How to Migrate #Oracle Beehive Email into #Office365

Migrating email from Oracle Beehive to Office 365 is not as easy, graceful, or efficient as it should ideally be, but it can be done.

We're going to show you how.

IF you are confident with accessing your IMAP set up, you (*should*) be able ignore this step with Test-MigrationServerAvailability.  Sashay over to Migrate E-Mail from an IMAP Server to Cloud-based Mailboxes,

You really need to get to the point where you run Test-MigrationServerAvailability:

Test-MigrationServerAvailability -IMAP -YourIMAPServer  -Port (143 or 993)

To do this you need to execute PowerShell (do this as an Administrator) and re-direct your session to the Exchange Cloud.  You need to execute these commands in PowerShell, filling in Administrator credentials (call 'em the SuperUser, the Big Kahuna, whatever you want, but you need the rights to administer your entire Cloud account)

These commands in PowerShell will do it.

$LiveCred = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
Import-PSSession $Session

When all goes well it will look like this:

Note that it did not work for me the first time through the lengthy command but it did immediately after with another simple try.  Go figure.

When in doubt refer to one of the most useful short webpages you will ever find: Connect Windows PowerShell to the Service.

Now you are in a position to run Test-MigrationServerAvailability.

I have done this here.  Note that I was having trouble resolving my FQDN, but just used a the 127.0.0.1 localhost address and was in with no problems.  This is not something that will work for you in a real world migration, but I wanted to illustrate it here and did not feel like making my test system available to the wider internet,

If you have reached this point you are knocking on the door to success.  

Again, since as nearly as I can tell this is exclusively to test if you can get access to your IMAP server, and the real work of the migration gets done below, you can in all likelihood skip this step.  Please feel free to drop some comments if you discover something to the contrary.

A final word:  ALWAYS Clean up your PowerShell session by ending with Remove-PSSession $Session.

NOW YOU ARE IN A POSITION TO REALLY BEGIN MIGRATING BEEHIVE EMAIL TO EXCHANGE,

First you owe it to yourself to review Migrate IMAP mailboxes to Exchange Online: Roadmap.

If you successfully complete the instructions in Step 3 you will see this:

Click New and select "IMAP"   Not a lot of choice in this if you're coming out of Beehive.

The next one you're going to need to fill in all your Beehive server particulars.  Note that I did not use a secure port here.

I am going to take only ONE user in this case, but you should feel free to scale it up as you need to.  By long tradition in Sumatra all our test users are rock stars with "J" names.  Here's Janis Joplin.  Note that we need a CSV file I'll show you the details on later, and we can specify mail folders not to migrate (here I specified we should ignore "Junk", "Drafts", and "Mercedes Benz" for all these users.

That CSV file is really simple -- just the email, user ID, and password.  But keep in mind you want the email to be the email of the target user on Office 365, and the UserName and Password to be for that same user on the legacy Beehive system!! 

When that's done you go through one more screen:

And then start your migration.

Now it's passed into the hands of a greater power than any of us has ever known -- Microsoft's data center.  

May they have mercy on your data.

Read the logs and check over any errors. In practice I'd really try to end the process here and not keep a periodic synch running -- that's just asking for trouble.  But your circumstances will vary.

And of course I cannot resist saying that while http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff683630.aspx tells you you cannot take calendar and contact information:

We at Sumatra have just put full-state calendar migration (meaning: meeting will be actual meetings when you're done) and contact migration technology into a couple of test sites.  Contact us (infoATsumatraPERIODcom) if you want to try it out.

Automatically Updating Domains / SMTP Addresses in #Lync Meetings in #Exchange

So for the last few months we've had an interesting tool running at a client site.

The initial motivation was a corporate re-organization where a group of users were  transferred into a new domain.  Being a communications-intensive environment this brought a number of issues with it.  One of them was how to update all their Lync meetings to the new domain automatically.

We built this into SuUNDO, one of our flexible utilities for modifying Exchange calendars (usually to clear stuff out).

You're going to need to do be issuing commands from PowerShell.  There is of course installation and configuration, which in the interests of brevity we cut out here.  The great thing about PowerShell is its scripting flexibility.

