Configure ADFS Extranet Lockout Protection

Extranet lockout provides the following key advantages: It protects your user accounts from brute force attacks where an attacker tries to guess a user’s password by continuously sending authentication requests. In this case, AD FS will lock out the malicious … Continue reading →

How to Configure Microsoft ADFS with Azure MFA as Primary Authentication

In order to setup Azure MFA as Primary Authentication with AD FS, this does require you to move to Azure MFA (cloud-based version). I have not deployed Azure Multi-Factor Authentication Server (on-prem/hybrid version) in a few years for anyone as … Continue reading →

Replace ADFS and WAP SSL Certificates

On the ADFS Server: Import the new SSL certificate in the computers MY“ certificate store. Run a elevated Powershell to get the thumbprint of the certificate. cd cert: cd localmachine cd my dir Identify the thumbprint in the output. In … Continue reading →

How to Upgrade ADFS 2012 R2/2016 to Server 2019

Once Computer restarted the Server 2016, Now you can see that AD FS Management is available. Now Click on it and open the AD FS Management But if you see, AD FS on Server 2016 is not showing anything here. … Continue reading →

SELF SERVICE PASSWORD RESET IN AADCONNECT NOT WORKING

For those google searching the eventlog azure ad connect sync errors I just had, which I couldn’t google an answer to: Start the AADConnect wizard and disable Password Writeback Do a delta sync Start the AADConnect wizard and enable Password … Continue reading →

Convert Synced User to In-Cloud User

Here is the scenario: Synced ID: Specifies the immutable ID of the federated identity of the user. This should be omitted for users with standard identities. You have local Active Directory with AAD Connect installed, which sync users and password … Continue reading →

Decide on Office 365 Migration Path

This gallery contains 1 photo.

Deciding on the best migration path of your users’ email to Office 365 can be difficult. Your migration performance will vary based on your network, existing messaging systems design, mailbox size, migration speed, and so on. For migrations from an … Continue reading →

Office 365 MailFlow Scenarios and Best Practices

Microsoft Office 365 gives you the flexibility to configure mail flow based on your requirements and uses scenario to delivered email to your organisation’s mailboxes. The simplest way to configure mail flow is to allow Microsoft EOP to handle spam … Continue reading →

Migrate Office 365 Relying Party Trust to Different ADFS Farm

To migrate Office 365 Relying Party Trust from an existing ADFS Farm to new ADFS Farm, follow the step by step guide. Migrating Office 365 Relying Party Trust will incur a minor disruption to SSO environment. Prerequisites: Existing ADFS Farm … Continue reading →

ADFS 4.0 Step by Step Guide: Federating with Splunk Cloud

To integrate On-Premises SSO with Splunk Cloud, you need the following items: On-premises Active Directory On-premises ADFS 2016 A Splunk Cloud tenant Splunk cloud Sign-on URL https://yourinstance.splunkcloud.com/saml/acs Splunk cloud Sign-on URL https://yourinstance.splunkcloud.com/saml/logout ADFS Sign-on URL https://sts.domain.com/adfs/services/trust ADFS Sign-Out URL  https://sts.domain.com/adfs/ls/?wa=wsignout1.0 … Continue reading →

ADFS 4.0 Step by Step Guide: Federating With Google Apps

To integrate On-Premises SSO with Google Apps, you need the following items: On-premises Active Directory On-premises ADFS 2016 A Google Apps single sign-on enabled subscription Google Apps Sign-on URL https://mail.google.com/a/domain.com ADFS Sign-on URL https://sts.domain.com/adfs/ls/ ADFS Password Change URL https://sts.domain.com/adfs/portal/updatepassword/ ADFS … Continue reading →

