client? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: How fragmentation on incorrectly formatted NTFS volumes affects Exchange
I've read this post which reinforced my thought that we have to 64K allocation unit size. I remember using disk utilities years ago to do a partition alignment.Is there any need to for this under Exchange 2010 or is a simple format with 64K good enough? Thanks Kevin -Original Message- From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Friday, February 11, 2011 5:23 PM To: MS-Exchange Admin Issues Subject: How fragmentation on incorrectly formatted NTFS volumes affects Exchange A very technical but very informative post by escalation engineer Mike Lagase. http://blogs.technet.com/b/mikelag/archive/2011/02/09/how-fragmentation-on-incorrectly-formatted-ntfs-volumes-affects-exchange.aspx I will be blogging this (with my elucidatory comments and opinions) later, but it's a great read. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: how to hide things in OWA
I realize segmentation is the answer (should have mentioned that)I'm not clear which setting (if any) can hide the account editing piece. City, Address, Phone number Thanks Kevin From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Wednesday, June 01, 2011 5:32 PM To: MS-Exchange Admin Issues Subject: RE: how to hide things in OWA OWA Segmentation. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Wednesday, June 01, 2011 7:26 PM To: MS-Exchange Admin Issues Subject: how to hide things in OWA If I wanted to hide the Account editing components in OWA 2010...what is the easiest way to do this? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
RE: how to hide things in OWA
If anyone else if looking for this option, it is located in Default Role Assignment Policy. This will allow you to disable editing account information via OWA. So some things for OWA are controlled there, others via the OWA segmentation option. Kevin From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Thursday, June 02, 2011 12:01 AM To: MS-Exchange Admin Issues Subject: RE: how to hide things in OWA I realize segmentation is the answer (should have mentioned that)I'm not clear which setting (if any) can hide the account editing piece. City, Address, Phone number Thanks Kevin From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Wednesday, June 01, 2011 5:32 PM To: MS-Exchange Admin Issues Subject: RE: how to hide things in OWA OWA Segmentation. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Sharp, Kevin [mailto:kevin.sh...@usask.ca] Sent: Wednesday, June 01, 2011 7:26 PM To: MS-Exchange Admin Issues Subject: how to hide things in OWA If I wanted to hide the Account editing components in OWA 2010...what is the easiest way to do this? Thanks Kevin --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