Let's take a look at a sample Lync meeting in Office 365.

If we just wanted to find out how many current meetings are in Zyg's calendar we could just do this:

#ReportONLY
get-StringsinNotes @LyncCmds -NewPrimarySMTPAddress: "zyg-furmaniuk@sumatra.onmicrosoft.com" 

Output to the screen generates this (telling us this user has one current Lync meeting)

This is recorded in a log file as well.

So far so good -- this can tell us the extent of the number of online meetings that would need to change for all users.

Now, let's take the next step and update them.

Let's say this was an on-premises Exchange installation (it's not, but one of the Cloud's best attributes is as a test system) and we needed to modify just the domain names for these users, from "lync.com" to "sumatra.onmicrosoft.com"

This command will do it:

set-StringsinNotes @LyncCmds  -NewPrimarySMTPAddress: "zyg-furmaniuk@sumatra.onmicrosoft.com" -OldPrimarySMTPAddress: "zyg-furmaniuk@sumatra.onmicrosoft.com" -OldSIPAddress: "lync.com" -NewSIPAddress: "sumatra.onmicrosoft.com"

And we see the results in the original calendar here:

And now for the magic part, it has been automatically updated in the ATTENDEES' calendars as well!

Of course, you could also use this for updating when users change SMTP addresses only (or both together!),

Preview: Oracle Beehive to Exchange 2010 Calendar Migration

We have Oracle Beehive to Exchange 2010 migration working pretty well in our lab and are about to release it to one of the few test sites we trust with these things.

We chose a different path on this new code.  Instead of going through an intermediary "extraction" step  we read directly from the Beehive Database and insert from there into Exchange 2010.

We still allow for individual mappings (so if Hillary Rodham in Beehive needs to become Hillary Clinton in Exchange we can handle that, or if you want to take this opportunity to recast your Conference Room nomenclature that is completely possible).

Of course, this is a FULL STATE migration so we preserve all of the recurrence patterns (and in this case we can preserve ALL of them), the Guest Lists, and the guest responses.  In short: meetings are completely "live" after migrating with this code.  It is like your users were on Exchange all along.

Just so you folks can get a glimpse of it:

And since one of Zyg's personal hot buttons is making sure international characters come out correctly, this hybrid German-Spanish text in Outlook on Beehive:

Migrates perfectly correctly to Office 365:

We're still working on some performance tuning -- but you can get a good idea of where this is all heading.

We're also considering migrating all the user preferences and email if we get strong enough demand.

Calendaring Incident in Office365 March 15

Sometimes clients wonder about our paranoia religion of checking and re-checking everything in migrations.

This is the latest battle story of WHY.

Last night as we were running a migration we started noticing that invitations were not being sent for migrated meetings.  Appointments and regular email seemed to be going in fine.

This in our world is a first-rate fuster-cluck disaster.

First we naturally suspected a bug in our own code or throttling changes.  This led us to a code review, soul-searching, and much sweat-producing anxiety.  We did solve this, and it was enlightening.

Wait for it.

Office 365 ITSELF was DOWN for all practical calendar migration purposes.

We never START with blaming Microsoft. It is with great regularity their fault, but it's better practice to look at ourselves first.

So adieu this weekend's migration into Office 365, we'll have to reschedule since as of this morning this is what the situation looks like in Service Health.

Was there any kind of alert to either THEIR administrator or say OUR Office 365 administrator that this was going down?  No.  I suspect there is some way to configure these, but am perfectly willing to give someone else credit for showing me how.  Right now with the tension buzz just coming down I feel more in need of documenting the situation.

To the credit of the Office 365 team they did acknowledge that the system was throwing defecation at the ventilator.

The way this presents itself in a migration is that invitations will seemingly disappear. (Amended from earlier posting where I showed a DIFFERENT issue.)

Oracle Beehive Calendar to Exchange Migration

With three requests (two of which we consider serious) we're working on an Oracle Beehive to Microsoft Exchange migration path.

And we're going to leave all the data in your hands and simplify our usual process.
Want to get in on the ground floor?
Drop us a line.

