Impersonation in Exchange 2010

Quick tip: Impersonation in Exchange 2010 has morphed from setting ACLs to Role Based Access Control (RBAC). It could not be easier to impersonate users in the entire domain:

new-ManagementRoleAssignment -Name:_suImpersonateRole
-Role:ApplicationImpersonation -User:'xxx@xxx.xxx'

Here is a link to a Microsoft TechNet article: Understanding Role Based Access Control

Sumatra Utilities for E2K7 available next week

We're not trying to drive you crazy -- just trying to make sure everything works and getting our legalese squared away.

The Sumatra Utilities for Exchange 2007 (including holiday server-side insertion capability) will be available next week.

Keep checking here for updates.

FullAccess fails with the error: The specified folder could not be found in the store.

I have been banging my head against the Exchange 2007 brick wall for the last month over the error: "The specified folder could not be found in the store."

Sumatra's conference room analysis tool's Exchange Web Service calendar folder "FindItem" request failed for about 5% of the rooms at one client. Other clients do not have this problem! The service account had FullAccess to all rooms. All conference rooms were on the same Exchange mailbox server, in the same OU, configured to autoaccept. Some had delegates, some did not.

The client could use the service account credentials to access the calendars via OWA. Was it a corrupted meeting? We changed FindItem's interval. No luck. Was EWS timing out over a large mailbox? Increased the HTTP timeout. No luck. Our FindItem requet uses the DistinguishedFolderID. We called GetFolder to find the FolderID. It failed on the inbox with the message "The specified object was not found in the store", and for the calendar folder with the message "The specified folder could not be found in the store".

Ahha! The permissions were not inherited. We added "InheritanceType: All" and it worked. Here is the syntax:

Get-Mailbox -filter {isResource -eq $True} -Resultsize unlimited
Add-MailboxPermission -User: xxxx -AccessRights: FullAccess
-InheritanceType: All

Holiday insertion server-side in Exchange 2007

Remember the Sumatra Utilities for Exchange 2003 and their beloved server-side holiday insertion capability?

And you remember how every year you ask us if we've done it for Exchange 2007?

Well, we (finally) rebuilt it for Exchange Web Services. Check out this example.

Friends of Sumatra can use this at no charge (you all know who you are) so just ask us and we'll send it out.

For everyone else we're actually going to charge for the capability this time.

Which brings me to the purpose of this posting: If you have any preferences on how we should do this -- drop us a line. If you do not know our emails you can use our contact form.

Oh yeah -- this is also going to include the broken meeting check, the terminated user utility, and the interface for managing conference room statistics (the full application for the last one will be a separate follow-on offering).

500 errors on test insertion into Exchange 2007?

When you get a "500" error on validation or a test insertion, please verify your:

1. CAS/MBX boxes are members of Windows Authorization Access Group
2. Impersonation permissions stuck (and are not denied) through Active Directory Sites & Services
3. Service Account is NOT a member of any Exchange Admin Group/Domain Admin group

Oracle Calendar / Meeting Maker to Google Calendar Migration

OK, for street cred, we did a Meeting Maker (it will work with Oracle or Sun Java Calendar as well) to Google Calendar migration extension.


Keep in mind, we'll morph this as it makes contact with the real world. Here's how it currently works.


We use our tools to produce ICS files. Not a problem for appointments, but for meetings the idea is to make them live.


Here's how we do it. We insert the emails of the attendees into the OWNER's agenda.

She or he can find these really easily after inserting into Google by searching for "(re-propose)" Open it and highlight the emails, copy / drag them into "Guests"

SAVE it and SEND it:
Voila, live meetings, simple, inexpensive, and done.

There's a few issues: I think we'll load all the To-Dos into an All-Day Event on the day of the migration (since Google doesn't have an import/export capability for Tasks yet).

We migrate Contacts via CSV files.

We looked at automated ways of uploading, but the Google Calendar API does not support uploading via ICS. So we're sitting on XML uploads via cURL until we have a corporate customer (which means we are not holding our breath).

