DPM does not recognize an Exchange Mailbox server as one!

Recovering single mailboxes to a non-production mailbox server

So I was deploying a new Exchange 2010 mailbox server for testing purposes (later it will be used as a production mailbox server)

The first test I wanted to do is to restore a single mailbox to a recovery mailbox database (RDB) on the new server, only to find that DPM cannot recognize the mailbox server as one in the recovery wizard!!

The reason behind this is the fact that DPM will not backup exchange databases unless they’re in a DAG, and will not show you the server as a mailbox server unless they’re protecting a database on that server!!

So here’re the steps you will need to take to restore the mailbox

1. Install the MBX role on the server
2. Create a new DAG
3. Join the server to the new DAG
4. Create a new mailbox database (SampleDB)
5. Create a new RDB (RecoveryDB)
6. Mark RecoveryDB as “This database can be overwritten by a restore”
7. Mount both databases
8. Install/attach DPM client to the server
9. Create a new protection group that backs up SampleDB
10. Recover the required mailbox to RecoveryDB using DPM’s Recovery Wizard
11. Use the EMS to restore the recovered mailbox to a working mailbox

Straight forward huh!

Oh, just so you know, I was using DPM 2012 RTM and Exchange 2010 SP1 (no rollups) for the test lab, but out of some internet research the experience should be the same for DPM 2010 and Exchange 2007-2010 SP2

Remove all send-as permissions a user has in the exchange organization

Send-As allows a user to send emails as someone else. A feature that comes in handy under many circumstances, such as an assistant sending Christmas greetings instead of her boss.

Adding Send-As permissions to a user is usually a straight forward task in Exchange. But finding all the Send-As permissions a user has on all the mailboxes in the organization is a different story.

In this article we will discuss how to find all the Send-As permissions a user has on all the mailboxes in the environment. And then removing all these permissions. Of course PowerShell will come in handy to achieve these goals. (And by PowerShell I mean the Exchange Management Shell, EMS)

The first step will be to find the permissions the user has on all the mailboxes.

$SendAsPermissions = Get-Mailbox | Get-ADPermission | Where-Object {($_.ExtendedRights -like “Send-As”) -and ($_.User –Like “Contoso\Kim.Akers”)}

In this command we used the Get-Mailbox without any parameters to get all the mailboxes then piped them to the Get-ADPermission cmdlet that returns all the permissions on a mailbox then we piped all the information to the Where-Object cmdlet in order to filter the output by the Send-As permissions where the user is Kim Akers who is the user that we querying the information about. Finally we created a variable $SendAsPermissions to store the data.

Running this command WILL take a long time to complete in a larger environment, so you may want to prepare yourself to wait for a while before it’s done.

You may want to run a command that shows you what permissions where found,

$SendAsPermissions | FL Identity, User, ExtendedRights

And the output should be something like that,

Identity : Contoso.local/Users/Don Hall
User : CONTOSO\Kim.Akers
ExtendedRights : {Send-As}
.
Identity : Contoso.local/Users/Delilah Edward
User : CONTOSO\Kim.Akers
ExtendedRights : {Send-As}

As you see, the results shows that Kim Akers has Send-As permissions on two users, Don Hall and Delilah Edward.

Now the next step is to remove the permissions and stop Kim Akers from being able to send as Don or Delilah.

$SendAsPermissions | Remove-ADPermission -Confirm:$False

In this command we piped the data in our variable into the Remove-ADPermission cmdlet that removed the permissions applied, the Confirm switch makes sure we don’t have to confirm the removal of each and every entry.

There will be no output if everything runs smoothly! So you may want to run the first command again (and expect no output too!) to check the successfulness of removal or check them manually from the EMC.

You may notice that there was no technical need for the second step, but knowing what you are deleting is usually a good idea.

This concludes our article, credit goes to Rajith Jose Enchiparambil for his article as it gave me the idea for this one.

DHCP Error: The Specified Address is not available‼

DHCP is one of my favorite server roles, it’s stable, straight forward, and rarely creates troubles. Well, at least until today when I was faced with a laptop refusing to lease an IP address!

My first trick was to reserve an IP address for the MAC address of the wireless adapter, but then I was faced by an error message saying “The Specified Address is not available.”

I double checked the leased and reserved IP and MAC addresses but that was not the problem.

So after a little search online I found a short comment by Vertigo963 on TechNet forums saying, “…where the netsh dhcp server command shows reservations that are not present in the DHCP GUI…”

As shocking as it seems to be, but I decided to give it a try, so I went to CMD and starting coding:

Netsh DHCP Server <IP Address> Scope <IP Address> Show ReservedIPs

And there was the MAC address‼ Don’t know why Microsoft enjoy giving the GUI users such a crappy experience but CMD to the win.