SuHoliday cmdlet and Exchange 2007

We've gotten a few inquiries about running the SuHoliday cmdlet on Exchange 2007 instead of Exchange 2010.

Short answer: Yes you can do it.  Nothing the the was we use the EWS API is specific to Exchange 2010 to the exclusion of Exchange 2007.

However, setting Permissions in Exchange 2007 IS VERY different from Exchange 2010, so you will have to adjust for that.  Taking all of the Exchange 2007 permissions stuff out of the documentation made it substantially shorter and clearer,

If you need help look at posts in this blog involving Permissions and Exchange 2007.

Read "Freedom for Users, Not for Software"

We've been watching the migration to the cloud for a while now -- wondering when everybody was going to wise up that data centers were farming them into cruelty-free meat by-products.

I was recently at a Christmas party with some people from a Redmond-based software corporation that makes Exchange.  Their take: Office 365 made their lives and their customers lives much more convoluted.  Where they could work solutions in on-premises servers, any changes to Office 365 need to be escalated at the corporate level.  And we all know how convenient and easy that is.  So they're increasingly seeing combined Office 365 and on-premises Exchange environments, precisely the opposite of what they and the customer predicted or wanted.

SO it's is with great fervor that I suggest you read Freedom for Users, Not for Software by Benjamin Mako Hill.

He hits it right on the money with his analysis of the market confusion initially arising from "free software" which was re-cast as "open software" (goals with which it is hard to disagree! What's so funny about peace, love, and understanding?) and the way this term was used and abused in the industry.  The aspect that I suggest you pay closest attention to is the emphasis on users. Focused on the server-side of the client-server model, we at Sumatra would substitute the term "consumers" for "users" to avoid the further linguistic confusion that comes from the distinction between "users" and "administrators" in such environments.  Both the admin and the user are consumers, and the user-admin collective together face the "user" conundrum.

After years in this business, I'm pretty sure the dynamics of the industry are never going to allow the ideals of the open software movement to be fully realized in any software that is both marketable and useful.  The lure of dollars is too strong.  When software remained the exclusive domain of academics and cowboys it was possible.  These guys were happy to have a car and an apartment.

But once venture capital and the stock market took hold these ideals were not going to stand up to the motivation of owning a private jet and a McMansion.

What's this have to do with the movement to the cloud?  It's all the same dynamic based on much of the same software with the scions of the same corporations promising freedom while actually building feudal digital fiefdoms.  Do not go mindlessly with the flow when you hear that your support problems are going to go away and your life is going to be easier.  You might luck out, but really look at what your business goals are and how you're going  to deal with realistic software disaster scenarios while your business processes are directly under someone else's control.

As we often quote Ronald Reagan: "Trust, but verify."

Retiring Meeting Maker Migrations December 20, 2013

Folks, it has been a great evening out but now the bartender is calling for last orders.

As of December 20, 2013 we will no longer be doing Meeting Maker migrations.  We of course continue to do both full state and faster-simpler migrations from Oracle Calendar to Exchange, and faster-simpler migrations from Zimbra to Exchange.  Our Holiday cmdlet continues to thrive and our custom calendar engineering is unparalleled.

To those of you who have been asking us about migrating in the last few years: we'd recommend starting your test cycles sooner rather than later.

We're sympathetic to your budget cycles, so if you need to discuss timing we're open to that.  But we do need to put a stake in the ground so we can all move on.

Exchange 2010 Permissions Debugging Protocol updated

It being a new year and we having found a few new ways that Permissions could be problematic in Exchange, we've modified the Debugging Protocol.

The latest is available at this link: Exchange_2010_Permissions_Debugging_Protocol.pdf and supersedes all earlier versions.

Changes mainly affect the holiday cmdlet.

Turn on calendar publishing so people can share information

In general we don't just re-publish other links, but this one is so useful I feel the need.

How do you make your calendar available on Office 365 to users external to your organization?

Check out this article: Turn on calendar publishing so people can share information

A darned useful ability if you use it well.

#Exchange #PowerShell cmdlet for server-side holiday insertion updated

We're happy to announce we've updated the trial version of our Microsoft Exchange cmdlet for inserting holidays server-side.  This works on Exchange 2010 and Office 365.