We think it's more likely a corporate customer is going to want to get OUT of Google Calendar and into Exchange (you listening, Roche?).

NB: We only handle "re-propose" for meetings which have not yet ENDED -- any other meetings get turned into appointments in everyone's calendar.

Smartphones and your calendar server migration

We go over this a lot with folks and it's worth blogging about.

Let's say you're switching your calendar server and you've got BlackBerrys, Smartphones, ancient PDAs, whatever connected to your old server. And you want to use the same product when you're done in your NEW environment (let's call it Exchange).

Our recommendation is that as part of your migration process you blank out your calendars in your source system and re-synch completely on your target.

Why? Because the synch usually keeps track based on something called UIDs (or Universal Identification Numbers). You change your calendar server, you change your UIDs, and if you're not careful your Smartphone will get data from BOTH systems (and this is a hassle).

While migration is going on we strongly recommend turning off your BlackBerry server. Why? Sumatra generates a lot of email as part of re-creating end-user calendars in Outlook. While Sumatra’s insertion technology removes almost all of that email from end user’s in boxes, it can not remove those messages delivered to your device via the BlackBerry Exchange Server. So depending on your migration option your BlackBerry users will either be flooded with a lot of email (no EventSink) or some email (EventSink).

Since your BlackBerrys, Palms, or WindowsMobile PCs is synched with a system that is obsolescing – you will need to clear the calendars when you shut down your Oracle Calendar / Meeting Maker / Sun Java Calendar / etc. server, then have your users re-synch after the migration is completed.

BlackBerry

For clearing the calendar on the Blackberry – see the following webpage:
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/7925/8142/How_To_-_Reset_the_BlackBerry_device_calendar.html?nodeid=1201826&vernum=1

Palm

For clearing the calendar on a Palm OS, you might use the Purge function:
http://kb.palm.com/SRVS/CGI-BIN/WEBCGI.EXE?New,kb=PalmSupportKB,CASE=obj(5029),ts=Palm_External200173

Windows Mobile (Pocket PC)
For Windows Mobile, you can:
· Open ActiveSync
· Double Click on Calendar.
· Change the settings such that it syncs only 0 past and 0 future appointments.
· SYNC - this will clear all calendar items on the IPAQ / most other Pocket PCs.
Note: Some earlier ActiveSync versions attempt to interpret the default Sumatra Category as a date field. If you have Windows Mobile PCs you should remove the keyword AFTER you have done your quality assurance testing on the migration. Sumatra also has a COM add-in for Outlook that will accomplish the same thing on a user-by-user basis.

NotifyLink

Updated September 10, 2009 with info from Notify Technology.

Migration for NotifyLink Enterprise Server (NLES) Users with recent versions.

An administrator must:

1. Make sure the NLES server and device software are up to date.
2. Create the new mail and PIM servers
3. Open the user administration list and for each user to be moved, select the “Edit User” button.
4. On the “Edit User” page, switch the email and PIM servers to the new servers that were created.
5. This should all be done after the actual migration is complete on the server side. Notify Tech claims their software should handle the rest. It should re-prime accounts and issue full resynchronization commands. The device PIM stores will be automatically cleared and reloaded with the new account info.
   
   Earlier versions of their software ran a more complicated, non-automatic process.

"Run-As" for Vista/Windows Server 2008

Wondering how you can get the "Run-As" back in the context menus for Vista and Windows Server 2008? Thanks to Sysinternals Mark Russinovich and Jon Schwartz it's easy. Their tool ShellRunAs is located here: (http://technet.microsoft.com/en-us/sysinternals/cc300361.aspx)

It's easy to use - Unzip and move shellrunas into windows\system32. Then type the following in the start/Run command line: shellrunas /reg. That's it. Right click on an item to see "Run as different user"

Russ

When the Cloud disappears why does everyone not fall to earth?

Gmail went down again on September 1, 2009.

My schadenfreude finally met my Weltanschauung.

Of course, I got THIS one at 3:43 PM PDT which was DARNED confusing:

So with everyone who's been looking to migrate into Google Calendar: be really careful what you ask for.