ADFS 4.0 Step by Step Guide: Federating with ServiceNow

Prerequisites: Windows Active Directory Windows Server 2016 with ADFS Role installed ServiceNow Tenant ADFS Signing certificate from ADFS Server ADFS Service Identifier: http://sts.domain.com/adfs/services/trust ServiceNow Sign On URL: https://company.service-now.com/navigate.do ServiceNow Identifier: https://company.service-now.com ADFS Signout URL: https://sts.domain.com/adfs/ls/?wa=wsignout1.0 Step1: Export Token Signing Certificate … Continue reading →

Office 365 Hybrid Deployment with Multiple Active Directory Forests

This article explains how you can deploy a hybrid Office 365 and Exchange on-premises environment with multiple Active Directory Forest. An organisation that utilizes an account forest and a resource forest to separate Active Directory accounts and Exchange servers in … Continue reading →

Building Multiple ADFS Farms in a Single Forest

Let’s paint a picture, you have an unique requirement to build multiple ADFS farms. you have a fully functional hybrid environment with EXO. you do not want to modify AAD connect and existing ADFS servers. But you want several SaaS applications use different ADFS farm with MFA but their identity is managed by the same Active Directory forest used by existing ADFS farm.

Here is the existing infrastructure:

• 1 single forest with multiple hybrid UPNs (domainA.com, domainB.com, domainC.com and many…)
• 2x ADFS servers (sts1.domainA.com)
• 2X WAP 2012 R2 cluster
• 1x AAD Connect
• 1X Office 365 Tenant with several federated domains (domainA.com, domainB.com, domainC.com and many….)
• 1x public CNAME sts1.domainA.com

Above configuration is working perfectly.

Now you would like to build a separate ADFS 2016 farm with WAP 2016 cluster for SaaS applications. This ADFS 2016 farm will be dedicated to authenticate these SaaS applications. you would also like to turn on MFA on ADFS 2016. Add new public authentication endpoint such as sts2.domainA.com for ADFS 2016 farm.

End goal is that once user hit https://tenant.SaaSApp.com/ it will redirect them to sts2.domain.com and prompt for on-prem AD credentials and MFA if they are accessing from public network.

New ADFS 2016 infrastructure in the same forest and domain:

• 2X ADFS 2016 Servers (sts2.domainA.com)
  
• 2X WAP 2016 Servers
• 1 X separate public IP for sts2.domainA.com
• 1X public CNAME for sts2.domainA.com
• 1X Private CNAME for sts2.domainA.com

Important Note: You have to prepare Active Directory schema to use ADFS 2016 functional level. No action/tasks necessary in existing ADFS 2012 R2 environment.

Guidelines and referrals to build new environment.

Upgrading AD FS to Windows Server 2016 FBL

ADFS 4.0 Step by Step Guide: Federating with Workday

Branding and Customizing the ADFS Sign-in Pages

Deploy Web Application Proxy Role in Windows Server 2012 R2 –Part I

Deploy Web Application Proxy Role in Windows Server 2012 R2 –Part II

Office 365 Hybrid Deployment with Exchange 2016 Step by Step

Hybrid Configuration Business Case. On-premises IRM- Information Rights Management (IRM) enables users to apply Active Directory Rights Management Services (AD RMS) templates to messages that they send. Antispam and malware protection- Mailboxes moved to Office 365 are automatically provided with antivirus … Continue reading →

Login to Exchange Online PowerShell using MFA

Once you enable MFA on Admin account, you will be denied access to EXO using PowerShell until you update Azure PowerShell version to latest. Download and install Microsoft Online Services Sign-In Assistant and Azure Active Directory Connection preview Use Connect-MsOlService … Continue reading →

Exchange 2010/2013 to Exchange 2016 Migration Step by Step

Deployment Location: On-premises Target Environment: Exchange Server 2016 CU4 Current Environment: Exchange Server 2010 or Exchange Server 2013 or mixed Public Folder Location: Exchange Server 2013 Understanding of Exchange Server 2016: Exchange Server 2016 wraps up in two Exchange roles … Continue reading →