You can read about it and get a download link by going here and filling out a form (we want to keep track of who is using it).

You can read the documentation here (and this includes how to insert class schedules using the tool as well as how to use the web-based version we've done).

We have had tens of thousands of people using this version since last year, but only a handful actually made any donations to the project.  So we're setting up a payment mechanism for the non-trial version.  When that's ready we'll let you know.

Oracle Calendar / Zimbra to Microsoft Exchange faster/simpler trial.

We've been getting lots of requests for the simplified method of going into Exchange from Oracle Calendar System and Zimbra.  So you can just download the trial here.

This version is quicker and simpler than our full method, and it will work for you IF:

• You are not changing your base SMTP addresses for users in your migration
• You do not want your recurrence patterns re-created
• You have no need of re-mapping email addresses of a subset of your users 
• Your users can deal with responding to their invitations again

If you really want the full-state, map-able, recurrence pattern recreating version you'll still need to do a trial.

Holidays into #Exchange and #Office365 via Server-Side Tools

We've just upgraded our cmdlet for inserting holidays server-side into Exchange 2010.  We'll give you some more details about that in a later post.

Mainly we're writing because we've just completed a site that lets you upload holidays into Office 365 without the cmdlet.

The full URL is: http://www.sumatraresourcewatch.com/holiday

We're treating it as a beta right now -- but we want folks to try out the online experience since it's one of the easiest ways to actually see how the full cmdlet works.  The "Buy" button will not be active until next week or so.

We've tried to make the web interface as easy as possible.  Folks who have been through a migration with us will also recognize our 1930's Soviet tractor style of user interface (not pretty but it works -- if the market responds well to this we've already got plans to update it). And since we traditionally use Jimi Hendrix as a sample account we are announcing this shortly after after his birthday.

You will need credentials for a service account that has Impersonation permissions to any of the accounts you want to modify.  This will be no surprise to any Exchange administrators.  The full manual for the cmdlet goes over how to do this.  

Then you select if you want to insert into a single calendar or upload a list of calendars to insert.

And the default calendar list goes right into Jimi's calendar.

Note that you can also remove inserted holidays automatically but leaving all other calendar data intact.

The web-based version allows you to do select a list of SMTP addresses to insert at once.  In the unlicensed version we limit this to 25 users per day, and only allow you to select US or UK holidays that we have already defined.

The full cmdlet allows you a lot more functionality: multiple time zone support, script-ability, and LDAP query insertions.

For the record, US Federal Holidays came from http://www.opm.gov/operating_status_schedules/fedhol/2013.asp  Our default file will insert JUST THIS LIST (i.e., NO “Day after Thanksgiving”) and we left Veteran’s Day a ”Free” day rather than a Busy day,

UK bank holidays came from this list https://www.gov.uk/bank-holidays 

Beta sites wanted for injecting holidays into Hosted Exchange / Office 365

Wanted: sites willing to try web application to insert holidays server-side into Hosted Exchange / Office 365.  Short learning curve (this is a web app and not the cmdlet) but we do want some feedback.  Apply to email address in above image.

Injecting Student Class Schedules into Exchange Online

At one site we've been injecting class schedules and recruiting events into individual student calendars for a few years now -- and we've just found out some others want to do it.

So here's a quick primer of what is possible.

We built a special-purpose tool for this particular client, but you can use our holiday cmdlet with the schedules in a CSV file.

Here is Zyg's daughter's Economics class in the syllabus and translated into a CSV.

Because her university probably won't give me credentials, I loaded it into my calendar (initially blank)

Then populated with her classes:

Opening one of them gives some more detail as well as seeing it tied to a useful Category.

We also have the capability to selectively REMOVE these classes, set them as Free or Busy, all the usual sorts of things you'd want to do.
Keep in mind - this is all going on server-side with no end user intervention.

The Legacy of BPOS when you migrate to O365

Had an interesting one come over the fence the other day.

A site is migrating into Office 365 but HAD been in BPOS before they started the migration process.  They were having problems with their conference rooms.