After that firing this command deleted the problematic entry and now the IP address can be reserved and the Laptop is able to obtain a DHCP lease.

Netsh DHCP Server <IP IP Address> Scope <IP Address> Delete ReservedIP <IP Address> <MAC Address>

Moral of the story, “When it’s a GUI, it’s never WYSIWYG”

Remove unused computer accounts from Active Directory using PowerShell

I can never call myself a PowerShell guru, but I am currently trying my best to “practice” more PowerShell since I know that it is the future of command line administration.

So today, I was doing some regular maintenance to the active directory, just disabling the old computer accounts as a step into removing them later, and decided to use the “Active Directory module for Windows PowerShell” to perform the task.

Note: we are changing the naming policy for the computers, which is why we do not just reset the computer account, which is the recommended method when reinstalling Windows.

Find all XP computers and export as a CSV

For documentation, we decided to export a list of the XP machines that exist in the AD. This command did it.

Get-ADComputer -Filter {OperatingSystem -eq “Windows XP Professional”} -properties * |Select-Object Name, LastLogonDate, DistinguishedName, OperatingSystem, enabled | Export-Csv D:\XP_Machines.csv

This exported a list of all the XP machines in the domain, with the path, date last used, OS and status (enabled or disabled) of each account.

Disable all the accounts that did not logon since November

That’s a two-step operation; first you create a variable with the required date and then use a magical command to disable all the machines.

$date=’Nov 1, 2011′
Get-ADComputer -Filter {LastLogonDate -le $date -and OperatingSystem -eq “Windows XP Professional”} |Set-ADComputer -Enabled $False

That’s it, here we used Get-ADComputer to create a list of the required criteria, piped the list to Set-ADComputer to disable the accounts.

In a production environment doing this task manually can take hours and hours, powershell comes in as a very useful timesaver tool.

Useful resources

http://blog.thomaswimprine.com/2010_10_01_archive.html

http://blogs.msdn.com/b/adpowershell/archive/2009/04/14/active-directory-powershell-advanced-filter-part-ii.aspx

Hope you found this useful!

Watching history as it happens

One light year is the distance that light travels in one year, for example if you light a very strong lamp on Earth people on the moon (assuming there are ones) will not be able to see the light from your lamp except after a while, that’s because light needs to travel from earth to the moon before they can see it.

If we know that light can travel 299,792,458 meters per second, that’s almost 300,000 kilometers per second (186282 miles if you live in the US) and the distance between the center of our earth and the moon is 384,405 kilometer (238,858 miles). This means light needs 1.26 seconds to reach the moon from your lamp.

Scale model of the Earth and the Moon, with a beam of light traveling between them at the speed of light. It takes approximately 1.26 seconds.

Now this seems like a negligible amount of time, but the nearest star to our Earth (other than the sun) is 4.2421 light years, the star is called “Proxima Centauri”, that is for the light of this star to be seen on earth it needs 4.2421 years (4 years and 88 days).

Ok, here comes the trick, do you remember the lamp you were holding a couple of minutes ago. This lamp was lit and 1.26 seconds later the folks on the moon saw it. Now what if you only lit this lamp for 0.5 seconds? The folks on the moon 0.76 seconds later will see the light… that’s 0.76 seconds after you actually switched off the lamp, they’re looking at a lamp that, at the moment they look at it, isn’t even lit‼!

That’s exactly what we’ve been doing since probably the beginning of our existence, watching the light coming from stars that are millions of light years away from us!

If Hubble telescope can see stars as far as 15 billion light years away from us, then we are watching, studying, and analyzing stuff, which may even cease to exist at the time we know it was born since stars that are around the size of our sun live about 13 billion years, and bigger stars can live only around a 100 million years (you still think Mubarak is an old guy!?)

If what I’m saying still makes any sense to you, then think again after reading this.

A star that is 100 million years away from us, that means that if this star dies and ceases to send any more light, we wouldn’t know about it except after 100 million years of watching it. What if this star died because dooms day came to it?

What if dooms day actually happened, it’s just a 100 million years away from us. And all these stars that we see die (those that actually died years ago, we just saw their death now) are actually dying as dooms day reaches them.

Dooms day is that black matter that is blacking out everything on its way, and its moving on its own pace but we can only see what it did to those stars years (or millions of years) after it happens…

We are watching history as it happens. And we can do nothing but watch it. Because you can never change history, you can just sit in front of your little telescope and watch stars that may not even exist and study the birth of a universe that was doomed millions of years ago.

And may be, a couple of light years away, we are just history that some other people are now watching; we just can’t see them because they aren’t even there… Yet!