And to everyone already there: migrating OUT of Google Calendar into Exchange is a LOT easier than a real time server-side synch between the two.

Yes, we joined Twitter

You can now find us on Twitter:

http://twitter.com/sumatra_dev

We're sending all our future blog postings there, too.

Facebook is just not a natural match for us, though.

Migrating Resource Scheduler Data into Exchange 2007

No sooner was one of us back from the Seattle Opera Ring Cycle (Janice Baird rocks!) than we got one of our favorite types of inquiries: Can we get data out of Resource Scheduler and into Exchange 2007 native?

Short answer: Yes.


If you're primarily using Resource Scheduler to book rooms (something Exchange 2003 did not do well) and want to take advantage of the newer (and better) capability in Exchange 2007, this is very doable. We've already figured out how the Resource Scheduler SQL schema is structured and can simply modify and re-propose the meetings with mailbox-enabled resources on E2K7. With this knowledge if you want to try to write this code yourselves, go ahead, but be forewarned, it is harder than you think.


In contrast to the hundreds of calendar migrations we've done, this is more of an informed consent clinical trial right now, but if you're interested drop us a line. The more interest there is the more likely it is we'll proceed with development.


You should also read: Resource scheduling in Exchange Server 2007 and Using Exchange 2007 for Resource Booking. For the truly adventurous and technically adept, check out How to Create or Remove Custom Resource Properties.

Sun Java Calendar, aka iPlanet, full-state migration to Exchange 2007

Sun Java Calendar Server, previously known as Sun ONE Calendar Server, and before that iPlanet Calendar Server (the darn thing has had more names than that "Diddy" guy) is now among our full-state, server-side migrations into Exchange 2007.


It kept popping up sporadically and just came around for a 5000 user migration. Then this opportunity turned into a 500 user migration with a budget that would cover a few blended drinks at Starbuck's and we were wondering how we were going to make any money out of it. As any of you know, we're market-driven.

So here's how it's working.

We use Sun's WCAP protocol to extract the calendar and task data.

We run it through our conversion tools to morph into our intermediate format from which we can map user IDs and do all sorts of other wondrous things.

Then we insert it into Exchange 2007 using EWS (we parted ways with the now-deprecated CDO way back after Exchange 2003).

A few notes:

Recurrence patterns in Sun Java Calendar are a 1:1 match for Outlook, so we have thus far not seen any exceptions.


We can actually handle attachments. The big issue here is not the technical aspects of attachments, but the logistical ones. Often when running a migration the amount of data can cause low-set quotas to be exceeded pretty quickly, and you don't want to run into that at 2:00 AM on a Saturday. So we recommend extracting to a common directory and just passing a link to the attachment in the Agenda field. If you can avoid migrating them entirely, so much the better.

SJC has a limit on "on-going" meetings. Outlook / Exchange do not -- so we simply set an SJC "ongoing" meeting to an Outlook meeting with No End Date.

A word on versions.

We do version 6.x. With a little bit of prodding (in the commercial sense) we could be convinced to make it work for Sun ONE / iPlanet 5.x.

Future version 7 (now in beta) - we are not guaranteeing. You want to check out Calendar Server 6 and Calendar Server 7 Comparison and Coexistence. Since Sun does not currently have a migration path between 6 and 7 we're not anticipating we'll need to have a version 7 migration to Exchange path for a while.

However, since Calendar Server 7 us apparently based on MySQL (see : Best Practices for Backing up and Restoring MySQL Databases in Calendar Server Deployments) we are very optimistic a full-state migration will just involve reading their database and morphing it into our schema.

Bigger question is: Will Version 7 even make it out the door when the Oracle acquisition is final? Oracle is not likely to keep supporting two past-their-prime calendar systems.

Meeting Maker to Google Calendar field test results

It's been a productive few weeks.


We just used our existing iCalendar tools to export a few Meeting Maker calendars for a site that wanted to go into Google Calendar.


With a little surgery (removing our Time Zone DST definitions) and using the Zulu time option, the data actually imports pretty well. The above example is real-world data.