Conference rooms and resources were validating fine but no data was coming into the calendars for them.

Why should this be, we wondered?

Turns out it was an artifact of their BPOS installation.

They had the rooms set up in BPOS previously and had deleted them.  However, creating what they thought were new rooms (just with the old names) resulted in SMTP addresses like:

G9c5........a5962b@company.com

instead of 

Room_101@company.com

The alternate names were validating but email was being lost in the bowels of hosted Exchange when we tried to actually insert (remember our main recommendations: test, test, test). 

The first time when they created the rooms with the OWA user console (log in and go to Options > See all options > Manage my organization > Mailboxes). Rooms created this way using the same name values that were previously used in BPOS (say Room_101), would have  the email SMTP value assigned as Room_101@company.com and the UPN as the secondary.  BUT when you checked the same account name in the Admin console, only the UPN would be present. 

To make a migration work in this situation you have to give the rooms a NEW unique name that was never used for the SMTP address to be assigned as the primary for users to see the calendars.  In setting up your MM_Exchange_User_Map for these resources, copy the UPN name assigned as the account name and use that SMTP address.  You still have the hellacious hexadecimal as a UPN, but the method will work.


Worked like a champ.

And remember to use the UPN when setting defaults for rooms prior to migrating.  I.e., you want to NOT enforce a horizon and you want to allow conflicts.  Example:


PS C:\Windows\system32> Set-CalendarProcessing 
     -Identity  G9c5........a5962b@company.com
     -AutomateProcessing None
     -EnforceSchedulingHorizon $false
     -AllowConflicts $true



And to see what your settings are:

PS C:\Windows\system32> Get-CalendarProcessing
     -Identity   G9c5........a5962b@company.com  | fl


RunspaceId                          : 304a36b7-NNNNNNNNNNN
AutomateProcessing                  : None
AllowConflicts                      : True
BookingWindowInDays                 : 180
MaximumDurationInMinutes            : 1440
AllowRecurringMeetings              : True
EnforceSchedulingHorizon            : False
ScheduleOnlyDuringWorkHours         : False
ConflictPercentageAllowed           : 0
MaximumConflictInstances            : 0
ForwardRequestsToDelegates          : True
DeleteAttachments                   : True
DeleteComments                      : True
RemovePrivateProperty               : True
DeleteSubject                       : True
AddOrganizerToSubject               : True
DeleteNonCalendarItems              : True
TentativePendingApproval            : True
EnableResponseDetails               : True
OrganizerInfo                       : True
ResourceDelegates                   : {}
RequestOutOfPolicy                  : {}
AllRequestOutOfPolicy               : False
BookInPolicy                        : {}
AllBookInPolicy                     : True
RequestInPolicy                     : {}
AllRequestInPolicy                  : False
AddAdditionalResponse               : False
AdditionalResponse                  :
RemoveOldMeetingMessages            : True
AddNewRequestsTentatively           : True
ProcessExternalMeetingMessages      : False
RemoveForwardedMeetingNotifications : False
MailboxOwnerId                      : _4th Floor
Identity                            : _4th Floor
IsValid                             : True

As always, this is why we stress testing early and often.

Train hard -- fight easy.

Exchange 2013 First Insertion

So we're running Exchange 2013 and have successfully inserted data using our process.

Throttling looks different and we'll need to deal with it.  No surprise there.
But the early results with 2013 are very positive.
We do not expect to be needing to do migrations into 2013 for 6-12 months after final release to manufacturing (this is the historic lag we've seen with other Exchange releases), but it's good to know it's not looking like a problem.

Retiring Exchange 2007 Migrations

As of now we're retiring migrations into Exchange 2007.

There's been exactly ONE this year (which actually started in 2008 -- long story).

So unless you have a really good story or a really fat checkbook -- look to 2010 or 2013.

Exchange 2010 Permissions Debugging Protocol (revised)

Everything in the calendar migration business is a moving target: the legacy systems, the target systems, and all the permissions and APIs associated with each side.

As we never tire of saying Permissions are the biggest problem we see and the best responses to permissions issues are always fluid.  Too fluid and complex for straight blogging. To better inform our migration clients we're now extracting the Permissions section of our manual and putting it as a PDF here.

