Microsoft Windows

May 8 2008   5:49AM GMT

Microsoft Exchange Edge Subscription Process

Posted by: John Bostock
Exchange, ADAM, Microsoft Edge Subscription Process, Edge Transport, Edge Transport Agents, Exchange front-end back-end, Exchange Roles, Exchange Server Roles 2007, Edge Transport Server Role

This post provides information about Edge Subscriptions and the EdgeSync synchronization process. Edge Subscriptions are used to populate the Active Directory Application Mode (ADAM) directory service instance on the Microsoft Exchange Server 2007 Edge Transport server role with Active Directory directory service data.

If you have been following these posts you will see from this extract that ADAM has a role.

The computer that has the Edge Transport server role installed doesn’t have access to the Active Directory directory service. All configuration and recipient information is stored in the Active Directory Application Mode (ADAM) directory service

The Edge Subscription Process

Creating an Edge Subscription establishes secure, automatic replication of information from Active Directory to ADAM. The Edge Subscription process provisions the credentials that are used to establish a secure Lightweight Directory Access Protocol (LDAP) connection between Hub Transport servers and a subscribed Edge Transport server. The Microsoft Exchange EdgeSync service that runs on Hub Transport servers then performs periodic one-way synchronization to transfer data to ADAM and keep that data up to date. This process reduces the administration that you must perform in the perimeter network by letting you perform required configuration on the Hub Transport server role and then write that information to the Edge Transport server.

You subscribe an Edge Transport server to an Active Directory site. Subscribing the Edge Transport server to the Active Directory site enables the Edge Transport server to receive updates to ADAM from Active Directory and creates a synchronization relationship between the Edge Transport server and the Hub Transport servers deployed in that site. The Edge Subscription process also creates an Active Directory site membership affiliation for the Edge Transport server. The site affiliation enables Hub Transport servers in the Exchange organization to relay messages to the Edge Transport server for delivery to the Internet without having to configure explicit Send connectors.

One or more Edge Transport servers can be subscribed to a single Active Directory site. However, an Edge Transport server cannot be subscribed to more than one Active Directory site. If you have more than one Edge Transport server deployed, each server can be subscribed to a different Active Directory site. Each Edge Transport server requires an individual Edge Subscription. A subscribed Edge Transport server can support only one Exchange organization.

In my next post I’ll talk about the process itself..

Dec 16 2007   10:16AM GMT

Message tracking event IDs in Exchange Server 2003

Posted by: John Bostock
Exchange Tracking Center, Exchange, Outlook, OWA, Microsoft Windows, Windows Computing, Mailboxes, Message logging, Message tracing

Here are some of the event IDs that are logged to message tracking log files. You can enable message tracking logs to track or to troubleshoot the flow or status of a message in Exchange Server 2003 as shown in previous blog. You can record information about the sender, the message, and the recipient. If you want to log more detailed information, you can also record the subject line of messages.

By default, the tracking logs are located in the C:\Program Files\Exchsrvr\YourServerName.log folder. Each daily log is named in the yyyymmdd.log format according to the date that the log was created. The file name date is in Coordinated Universal Time (UTC). Here is a list of event ID’s and there meaning. You can import this log file into Excel which makes it easier to read as opening the text file is too busy.

A few FAQ’s
Q1: When a message is generated in the system for the first time, what event is associated with that message in the tracking log?
A1: There are different events for different message submission paths to Exchange Server 2003. For example, for messages that are submitted through the SMTP component, the first event ID in the tracking log is 1019. For messages that are submitted through the Store component, the first event ID in the tracking log is 1027.
Q2: Is there one event ID that covers the creation of all messages and that only appears one time per message?
A2: There is no one event that covers the creation of all messages because messages can be created in various ways by various clients, remote servers, and pickup directory. It would make no sense to use the same event for all these code paths. Or, it would be impossible to use the same event for all these code paths. However, event 1019 is logged when any message enters Inetinfo-side transport processing. The tracking log may frequently contain multiple 1019 events that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected behavior.
Q3: Why are there multiple 1020 and 1031 events that are logged for the same message ID?
A3: This is expected behavior. The same message ID can be transferred out multiple times. When the same message ID is transferred out multiple times, events 1020 and 1031 are generated.

