Exchange Migration - Correcting IMAP folders

Following a legacy migration from an old email server I found that users had difficulty with particular folders that were migrated over displaying their correct contents in Outlook. If the user opened the folder in OWA they had no issue.

The cause of this behaviour is due to the folder type being set as an IMAP folder in Exchange. To correct this issue simply follow the below procedure (as always after making the required backups):

Download and Install ExFolders:

1. Confirm you are running at least SP1 for Exchange 2010
2. Download ExFolders for Exchange 2010 (SP1+) from http://gallery.technet.microsoft.com/Exchange-2010-SP1-ExFolders-e6bfd405
3. Install the ExFolders utility by running the registry file contained within the ZIP and copying the ExFolders.exe file to the Exchange bin directory

Run the ExFolders utility:

1. Run the ExFolders.exe file
2. Click on File - Connect
3. Connection Type should be set to Mailboxes and Connect by set to Database
4. Click on the Select button next to the "Global Catalog" section. Enter a DC running the global catalog role
5. Click on Select next to the "Database(s)" section and select the required exchange database
6. Click OK, at this point you should see a list of mailboxes contained within the database(s) you selected from the previous step
7. To run modifications for all mailboxes simply highlight the Mailboxes root, otherwise highlight the user mailbox you wish to update
8. To enable logging for troubleshooting purposes click on Tools, Options and enable both the "Enable logging to file" and "Enable extended logging" then click OK
9. Click on Tools - Custom Bulk Operation then paste in the following into the Overall Filter section : (&(0x3613001E=IPF.Imap))
10. Now click on the Add button and on select "Other folder properties" on the Operation Type prompt
11. Click on the Property drop down list and select "PR_CONTAINER_CLASS : 0x3613001E"
12. Enter the following into the Value field : IPF.Note and click on the Add button
13. Click OK and OK again
14. The update process will now run, correcting all IPF.Imap folders contained within the selected Database / Mailbox to the standard IPF.Note format

Note that it can take a few minutes for Outlook to update the folder type information.

I hope this helps you out.

System Center 2012 SP1 RTM

System Center 2012 SP1 has been officially hit RTM status and been released to Microsoft VLC customers.

If you havent been planning your upgrade already then you might want to review the list of improvements and additional features included in the new release, these include DPM's ability to back up data de-dupe volumes from Windows 2012, support for Windows 8 / 2012 in SCCM and Azure support in DPM/SCOM.

Kevin Greene (SCOM MVP) has a good article on the upgrade process for SCOM 2012 -
Part 1 : http://kevingreeneitblog.blogspot.ie/2012/12/scom-2012-installing-service-pack-1-rtm.html
Part 2 : http://kevingreeneitblog.blogspot.ie/2013/01/scom-2012-installing-service-pack-1-rtm.html
Part 3 : http://kevingreeneitblog.blogspot.ie/2013/01/scom-2012-installing-service-pack-1-rtm_2.html

I will be running through the SCCM and DPM upgrades on a later post.

Reset Microsoft Surface tablet to factory settings

My manager recently purchased two Microsoft surface tablets in the states and of course deployed one of these units to the MD, no big deal I thought (for testing purposes). However connecting it to our exchange server required a password change and this is where the fun began.

Following a successful password change, the password was subsequently forgotten (it happens to us all) and access to the Surface unit was locked. After a quick search in Google I found a link to a TechNet article (http://technet.microsoft.com/en-us/library/ee692045(v=surface.10).aspx) that provides step by step instructions to reset a Surface unit back to Windows Vista factory settings - oh dear god no.

Now for the correct way to reset the tablet in this event:

1. Boot the Surface tablet to the Windows 8 logon screen
2. With the keyboard left shift button held down tap the power icon and choose the restart option
3. A menu will appear with several options, pick the Troubleshoot option
4. Now you will be presented with options to wipe the device back to factory settings

SCOM Dashboard / Windows Auto Logon

I was recently requested to setup a SCOM dashboard which needed to be displayed in a public area of my office so employees and management could see live states of applications and our WAN infrastructure. 

Setting up the Visio web drawings was the easy part, linking them back to SCOM and setting various shades of green, amber and red for alerts etc. One thing that struck me though was the absence of TweakUI for the Windows 7 PC that would drive the dashboard screens, remember with the Microsoft TweakUI PowerToy you could very easily setup an auto logon account (obviously you need to ensure that the account is very restricted).