Exchange_2010_Permissions_Debugging_Protocol.pdf

We'll update the PDF as we need to -- the date in the footer being your indication that anything has been updated.

In tribute to the immortal Julia Child (whom I would occasionally see around Cambridge back in the day): bon  appétit!

Legal Discovery in Archived Meeting Maker Data

Necessity truly is the mother of invention.

I know, cliche does not become us, but it's apt in this case.

The topic is legal discovery.  A client has scads of backups of Meeting Maker server data back to the turn of the century and needs to do legal discovery on it. 

Our previous modus operandi required a full calendar insertion (meaning significant computer lab resources and expertise) and a PST export.  But after noodling on this we thought -- let's use our tool that we originally built for Zimbra insertions!  It produces ICS files which we inserted into Zimbra but are also readable in Outlook and as text!

Here's how it works:

We convert Meeting Maker export into our intermediate Access format and run zinsert (either for one user or the entire server of users if you prefer).

If you use a text editor to look at them they look like this (readable, but let's face it, geeky):

If you list them as an external file in Outlook (which does not involve IMPORTING them) - they look a lot more like calendars:

and can even be searched and displayed as a list:

Where did the HTML in my note body go?

One of our customers asked us to put up a custom message in the Sumatra Holiday tool.  This message needed a small bit of HTML formatting in EWS Managed API v1.2 code.  A "slam-dunk."  Yet this simple HTML produces horrible output:

Microsoft published a KB article that confirmed the problem:  meeting request that you send from an EWS application is in plain text format instead of HTML format when an attendee opens the request by using Outlook in online mode

The fix? Patch your servers! Here's the link: Update Rollup 3 for Exchange Server 2010 Service Pack 2 (KB2685289)

We patched our dev server this weekend and confirmed it works!

(PS: we're tagging this as an API bug, but it really isn't.....

Week of June 18, 2012 in Sumatra-land

Since as usual we have a number of sites at various stages with their purchase orders and test cycles, and Murphy's Law says they will all start to come to us at the worst possible time, a word of timely warning:

The week of June 18 Sumatra is going to be slow in responding.  So please do not expect immediate turnaround on a sudden Meeting Maker conversion or latest software for an Oracle migration.

This is due to various moving, graduation, and vacation schedules among out staff (which seem to have all hit at once).

Visual Basic Script to make calendar objects public

Well those fine, fine people at Oracle make the default PRIVATE for ICS exports in Oracle Calendar Server 10.x.

SO we have options for making our process make them NON-PRIVATE if you wish.

OR if you want to migrate it as private and then change it, this VB script will help.

---------------------

Here is a VB Script that will make items public

---------------------

'Used this MSDN as a hint: http://msdn.microsoft.com/en-us/library/aa171274(v=office.11).aspx

Dim appOutlook As New Outlook.Application

Dim OutlookItems As Outlook.Items

Public Sub ClearCalendarItemsPrivateFlag()

Set OutlookItems = appOutlook.GetNamespace("MAPI").GetDefaultFolder(olFolderCalendar).Items

For Each appointment In OutlookItems

    appointment.Sensitivity = olNormal  'or olPrivate if you want to turn it back

    appointment.Save

Next appointment

End Sub

Exchange 2010 Permissions summary and debugging

Depending on the situation there are four permissions your service account must have to function successfully in either a migration or using Sumatra calendar tools:

1.       Impersonation

2.       Full access

3.       Read access to the GC

4.       Other details: Allow Log On Locally

In which situations are these permissions used?

This summarizes the types of permissions you must use when using Sumatra calendar technology.