Enable multi-factor authentication for office 365 users using PowerShell

The script enables strong authentication for Office 365 users from a CSV input. Before you turn on strong auth or multi-factor auth, take necessary measure to communicate with users to notify them that they will have to register their mobile … Continue reading →

Add multiple users to Office 365 security groups using PowerShell Scripts

Step1:  Connect MSOL Services Connect-MsolService Step2: Find out ObjectID of the Security Group you would like add members to Get-MsolGroup –Maxresults 100000 | Where-Object {$_.DisplayName -eq “Test Security Group”} Get-MsolGroup –ObjectId “af407072-7ae1-4b07-a0ca-6634b7396054” OR Sign-in to Portal.Azure.Com and Select Azure Active … Continue reading →

Configuring Retention Policies in Office 365

Retention policies are used to manage email lifecycle. Retention policies are applied by creating retention tags, adding them to a retention policy, and applying the policies to mailboxes. To Create various retention policies in Office 365 using simple PowerShell. Connect … Continue reading →

Office 365: Configuring catch-all mailbox during migration

Step1: Create Catch-All Mailbox 1. Sign in to portal.office.com>Active Users 2. Create a new user named “Catch-All-Mailbox” and assign licenses either E1 or E3. Step2: Create exception Security Group (Optional Step) 1. Log onto Office 365 admin portal 2. Go … Continue reading →

Branding and Customizing the ADFS Sign-in Pages

Branding and promoting Company name and logos are common business practices. You would like to see your own brand whilst signing into to Microsoft Office 365. ADFS provides opportunity for businesses to customize sign in page and promote own brand. … Continue reading →

Centralized Mailflow: NDR Remote Server returned ‘550 5.7.1 Unable to relay’

 Environment: Mailbox hosted on the Exchange Online Hybrid on-prem Exchange 2010/2013 with Microsoft Exchange Online Centralized Mailflow configured for Exchange 2013 Route all emails through on-premises configured for Exchange 2010 Accepted domain configured either Managed or Authoritative on the Exchange … Continue reading →

Export Office 365 Licenses

An Office 365 admin perform one repetitive task on the Azure AD PowerShell is to generate license report from Office 365. Two simple Cmdlets Get-MsolUser  and Get-MsolAccountSku can be used to generate many reports. This article uses variation of these … Continue reading →

How to Configure Office 365 SMTP Relay

There are three ways you can setup SMTP Relay for Applications and multi-function devices using Office 365. All three options are elaborated here. Option 1 and Option 2 are configured within the application and devices. Option 3 are setup within … Continue reading →

Migrate On-premises Exchange Server to Office 365 using MigrationWiz

This gallery contains 9 photos.

Assumptions: An operational on-premises Microsoft messaging environment or an IMAP Source An operational Microsoft Office 365 tenant for Exchange Online Active Directory synchronised with Microsoft Azure Active Directory using DirSync Licenses are assigned to Active Users. There are place holder … Continue reading →

Mailflow Co-existence between G Suite and Office 365 during IMAP Migration

This article will explain how to create mail flow coexistence between disparate IMAP source and Exchange Online destination. Use case: Customer wants a mailflow co-existence between hosted email e.g. Gmail and Exchange Online during mailbox migration phase. Customer has on-premises … Continue reading →

On-prem to Office 365 Migration: PowerShell Script Collection

Connect to Azure Active Directory PowerShell without Password Prompt #Use Case: Log on to Office 365 tenant without typing credentials. $User=”Raihan@tenant.onmicrosoft.com” $Password=ConvertTo-SecureString -String “MyPassword” -AsPlainText -Force $O365CREDS= New-Object –TypeName “System.Management.Automation.PSCredential” –ArgumentList $User, $Password #$O365CREDS = Get-Credential -Username Raihan@tenant.OnMicrosoft.Com $SESSION = … Continue reading →

How to Configure Wild Card Certificate in Exchange Server 2013

You may experience certificate warning when using OWA and Outlook after you installed wild card certificate in your exchange organization. There are resolution available if you bing. Examples: Certificate error message when you start Outlook or create an Outlook profile … Continue reading →

Migrate Windows Server 2008/R2 Active Directory to Windows Server 2012/R2 Active Directory

Forest Functional Prerequisites

1. Check to ensure the Domain Functional Level is currently setup to at least Windows 2003 mode.
2. Open the Active Directory Users and Computers console, select the domain via the right mouse button on it.
3. Select Raise Domain Functional Level and review the Current domain functional level reported minimum Windows Server 2003.