Now there's a couple of things it doesn't do right out of the box: banners are currently off kilter (this is an easy fix), and we're not sure it's worth replicating the full set of state data for guests (because nobody else does it and everybody going into Google Calendar is price-constrained), but it's not that hard to at least put the guest list into the Description field.

As you know, we actively solicit your feedback.

Migrating to/from Lotus Notes/Domino Calendar from/to something else?

It was a glorious summer day in Boston and of course I could think only of calendars.

Having come off installing Yellow Dog Linux on my PS3, I thought "How much geekier can I make the day?" OK, I actually thought "how soon can I fire up the grill?" but the lack of high-quality Chilean sea bass caused me to re-think my plans.

So given that one of the development guys warned me that there was no way I could possibly set up a Lotus Domino configuration on Linux by my own self, I had to prove him absolutely correct and generate this sample calendar. (BTW: If you try doing this on Fedora, remember to shutdown sendmail or Domino won't come up due to a port conflict.)

Needless to say - yes, this means we're looking at full-state migrations out of Lotus Notes and into other less "legacy" environments. Our first impetus is someone who wants to take a few thousand Meeting Maker seats and put them INTO Lotus Notes, but we can work in stages.

More later.

Exchange 2007 Rollup 9 for SP1

MS released Exchange 2007 Rollup 9 for SP1 last week. The KnowledgeBase article (970162) reports twelve calendar, Outlook/OWA-related fixes:

1. 954739 Exchange Impersonation feature does not work if a cross-forest topology has only a one-way trust relationship between forests (Ex07SP1)
2. 961124 Some messages are stuck in the Outbox folder or the Drafts folder (Ex07SP1)
3. 961544 Mobile users whose location is set to New Zealand cannot synchronize an exceptional occurrence after the daylight saving time (DST) update (KB 951072) is installed (Ex07SP1)CAS server
4. 967479 Entourage clients cannot synchronize with mailboxes (Ex07Sp1/Win 08)
5. 967525 Error 4 is returned when you synchronize a supported list of contact properties by using Exchange ActiveSync(Ex07SP1)
6. 967676 E-mail address properties of contacts changed through Exchange Web Services (EWS) are not updated in Outlook or Outlook Web Access (OWA)(Ex07SP1)
7. 968081 Monthly recurring meetings are declined if the "Schedule only during working hours" option is enabled(Ex07SP1)
8. 968350 When you change the location field of a recurring calendar item to empty, the location field is set to the default value of the recurring series if this recurring item is synchronized on a Windows Mobile device (Ex07SP1)
9. 969054 Error message after user replies to a message that has more than 300 recipients in Outlook Web Access (OWA): "Microsoft Exchange issued an unexpected response (500)" (Ex07SP1)
10. 969324 Outlook crashes when you try to use Outlook to view e-mail messages that are arranged by subject in (Ex07SP1)
11. 969838 An error message is returned when a user tries to change a recurring appointment in Office Outlook Web Access that was created in Outlook 2007 (Ex07SP1)
12. 969969 OWA Error "Outlook Web Access has encountered a Web browsing error" when a user tries to delete a calendar item

BlackBerry Permissions and Exchange Server-Side Holiday insertion

So remember a few days ago when we told you about a great simplification in setting up permissions?

Basically, and you should not be too surprised at this, the permission for BES admin are really really close to the permissions necessary for inserting holidays or running a full-state calendar migration.

Check out this post:

http://forums.crackberry.com/f50/exchange-2007-bes-install-guide-942/

which advises setting permissions as follows:

get-mailboxserver add-exchangeadministrator
BESAdmin –role ViewOnlyAdmin

get-mailboxserver add-adpermission –user
BESAdmin –accessrights ExtendedRight –extendedrights Send-As, Receive-As,
ms-Exch-Store-Admin

And then tells you to follow up with:

Open Active Directory and from the View menu select "Advanced Features". Then
go to each user that will be added to the BES and open their properties, go to
the security tab and add the user BESadmin and add the security permission "Send
As". (This will overcome some MS patches that prevent BES sending emails).
Methods are available to add BESadmin "Send As" rights to all users if required
but this method ensures only the required users have permissions added.

