Category Archives: Exchange 2010

OST sync with mailbox after restore

If we restore Exchange 2007 data from 2 weeks ago and bring it back online, will Outlook clients sync the previous 2 weeks of email from the OST back to the Exchange mailbox after its restored from backup?

I seem to see split opinions on this, and no documentation to support either claim if it will or will not.

We just tested.  Outlook did not sync the previous 2 weeks of emails as I had thought back with Exchange.  However those 2 weeks of emails did stay put in the users Outlook so far…

Manually Remove Symantec Mail Security for Exchange w/ Script

Removing Symantec Mail Security for Microsoft Exchange 6.5 (SMSMSE) for Microsoft Exchange 2010/2007 after Add or Remove Programs does not work
http://www.symantec.com/docs/TECH123582

Manual removal script for Symantec Mail Security for Exchange (SMSMSE) for all versions
http://www.symantec.com/docs/TECH214662

SMSMSE_Remover
removeSMSMSEmanual
manualSMSMSEscript

Scan to Email goes to Outlook Junk Filter

When scanning documents through a copier to email, the created emails with the PDF attachments are going to built-in Junk Folder.  On the Exchange server I ran the following command in the Exchange powershell Get-OrganizationConfig and look for SCLJunkThreshold  this should be set to higher the SCL value the scanned email is coming in as.

get-organizationconfig

 

The email’s in the Junk Folder had an SCL value of 5, so I ran the following command to change the SCLJunkThreshold.

Set-OrganizationConfig -SCLJunkThreshold 6

Run another Get-OrganizationConfig and confirm the changes took effect.

Blocking ZIP files with a Transport Rule

  1. Log into an Exchange 2010 server and navigate to Organization Configuration > Hub Transport > Transport Rules
  2. Right Click and select New Transport Rule, and name your rule. (add comments if necessary, and uncheck Enable Rule if you don’t want it enabled right away. Click Next
  3. Check the box “when any attachment file name matches text patterns”
  4. Click text patterns and add “.zip” without quotes, and click Add, OK, Click Next
  5. I also wanted to forward any blocked zip files to a specific mailbox I setup
  6. In the Actions screen, I selected “redirect the message to addresses”
  7. I clicked addresses and added the mailbox I just created
  8. Clicked Next as I did not want to create any exceptions at this time
  9. Clicked New to Create the Rule
  10. Next, go into Services on Exchange Hub Transport Server, and restart the Transport Service for changes to take effect, users will not notice anything, and mail flow will only be impacted for a few seconds.

Exchange 2010 Pages/sec Counter

I have been monitoring our Exchange servers on a daily basis for a few weeks, just making it part of my daily monitoring.  I have been using the Exchange Server Performance Monitor. On the Mailbox server I have noticed that the Pages/sec has been spiking quite a lot, up to 300 at times.  It is averaging about 50.  Normally when counters start spiking, something isnt right so i started to look into the counter a little bit to see if i could pin point where the issue was.  Since i know paging deals with RAM, this narrows it down quite a bit.
  • Pages/sec—The values of this counter should range from 5 to 20. Values consistently higher than 10 are indicative of potential performance problems, whereas values consistently higher than 20 might cause noticeable and significant performance hits. The trend of these values is impacted by the amount of physical memory installed in the server.
  • Page Faults/sec—This counter, together with the Memory—Cache Faults/sec and Memory—Transition Faults/sec counters, can provide valuable information about page faults that are not committed to disk. They were not committed to disk because the memory manager allocated those pages to a standby list. Most systems today can handle a large number of page faults, but it is important to correlate these numbers with the Pages/sec counter as well to determine whether Exchange Server is configured with enough memory.

I did some Google searching to try and get some guidelines to go off of as to where these counters should be, and the definitions above seem to be what i was looking for.  Based on those numbers there is clearly an issue.  Next I opened up Resource Monitor on the Mailbox Server and started watching the Memory.  I was actually get some page faults also.  Here are some screenshots.

ExchangeMailboxMemory 

ExchangeMailboxMemory2

I noticed that physical memory usage was 83% this seemed a little high, but was it causing the issue i was seeing with a lot of page spikes and page faults?   I have done some reading on excessive paging in Exchange 2010 and believe the best spot to start off is by increasing the amount of RAM in our mailbox server from 10GB to 16GB.  I will update next week with the outcome.

UPDATE: Since adding an additional 6GB of RAM to the mailbox server, pages/sec have dropped from about 50 pages/sec on average to about 10 pages/sec average.  According to documentation the acceptable range is 5-20 so I will leave it at 16GB for now, and continue to monitor into the future.