SysInternals offer their autologin utility (http://technet.microsoft.com/en-us/sysinternals/bb963905.aspx) but I wanted to have control over a number of machines across our network and the user / password combination for them.

Having prepared a new GPO which effectively turned the user accounts setup for the dashboard PC's into kiosks I stripped the additional registry keys that the autologin utility creates and added them into the group policy preferences/registry:

Keys required:

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName

With the new GPO supplied registry entries I can now specify targets for the DefaultPassword and DefaultUserName registry entries allowing me to control which user logs into which dashboard machine.

Another minor task made easier..

Software VSS Provider - DPM 2010/2012 Brick Level Backup

Even entry level SAN's today from vendors such as HP, Dell etc are offering hardware VSS software as standard, which is great for brick level backups of your Hyper-V virtual environment. 

But... What happens if you find yourself using a SAN without H/W snapshots or your financial director has locked away the key to the stationary room. The dilemma is then whether or not to go ahead and submit the proposal for the H/W snapshot licenses or use the build in software VSS provider in Windows.

It is at this stage you need to undertake a comprehensive review of the perils of using software VSS, these being the increased demands on your Hyper-V hosts, long backup times and the dreaded redirected I/O in a clustered environment.

Redirected I/O

When backing up CSV's you will need to rethink your VM placement, this is due to the fact that low level operations on CSV's in Windows 2008 R2 Hyper-V result in redirected I/O. This process locks the CSV for exclusive access by the CSV owner in order to take a consistent backup, the bad news is every other host in the cluster will need to read and write data over cluster communications network rather than the storage network.

When using H/W VSS providers the amount of time for redirected I/O to occur during a backup is limited to the time required to create the hardware snapshot (typically a couple of seconds), but when using a S/W VSS provider redirection will occur for the entire length of the backup. Obviously backing up large numbers of virtual machines during business hours becomes a non runner, however S/W VSS can be used to backup VM's as long as you plan your environment to suit the solution.

VM Placement

When planning to use the S/W VSS provider you need to consider a couple of key area's. As mentioned earlier you want to limit the amount of time you incur redirected I/O so you should setup protection groups by CSV rather than by logical groupings such as SQL servers for instance. VM's with VHD's on multiple CSV's are also going to be an issue as when a backup is called, every CSV which is associated with the VM will also go into redirected I/O mode.

Using manual migration or Systems Center Virtual Machine Manager you want to get to a point where by manageable quantities of virtual machines are located for your soon to be built brick level protection groups.

Serialisation - Backup Jobs

Once you have sorted out your CSV / VM placement design the next stage is to serialise backups by using registry entries and the DSConfig powershell script. This process ensures that DPM is made aware of virtual machine placement at a storage level and limits DPM as to how many VM's it can backup at a particular time.

Conclusion...

Once you plan your environment and follow the guidelines outlined (http://technet.microsoft.com/en-us/library/hh757922.aspx), using DPM for brick level backups with the software VSS provider can help you get to a good place with your entire virtual environment ready to restore in a click of a button.

Microsoft PKI Update - October Patch Tuesday

Patch Tuesday in October will present a new challenge to IT admins across the globe as Microsoft increase the minimum RSA key length supported by all operating systems going back as far as Windows XP SP3.

The new 1024 bit requirement has the potential to cause large scale issues if certs are not updated to reflect the new security requirements of the O/S. Be warned and read the below advisory in order to keep systems compliant.

Microsoft Customer Advisory : http://support.microsoft.com/kb/2661254
CAPI2 Logging Utility : http://support.microsoft.com/kb/2661254

The User Profile Service failed the logon. User profile cannot be loaded

During a recent deployment of Windows 7 Enterprise with SCCM I ran into a strange issue after adding the install updates into the task sequence. When the O/S loaded only users with administrative rights who had logged on to the machine previously (i.e. local admin in this case) could log on.

For all other users they received the following message:

 

"The User Profile Service service failed the logon"

Microsoft do have a KB on this issue (http://support.microsoft.com/kb/947215), however in my scenario the user profile didn't exist so the fixes did not apply.

Having looked at the logs it became apparent that files within the C:\Users\Default directories had altered security permissions following the Windows updates.

As a work around I added the following command line task to reset permissions to default on the C:\Users\Default directory.

 

Command : icacls C:\Users\Default\* /reset