Make BESadmin a local Administrator of the server where you will be
installing the BES software. This is done by right mouse clicking my computer
and selecting “Manage”. From Computer Management expand “Local Users &
Groups” and select Groups. From Groups double click “Administrators” and add
BESadmin.

This is pretty much what we tell you to do in setting up a service account for running a Sumatra migration or inserting holidays, checking for broken meetings, or running the "terminated user" option in our code.

If you do not have a specific service account set up yet, this is a good place to start.

Server-side holiday insertion in Exchange 2007 - example

Well yes, we did go ahead and add the server-side holiday insertion into our mainstream migration code for Exchange 2007.

And we even field-tested it at a site in a mythical place called Canada.

This is a (slightly revised for purposes of pedagogy) holiday file, showing some of the flexibility of our approach. Notice you can have holidays which show as Free "F" or Busy (abbreviation is left as an exercise to the reader) so that our Canadian cousins can list USA holidays as information for everyone in their company, but make sure the time shows as Busy (i.e., do not book then) for Canadian holidays on their calendars.

In an example of instant karma, the test site told us of a wonderfully simple short cut to permissions in setting up insertion (for those of you who have not been through a migration) based on BlackBerry Enterprise Server permissions, which we'll blog on separately.

Please note that this has the following advantages:

• It's run server-side with no user intervention
• It is scriptable from the DOS command line
• It's reversible, i.e., we built in UNDO capability for those occasional accidents
• Handles multiple time zones

Any sites who have been through a migration with us are welcome to use this capability at no charge for Exchange 2007. Just drop us a line if you do not have the latest code.

GeekSpeak: Memory Leaks in System.DirectoryServices

It rained 22 days in June (in Boston). The last few days were glorious. And I missed the sun while dealing with a memory leak.

We hit this problem while translating legacy Exchange DNs into SMTP addresses in our Exchange Room analysis tool. The culprit -- System.DirectorServices (.Net 3.5)
calls to GetDirectoryEntry().Properties. With each call to System.Directoryservices, memory use jumped by 120 bytes. The annoyance became a problem after we looked up three fields - for 8,000 users.

Microsoft's MSDN Reference says: "Due to implementation restrictions, the SearchResultCollection class cannot release all of its unmanaged resources when it is garbage collected. To prevent a memory leak, you must call the Dispose method when the SearchResultCollection object is no longer needed.".

I did that. So did other folks posted similar problems in the MS forums. All were told to use dispose. It didn't work. After reading dozens of responses, someone said try the "using" contruct along with "dispose". I did. It worked.

For those of you who don't want to find the mines by stomping on the ground, here is sample code that shows System.DirectoryServices calls broken out into an excessive number of using blocks:



'return ONE value from AD given a filter
Public Function GetADField(byval strFilter as string, _
 byval strField as string) As String
 GetADField = ""
 Using dsDir As System.DirectoryServices.ActiveDirectory.Domain = _
  System.DirectoryServices.ActiveDirectory.Domain.GetCurrentDomain
    Using dsRoot As New DirectoryEntry(dsDir.Name)
      Using dsSearcher As New DirectoryServices.DirectorySearcher
        dsSearcher.SearchRoot = dsRoot
        dsSearcher.Filter = strFilter
        dsSearcher.SearchScope = SearchScope.Subtree
        dsSearcher.PropertiesToLoad.AddRange(New String() {strField})
        dsSearcher.FindAll() 'results
        Using dsResult As DirectoryServices.SearchResultCollection = _
            dsSearcher.FindAll() 'results
            Dim result As DirectoryServices.SearchResult
            For Each result In dsResult
             Using de As DirectoryEntry = result.GetDirectoryEntry()
               GetADField = de.Properties("mail").Value.ToString
               de.Dispose()
             End Using 'de
           Next 'result
           dsResult.Dispose()
           result = Nothing
        End Using 'dsResult
      dsSearcher.Dispose()
    End Using 'dsSearcher
   dsRoot.Close()
   dsRoot.Dispose()
  End Using 'dsRoot
  dsDir.Dispose()
 End Using 'dsDir
 Return GetADField
End Function



-Russ

Bulk Move Meeting Maker to Oracle Calendar?