Situation	Use Permission	Notes
Migrating Calendar Data into Exchange	Impersonation	Resource mailboxes are Disabled accounts by default, so in a full-state calendar migration they are ENABLED temporarily so that the Sumatra process can populate data correctly.
“Faster simpler” ICS calendar migration to Exchange	Impersonation
Using the SuHoliday cmdlet or the Sumatra Pump on users	Impersonation	Putting holidays into user calendars requires only impersonation
Using the SuHoliday cmdlet or Sumatra Pump on resources	Full access	Why Full access in this case?  Impersonation will not work unless you enable the accounts.  In a migration there are many reasons for doing this, but for holidays that is a wasteful extra step.  Use Full access.
Terminating an Existing User	Impersonation	It’s basically a migration in reverse, so you use the same permissions as a migration
Removing broken meetings from resource or user calendars	Full access	Don’t mess around in this case.  You’re trying to scrub out bad data, don’t let low permissions get in the way of a fast job.

Impersonation

Impersonation grants the service account permission to ‘send-as’, and ‘receive-as’ the user account.   Note, however, that impersonation works only when the account is enabled.  For disabled accounts you will need full access.

To impersonate in Exchange 2010, create a new ManagementRoleAssignment (called “_suImp8”) for your service account (called “exsu”.)

new-ManagementRoleAssignment    -Name:_suImp8    -Role:ApplicationImpersonation    -User:exsu@cod.sumatra.local

Full Access, Send-as, Receive-as

Full Access grants the service account permission to access the user account.   Full access allows you to read from and write to folders in both enabled and disabled accounts.   If you are just cancelling meetings from the conference room, full access is sufficient.  If you want to send mail on behalf of a disabled user/room, you will also have to grant send-as receive-as (see the next section)

To grant your service account (called “exsu”,)  full access for a room (“crar210q”), use the add-mailboxpermission cmdlet.

Add-MailboxPermission     -Identity: crar210q     -User: exsu@cod.sumatra.local     -AccessRights: FullAccess     -InheritanceType: All

See our blog: (http://calendarservermigration.blogspot.com/2009/10/fullaccess-fails-with-error-specified.html)

Note that group policies sometimes prevent permissions from being inherited.  Please use Active Directory Users and Computers (ADUC) to ensure the permissions were set!  Find the account (crar210q) and right-hand click to obtain properties.  Select the security tab, then advanced. (If the security tab is missing, select Advanced Features under View.)   You can check the permissions, or the effective permissions.  You should not see deny checked!

Add Send-as, Receive-as

If you have to add send-as receive-as, here is the commandlet

Add-ADPermission

    “CR 101B”

    -user: exsu

    -AccessRights:  genericall

    -ExtendedRights: "receive as","send as",

                        "ms-exch-epi-may-impersonate","ms-exch-epi-impersonation"

    -InheritanceType: All      

Read access to the Global Catalog

Many enterprises grant access to the global catalog if the user is a member of the domain.  If login is failing, anonymous access is probably disabled (since Windows 2000 DCs).  Make sure you are an authenticated user.

Other Details: Allow log on locally                       

Make sure your service account is allowed to log on locally (as in the Local security policy, or if you have multiple machines, set via Group Management Policy, screen shot below.) Otherwise you will generate a 401 error.

Note that in the example above we have both a specific service account and a Group of Service accounts.  Using groups in this way is an effective means of managing several accounts if you need to segment them for Exchange data insertion.

Debugging Exchange 2010 Permissions Problems

Setting permissions correctly is one of the largest stumbling blocks in the process.    Here is a list of the HTTP errors, and ways to debug (and fix) permissions.

HTTP Response	Most Likely Issue	Solution
401	Service account not allow to “log on locally”	Grant permission to “log on locally” via group or local security policy
	The CAS and Mailbox servers are not members of Windows Authorization Access Group.	Add all computers as members to “Windows Authorization Access Group” in ADU&C.
	BASIC authentication is not enabled for the EWS virtual directory in IIS	Set Basic authentication in IIS; remember to restart IIS
	The "SERVICE ACCOUNT" is not authorized to submit requests to the CAS Server	Create a new-ManagementRoleAssignment, and grant ApplicationImpersonation rights  to the service account.  Also remember to check the service account creds to ensure they password is correct. Paste the "ews url" into a browser. Enter the service account creds, when prompted. Do you see a EWS WSDL page? (Note: this could show up as a 500 error in some instances.)
500	The "test user" does not exist in Exchange or is not mailbox enabled	Verify account exists in the domain, it is enabled, a mailbox user (try to access the account in OWA using the service account credentials).  If the account is disabled, did you grant “fullAccess” to the service account?
	The "SERVICE ACCOUNT" cannot impersonate the "test user"	Verity there is a management_role assignment "ApplicationImpersonation" (Ex10) or ExtendedRights:"ms-Exch-EPI-Impersonation","ms-Exch-EPI-May-Impersonate" (ex07) for the SERVICE ACCOUNT that is applied to the server or the user you are attempting to test.