Exchange 2010 Retry Remote Delivery Queue Length

MSExchangeTransport Queues(_total)Retry Remote Delivery Queue Length
-Shows the number of messages in a retry state in the remote delivery queues.
-Shouldn’t exceed 100. We recommend that you check the next hop to determine the causes for queuing.
http://technet.microsoft.com/en-us/library/ff367923.aspx

In my daily monitoring of our Exchange 2010 servers, I glance at the Exchange Server Performance Monitor on both our CAS/HUB server, and the MBX server.  This allows me to see any abnormal activity pretty easily with lines on a graph.  If there are high spikes, or sustained heightened activity, I will usually investigate.  Since ive been working with Exchange I have noticed there are always a substantial amount of messages stuck in the Retry Remote Delivery Queue Length.  When I go into Queue Viewer and click the messages tab, I can view all of the messages that are causing the large queue size.  Normally this is between 30 and 100 messages.  These messages are addressed to recipients that do not exist in our organization with the error 400 4.4.7 Message Delayed, and keep retrying.

So what is causing these queued messages?

W3WP Process High CPU and RAM utilization on Exchange 2010 CAS

Last weekend I updated Exchange to SP2 and UR3 and have been keeping an eye on the server occacionally to make sure its running normal.  Today I noticed in the Exchange Server Performance Monitor that there was a lot of spiking and more than normal activity.  The extra activity was for the processing, so I went into the task manager to take a look at what process was using it all, as we normally run between 5-10% utilization on this server, and it was spiking up to 60% at times and consuming over 1GB of memory.

I checked out the Event Viewer and didn’t see any errors.  There were quite a few warnings from ActiveSync for an iPad device for user dsims, could this be linked to the IIS process issue?

Next I downloaded Process Explorer and located the troubled process and gathered some more info.  The IIS worker process was linked back to MSExchangeSyncAppPool.  I went into the Performance Graph and noticed something odd, there was a lot of CPU usage and IO and then it stopped, and started again.

At this point, I did a google search for ‘MSExchangeSyncAppPool high memory usage’ and many pages linked back to an issue with iOS devices.  Since I know who has the iPad in our company, I messaged them to see if they could take it offline for a while to see if that resolved the issue, which it did.

My concern is why was this process so heavily used?  Was it a bug, was the user downloading all of their mail, what caused the issue?

HowTo View Exchange Services Health

Last weekend I installed SP2 and UR3 onto our Exchange 2010 CAS and Hub Transport servers, along with the mailbox server.  Mail flow seemed fine afterwards and I was able to send and receive emails, but sometime over the weekend two services stopped.  I started the services Monday morning before everyone got it, but some automated reports ended up not running over the weekend.

Solution 1: I put a powershell script in place that I found online that monitors the Exchange Servers and emails me daily at 8PM through a scheduled task.  I will eventually be modifying it to show the hard drive space of all the partitions.
http://exchangeserverpro.com/powershell-script-health-check-report-exchange-2010

Solution 2:  There is a command you can run in the Exchange Management Shell that will show you the status of all the Exchange Services on each server, and show which are running, and which are not.  This command is Test-ServicesHealth.

ActiveSync Remote Wipe caveat

Today I had to remotely wipe a users phone that was setup to our Exchange 2010 server through ActiveSync.  I haven’t done this yet, since we are migrating from BlackBerry’s and usually just do a Remote Wipe on the BES server, so I figured I would try it out with ActiveSync and get a documented process and KB article created.

Ran the following commands in the Exchange Management Shell

Get-ActiveSyncDeviceStatistics -Mailbox bstollfus | fl Identity

Identity: internal.domain.com/Information_Systems/SystemsAdmins/Users/Brad Stollfus/ExchangeActiveSyncDevices/SAMSUNGPHD710SAMSUNGA00000F78349FA

Clear-ActiveSyncDevice -Identity internal.domain.com/Information_Systems/SystemsAdmins/Users/Brad Stollfus/ExchangeActiveSyncDevices/SAMSUNGPHD710SAMSUNGA00000F78349FA -NotificationEmailAddress “bstollfus@internal.domain.com

Initially the wipe didnt work so I rebooted the phone which didnt resolve the issue so I started to look into why.  It turns out that because the way ActiveSync works with the remote wipe flag, if the user is disabled in Active Directory, the phone is unable to authenticate (obviously) and the remote wipe flag can not get received by the phone if it is unable to authenticate.

Here is an article that goes into the details a little bit more.
http://msinfluentials.com/blogs/jesper/archive/2010/04/08/don-t-fire-people-until-after-you-wipe-their-phones.aspx