Keeping an eye on keyword searches that bring folks to our site usually has few surprises.

Then last month this one showed up: "bulk move meeting maker oracle calendar" (right in there with "calendar migration oracle to exchange" and "meeting maker exchange calendar convert").

Yes, Oracle does have a process to convert Meeting Maker into Oracle Calendar.

They smartly used the Meeting Maker export DAT format (just as we do - it's independent of operating system so it's the most natural format and live Meeting Maker data is a horror show of complexity).

Sidebar: Turnabout fair play with an "X" to Paul Lynde. That's the same
strategy we use to move data OUT of OCS, using the utilities Oracle provides for moving calendar data between servers.

BUT when we ran the MM to OCS conversion (a ways back when we were figuring out how to convert Oracle Calendar to Exchange), we discovered they had missed several key attributes and in general failed to impress us with their solution (we did try licensing our tech to them but they were not interested). Since their own published report example consists mainly of "Nothing to import" messages, you should be appropriately wary.

Cornell did this nice guide when they migrated out of Meeting Maker into OCS and Penn State apparently moved last year.

If you want a real geek instance of calendar comedy, check out their Troubleshooting Calendar Migration Guide for their Microsoft Exchange migration consisting largely of the equivalent of "Step 2: Discard remainder of killer whale carcass" making success seem as accessible as Larry Ellison's yacht habit.

We are surprised that anybody nowadays is considering leaving one waning calendar-only product for another waning calendar-only product.

If it works for you, that's all the matters.

As always our message is: try it out for yourself beforehand and follow Reagan's maxim of "trust but verify."

But also be prepared to migrate again in a few years.

Double Booking in Exchange 2003? Look to BES Versions

Gentle Reader,

As a blogging calendar geek Ms. Calendars sometimes gets requests from the field. When they are useful to the general calendar-server managing public, she publishes them.

So it has come to pass that a question came in:

You mentioned on your site about the "perennial exchange problem of double-booked meetings". I thought I would drop you a line to see if this qualifies. We have Exchange 2003 and Blackberry Enterprise Server 4.1.3. Our users run Outlook 2003. We get these periods where users claim they are getting double booked meetings. More often than not we see one as tentative and one as accepted in the same time period. Do you have a resource that clearly explains why this happens? Is BES the culprit? Thanks in advance. Rick

Double bookings are really not unusual in Outlook. Microsoft itself has a guide on How to troubleshoot missing and duplicate appointments in Outlook. It is a work of singular genius: wonderfully complete in what could be causing the problem, and mostly silent on solutions or protocols to solutions (in contrast to Russ's latest blog entry), all the while referring you to other links which will hopefully keep you from realizing you are being given the runaround.

Just because we make a good living out of working with Exchange does not mean we're going to drink the Kool-Aid or praise the manure as BBQ.

But it does advise keeping abreast of your software updates, and that did turn out to be the problem.

In the end the problem has been solved by updating to BES version 4.1.6. The release notes go over the brand new BlackBerry Calendar Synchronization Tool. And to see what effect this will have on your Exchange server, see Technical Note: Impact of using the BlackBerry Calendar Synchronization Tool. So keep an eye on your BES servers, folks.

In general, we've noticed pretty big changes going on in CDO on E2K3: see here and here. With two years of E2K7 migrations under our belt, we're encouraging folks to migrate into E2K7 rather than E2K3.

Also, check out Information about CDO patching and third-party programs that interface with the calendar in Exchange Server and in Outlook.

We have another report of calendar weirdness from the field, this one with BES and E2K7, which we are pretty sure is related to the known problems with cached mode and the incremental change system. We'll blog on that later.

In general, if you notice weird behavior on your calendars, start with your BES server and work back from there. BES is the source of most calendar headaches we hear tell of.