Start with IIS Basic authentication on the EWSvirtual directory. It’s the easiest to see / fix.

Basic debugging protocol – 401 error

Open a browser window, and try to open you EWS url.  If you typically point to the load balancer, point to one CAS server instead.  Try to open the ews url e.g., http://ex10/ews/exchange.asmx.   You should be prompted for credentials.  Enter the service account credentials.  If the credentials are rejected, your service account may not be allowed to log on locally.  If you can login, try to insert a “test” appointment using suExchange.  If you see a 401, it will be due to basic authentication not set OR the CAS/MBX server(s) are not members of windows authorization access group.

Issue: Service account not allowed to log on locally.

Here’s an easy way to confirm you cannot log on locally.  Go to the cas server you pointed to in the EWS url, and open up the Security event log.  Search for event ID 4625, keyword Audit Failure.  You’ll know you have to grant log on locally if you see your service account, with failure information “the user has not been grated the requested logon type at this machine”.   If so, allow the service account to log on locally via a group policy or local security policy.

Issue: Basic Authentication not set

Look in the IIS logs.  If you see a 401 error, check IIS.  If basic authentication is disabled, enable it. Remember to cycle IIS:  “iisreset /noforce.”

Issue: Computers are not members of Windows Authorization Access Group

If you are still getting a 401 error, ensure that ALL exchange computers and domain controllers are members of windows authorization access group.

Basic debugging protocol – 500 error

Issue: Service account does not have impersonation permissions or full access

If you are still getting a 401 error, try logging into an active end user’s mailbox via OWA (like your own!) using the service account credentials.  If you see an error in OWA:

Check the Application event logs on the CAS server for Event ID 17. If you do, then create a “New-ManagementRoleAssignment” to grant the service account ApplicationImpersonation permissions (see “Impersonation,” above.)

Throttling in Hosted Exchange

Microsoft does not close a window without slamming a door and bricking you in.

One of our least favorite topics again comes to the fore: Throttling in hosted Exchange.

Redmond claims these changes are customer-driven, which may or may not be so, but from the standpoint of customers who want to migrate a lot of calendar data into Hosted Exchange, these modifications are like getting a grenade tossed in your lap.

In an on-premises migration it's straightforward to turn these limits off.  Going into Hosted you're at the mercy of Microsoft (good luck with that) or the cleverness of your developer (yes, we can handle this).


If like me you find an hour long video of Exchange Web Services Affinity and Throttling as and act of stultification on the order of Hypnotoad, you can read most of the gist of this at More throttling changes for Exchange Online.


Our recommendations going forward for Hosted Migrations:   


During validation, point to different CAS servers to reduce CAS-server throttling (our code is going to need to change to do this)


During an insertion, use MULTIPLE service accounts which means using parallel insertion processes and point these to different CAS servers.  We're set up for this already, but we now recommend it in smaller migrations than we used to.


During migration, set the batch input to at least 50 calendar objects.


Props to Andrew at UC Irvine who called this to our attention by stepping on the landmine in test last week.

2

Microsoft Access 2010 x64 database access

As more Sumatra customers stand-up x64 systems, they hit the "Unrecognized database format" error.  The issue:  There isn't an x64 MS Access driver.  But there is a solution:   

Download the 2007 Office System Driver: Data Connectivity Components

Choose Microsoft Office 12.0 Access Database Engine OLE DB Provider!!

If you are editing the suExchange _config.xml file, you'll find those settings in the DatabaseProvider tag.  The choices are:

x64: Provider=Microsoft.ACE.OLEDB.12.0;Data Source=
or x32: PROVIDER=Microsoft.Jet.OLEDB.4.0;Data Source=