Event Number	Event Type	Description
0	Message transfer in	The message was received from a server, a connector, or a gateway.
1	Probe transfer in	An X.400 probe was received from a gateway, a link, or a message transfer agent (MTA).
2	Report transfer in	A delivery receipt or a non-delivery report (NDR) was received from a server, a connector, or a gateway.
4	Message submission	The message was sent by the client.
5	Probe submission	An X.400 probe was received from a user.
6	Probe transfer out	An X.400 probe was sent to a gateway, a link, or an MTA.
7	Message transfer out	The message was sent to a server, a connector, or a gateway.
8	Report transfer out	A delivery receipt or an NDR was sent to a server, a connector, or a gateway.
9	Message delivered	The message was delivered to a mailbox or a public folder.
10	Report delivered	A delivery receipt or an NDR was delivered to a mailbox.
18	StartAssocByMTSUser
23	ReleaseAssocByMTSUse
28	Message redirected	The message was sent to mailboxes other than the mailboxes of the recipients.
29	Message rerouted	The message was routed to an alternative path.
31	Downgrading	An X.400 message was downgraded to 1984 format before relay.
33	Report absorption	The number of delivery receipts or of NDRs exceeded a threshold and the reports were deleted.
34	Report generation	A delivery receipt or an NDR was created.
43	Unroutable report discarded	A delivery receipt or an NDR could not be routed and was deleted from the queue.
50	Gateway deleted message	The administrator deleted an X.400 message that was queued for a gateway.
51	Gateway deleted probe	The administrator deleted an X.400 probe that was queued for a gateway.
52	Gateway deleted report	The administrator deleted an X.400 report that was queued for a gateway.
1000	Local delivery	The sender and the recipient are on the same server.
1001	Backbone transfer in	Mail was received from another MAPI system across a connector or across a gateway.
1002	Backbone transfer out	Mail was sent to another MAPI system across a connector or across a gateway.
1003	Gateway transfer out	The message was sent through a gateway.
1004	Gateway transfer in	The message was received from a gateway.
1005	Gateway report transfer in	A delivery receipt or an NDR was received from a gateway.
1006	Gateway report transfer out	A delivery receipt or an NDR was sent through a gateway.
1007	Gateway report generation	A gateway generated an NDR for a message.
1010	SMTP queued outbound	Outgoing mail was queued for delivery by the Internet Mail Service.
1011	SMTP transferred outbound	Outgoing mail was transferred to an Internet recipient.
1012	SMTP received inbound	Incoming mail was received from by the Internet Mail Service.
1013	SMTP transferred	Incoming mail that was received by the Internet Mail Service was transferred to the information store.
1014	SMTP message rerouted	An Internet message is being rerouted or forwarded to the correct location.
1015	SMTP report transferred In	A delivery receipt or an NDR was received by the Internet Mail Service
1016	SMTP report transferred out	A delivery receipt or an NDR was sent to the Internet Mail Service.
1017	SMTP report generated	A delivery receipt or an NDR was created.
1018	SMTP report absorbed	The receipt or the NDR could not be delivered and was absorbed. (You cannot send an NDR for an NDR.)
1019	SMTP submit message to AQ	A new message is submitted to Advanced Queuing.
1020	SMTP begin outbound transfer	A message is about to be sent over the wire by SMTP.
1021	SMTP bad mail	The message was transferred to the Badmail folder.
1022	SMTP AQ failure	A fatal Advanced Queuing error occurred. Information about the failure was written to the Event Manager.
1023	SMTP local delivery	A message was successfully delivered by a store drive (logged by Advanced Queue).
1024	SMTP submit message to cat	Advanced Queuing submitted a message to the categorizer.
1025	SMTP begin submit message	A new message was submitted to Advanced Queuing.
1026	SMTP AQ failed message	Advanced Queuing could not process the message. The message caused an NDR to be sent, or the message was put in the Badmail folder.
1027	SMTP submit message to SD	A message was submitted to the store driver by the MTA.
1028	SMTP SD local delivery	The store driver successfully delivered a message (logged by store driver).
1029	SMTP SD gateway delivery	The store driver transferred the message to the MTA.
1030	SMTP NDR all	All recipients were sent an NDR.
1031	SMTP end outbound transfer	The outgoing message was successfully transferred.
1032	SMTP message scheduled to retry categorization
1033	SMTP message categorized and queued for routing
1034	SMTP message routed and queued for remote delivery
1035	SMTP message scheduled to retry routing
1036	SMTP message queued for local delivery
1037	SMTP message scheduled to retry local delivery
1038	SMTP message routed and queued for gateway delivery
1039	SMTP message deleted by Intelligent Message Filtering
1040	SMTP message rejected by Intelligent Message Filtering
1041	SMTP message archived by Intelligent Message Filtering
1042	Message redirected to the alternate recipient

Dec 14 2007   7:24AM GMT

Exchange Message Tracking - A Great Tool!!

Posted by: John Bostock
Message tracing, Exchange Tracking Center, Message logging, ESM (Exchange System Manager), Exchange, Microsoft Windows, Mobile

Exchange has a great feature called message tracking that enables you to track messages. It works for both directions inbound/outbound – it also does internal messages. This function has a low overhead so I leave it enabled so I can get my hands on the info when I want,  although I do have a large amount of emails that pass through my organization on a daily basis so I set log removal to be low.

—————————————————————————————————————————————————————–

Here is the scenario. Your Boss calls at the wrong moment as per usual raving about a SUPER important email message that never got delivered. So what do you do? This is when you need to know how to use Message Tracking so let’s have a look at how.

How to Enable

1.       Open ESM go to servers
2.       Right click on the server and choose properties
3.       Select these options “enable subject logging and display” “enable message tracking”
4.       “Remove log files” This option set to 30 days which is long enough. If you have massive traffic consider lower times say 7-10 days.
5.       Also check out the location of the log files. Keep them away from the main store on a separate drive if possible.

