Howto: Allow Mailbox Access on Exchange 2007

Given our company structure I frequently have to allow User A to read or send as User B. This task is simple enough with the Exchange Management Shell (EMS) but does require two separate commands.

The first command here allows full access to the mailbox:
Add-MailboxPermission "FirstName LastName" -User "UserName" -AccessRights FullAccess
The FrirstName LastName is the mailbox that you are adding permissions to. The Username is the user that will have the permissions that you are adding.

The second command you will need to run is only necessary if you need to send email as that user.
Add-ADPermission -Identity "FirstName LastName" -User "UserName" -ExtendedRights Send-As
Once again the FirstName LastName should be the mailbox that you are adding permissions to and the UserName is the user that will have the permissions you are adding.

Based on how often I have to do this I really need to write a quick little application that will allow me to add these permissions with ease instead of having to type out the commands every time. I will keep you updated if I do.

*You have to have Exchange Organization Administrator role privileges on the Exchange server to make these changes.

Look How Easy Setup Is for Microsoft Exchange 2007

For anyone trying to setup Microsoft Exchange 2007 or thinking about it, or just curious about it. This is a good read for the first timers and even the veterans System Administrators among us.

Microsoft Exchange 2007 Catchall Agent

For those of you looking to implement a Catchall agent in Microsoft Exchange 2007 I finally have an answer for you! CatchAllAgent Exchange2007 Transport Protocol Agent does everything I needed it to do. It can handle multiple domains and supports standard .Net tracing for troubleshooting. Granted I didn't write it but it is simple to set up and configure.

The download is not as straight forward as I would have liked (multiple files vs. a Zip file) but the instructions are clear and consise for installation. The bare minimum you need to download is the CatchAllAgent.dll, config.xml, and Readme.txt. The author has included the source code for the CatchAllAgent incase you want to see how it works or if you have enhancements to make. The one issue I had with installation was due to me not reading ALL of the instructions and missing a step ([PS] C:\catchallagent>enable-transportagent "CatchAll Agent").

There are many reasons to NOT have a catchall agent setup. For one you open yourself up to a Denial of Service attack because all email will now be accepted for your domain, which may also lead to the servers storage being filled. But when the CIO and CEO both say we NEED a catchall I fulfill their request and warn them of the dangers. Hopefully I never have to say "I told you so!"

Testing Outlook Web Access from the PowerShell

As any of my readers know I check things on a daily basis, typically in the morning. As part of these checks I fire up Internet Explorer 7 and go to our Outlook Web Access page and log in.

Today I figured out how to do all of this from a PowerShell, which has already cut my daily monitoring duties down about 90%. This is a pretty simple oneliner that will test one OWA url. It does however require you to enter a password in a dialog box.

Test-OWAConnectivity -url https://mail.yourdomain.com/owa -mailboxcredentials:)Get-Credential domail\user)

After you run that it will ask you for the password of the user and report back success or failure.

Using the Powershell to check for mounted mailbox databases

If you want to quickly check to see what mailbox databases are mounted (or not mounted) there is a simple command that you can run from the Exchange Management Shell.

Get-Mailboxdatabase -status | where {$_.Mounted -eq $true}

To see what mailboxdatabaes are not mounted you can do:
Get-Mailboxdatabase -status | where {$_.Mounted -eq $false}

Let's break down what is going on here.
Get-MailboxDatabase will generally just return the list of mailbox databases in the organization.
The -Status switch will tell the command to get the status (Mounted, Last Full backup, et cetera).
We then pipe this into the where command to do the searching. The variable we are looking for here is Mounted and we need it to be equal (-eq) to True ($true).

552 5.3.4 Message size exceeds fixed maximum message size

If you are running Exchange 2007 and you are getting the above error message from users outside your organization there is a very simple fix.

Set-ReceiveConnector -identity "Default [SERVERNAME]" -maxmessagesize 20MB

That will double your receive limit from the internet. Now if you want to go bigger you could do:
Set-ReceiveConnector -identity "Default [SERVERNAME]" -maxmessagesize 1GB
but that is not recommened at all.
The available options for the size are: B (bytes), KB (kilobytes), MB (megabytes), & GB (gigabytes). The maximum you can do is 2GB and any unqualified sizes are treated as bytes.

If there are other options you want to change with your Receive Connectors check out Set-ReceiveConnector on TechNet.

Microsoft Exchange 2007 Distribution Group Security

Today I found out that Distribution Groups within Microsoft Exchange 2007 have security placed on them that requires users to authenticate when sending emails to them. I understand having this feature, but I would argue against it being on by default.
With this setting on users outside your company cannot email to the distribution group. For some of my groups this is what I want. But for specific groups I want people outside my enterprise to be able to send them email.

To change this setting open up the "Exchange System Console" and go to the Recipient Configuration, Distribution Group. Then right click on the distribution group you wish to edit and choose properties. Next click the "Mail Flow Settings" tab and select the "Message Delivery Restrictions" and then hit the "Properites" button. On the "Message Delivery Restrictions" screen uncheck the "Require that all senders are authenticated" option and you will be all set.

To do all of the above from the "Exchange Management Shell" you can use the one-liner below.
Set-DistributionGroup -identity "DisplayNameOfDistributionGroup" -RequireSenderAuthenticationEnabled $False
It's really that easy.

When I first got my hands on Microsoft Exchange 2007 I did not like the idea of doing alot of things by the command line, but as time goes on I have found out that the Management Shell is a very powerful tool that every Exchange admin should learn how to use and fall in love with.

How to: Verify nessesary Microsoft Exchange services are running

Every monrning as part of my daily routine I check to make sure all the nessesary services are running for Microsoft Exchange 2007 to run properly and respond to client requests. In the past I have been opening the Services.msc and visually verifying that all of the services are indeed running. But today while I was looking over the list of CMDLETS I found my time saver, Test-ServiceHealth.
This command will test all of the services that should be running and report back what is and is not running. Since I keep the Exchange Management Shell open at all times I can quickly type this command and verify that way that everything is running as normal.

Complete List of Microsoft Exchange 2007 CMDLETS

Microsoft has a complete list of cmdlets you can use in the Exchange Management Shell. This list has come in handy when attempting to do something for the first time and not too sure where to start.

I would suggest anyone running Microsoft Exchange 2007 add this link to their favorites as it comes in handy often. Also if you are running OpenDNS on your network you could setup a OpenDNS shortcut to make it even easier!