Now mine looks slightly different because I do mine through a server policy as I have multiple Exchange servers. Although greyed out you can see the ticks and where I store them.

Now let’s look at Tracking Messages.

Once tracking has been running for a while you will have collected some information, then we can track messages. Let’s look at how

1.       Open ESM and then go to tools
2.       Scroll down to Message Tracking Center
3.       Choose the server you want to track the message from. This of course will be the server that the user has his or her mailbox on, depending on whether you want to track inbound or outbound messages.

At this point we can search even though nothing else is configured. But this will result in heaps of results up to a max of 1000 every message since midnight will be processed. Best case - use the other fields to narrow the search results. Once the system finds the message you can double click it which will show what exchange did with the message.

Tracking log files will be stored (by default) in a folder located at x:\Program Files\Exchsrvr\servername.log, where x is the volume you have installed Exchange Server onto. Inside this folder you will find a text file for each day that logs are being retained for. You can open these files and work from them if you want, but I would recommend doing it in Excel as the files are tab-delimited and very hard to sort through otherwise.  

Ok so we have a great way of searching and finding out what has happened with an email. Now that’s it but we can advance things a bit by utilizing third party tools and REALLY bringing Message Tracking ALIVE.

Check out these links for advanced use of Message Tracking. If you search the web you will find various software, some users have created scripts to work with these logs - Just make sure you test them and not in your live enviroment

Exchange Log Analyzer    Promodag Now This is great software

 

Dec 13 2007   11:54AM GMT

Uninstall Exchange Server 2003

Posted by: John Bostock
Exchange, Outlook, OWA, Bridgehead Server, Routing Groups, RUS, Mailboxes, Exchange databases, Transaction logs, Information Store, Public folders

Firstly I need to apologize for the delay between posts, I have been attending to some business which kept me away and will acknowledge next time should I expect a large gap again.I’m going to get straight into the correct way to uninstall Exchange 2003 from a server. I have a systems Administrator who has this task in hand and I’ve done this for him and others.
Let’s do it!

You must ensure you meet the prerequisites before you attempt this and they are as follows:

• If you have Exchange Full Administrator permissions at the administrative group level, you can uninstall Exchange Server 2003, provided that you have permissions for the administrative group to which the server belongs.

• If there are any mailboxes assigned to a storage group on a server, you cannot uninstall Exchange Server 2003 from that server. In this case, you must either move or delete the mailboxes before you can uninstall Exchange.

• You cannot uninstall Exchange Server 2003 from a server if it is the only server in your organization running the Recipient Update Service. Instead, you must first use Exchange System Manager to enable the Recipient Update Service on another server.

• You cannot uninstall Exchange Server 2003 from a server if it is the only server in a mixed administrative group that is running Site Replication Service (SRS). Instead, you must first enable SRS on another Exchange server.

• You cannot uninstall Exchange Server 2003 from a server if it is a bridgehead server for a connector and there are other Exchange servers in your organization. Instead, you must first designate a new bridgehead server.

• You cannot uninstall Exchange Server 2003 from a server if it is the routing master and there are other Exchange servers in your organization. Instead, you must first designate a new routing master.

Now before you remove the server from a production environment that has multiple servers in the administrative group, understand that you need to know all the servers roles that are held by this machine. Make sure you move your roles to other machines. Example: If the server is listed as a bridgehead server on a connector you will have to move this before uninstall will work. Failure to do this could cause many things including the following:

• Mail flow may stop if the server is a bridgehead server.

• Mail flow will be totally screwed if the server is the routing group master.

• Outlook issue and OWA issues so confirm and check before attempting the uninstall.

Before you remove Exchange 2003, you must disconnect all mailbox-enabled users from the mailboxes on the Exchange server. It is not possible to remove an Exchange Server when it has mounted mailboxes. If you are getting this error check out the following “One or more users currently use this mailbox store. These users must be moved to a different mailbox store or be mail disabled before deleting this store”A good way to try to find these missing users is to use Active Directory Users and Computers. Here’s what to do:

1. Run ADUC.(Active Directory Users and computers – come on!)

2. Right-click your domain at the top, and choose Find.

3. Click the Advanced tab, and then choose User from the Field button.

4. From the list of attributes displayed, choose Exchange Home Server.

5. Set the Condition field to Ends With and then type your Exchange server name into the Value field. Click Add to add this value.

6. Now click the Find button, and hopefully you’ll see the troublesome user listed in the results window.

You should then be able to remove the Exchange attributes from these user accounts and proceed with the un install.

To uninstall Exchange Server 2003

1. Log on to the server from which you want to uninstall Exchange.
2. Click Start, point to Control Panel, and then click Add or Remove Programs.
3. In Add or Remove Programs, select Microsoft Exchange, and then click Change/Remove.
4. On the Welcome to the Microsoft Exchange Installation Wizard page, click Next.
5. On the Component Selection page, in the Action column, use the drop-down arrows to select Remove, and then click Next.

Follow the bouncing ball and Exchange should uninstall.