RBAC Requirement

Your account must be a member of Domain Admins, Schema Admins and Enterprise Admin.

Systems Requirement

Processor	1vCPU
RAM	4GB
Free disk space requirements	32 GB
Screen resolution	800 x 600 or higher
Network	1 Ethernet
DVD	1

Prepare Windows Machine

1. Download Windows Server 2012 R2.
2. Build Windows Server 2012 R2
3. Join the Server to Domain with a static IP

Prepare Forest and Domain

1. Mount Windows Server 2012 R2 ISO on to the Windows Server 2008 R2 Domain Controller.
2. Log on to Windows 2008 R2 Domain as an administrator.
3. Open command prompt as an administrator, and type adprep /forestprep and press enter.
4. Open command prompt as an administrator, and type adprep /domainprep and press enter.

Install AD DS Role

1. Open the Server Manager console and click on Add roles and features
2. Select Role-based of featured-based installation and select Next.
3. Select the Active Directory Domain Services role.
4. Accept the default features required by clicking the Add Features button.
5. On the Features screen click the Next button.
6. On the Confirm installation selections screen click the Install button. Check off the Restart the destination server automatically if required
7. Click the Close button once the installation has been completed.
8. Once completed, notification is made available on the dashboard highlighted by an exclamation mark. Select it and amidst the drop down menu select Promote this server to a domain controller.
9. Select add a Domain Controller into existing domain
10. Ensure the target domain is specified.  If it is not, please either Select the proper domain or enter the proper domain in the field provided.
11. Click Change, provide the required Enterprise Administrator credentials and click the Next button.
12. Define if server should be a Domain Name System DNS server and Global Catalog (GC). Select the Site to which this DC belongs to and define Directory Services Restoration Mode (DSRM) password for this DC
13. Click the Next button on the DNS options screen.
14. Click the Next button once completed.
15. Specify location for AD database and SYSVOL and Click the Next button.
16. Next up is the Schema and Domain preparation.  Alternately, one could run ADPrep prior to commencing these steps, if ADPrep is not detected, it will automatically be completed on your behalf.
17. Finally, the Review Options screen provides a summary of all of the selected options for server promotion. As an added bonus, when clicking View Script button you are provided with the PowerShell script to automate future installations. To click the Next button to continue.
18. Should all the prerequisites pass, click the Install button to start the installation.
19. After it completes the required tasks and the server restarts, the new Windows Server 2012 R2 Domain Controller setup is completed.

Check New Domain Controller in AD Sites and Services

1. Open Active Directory Users and Computers, expand <Your Domain> and click the Domain Controller OU to verify your server is listed.
2. Open DNS Manager, right-click on <Your Domain>, select Properties and then click Name Servers Verify that your server is listed in Name Servers: lists.
3. Open Active Directory Sites and Services; verify that your server is listed in Servers under Default-First-Site-Name.

Check New Domain Controller in DNS Manager

1. Open DNS Manager in new Domain Controller
2. Expand Forward Lookup Zone
3. Select FQDN of domain> Double Click on Name Server (NS)>Properties>Check New Server in Name Server Tab.

Transfer FSMO Role

Now transfer all the FSMO roles from windows 2008 domain controller to windows 2012 R2 domain controller. Log on to windows 2008 domain controller as enterprise admin. Open command prompt type these command as follows:

ntdsutil

roles

connections

connect to server WIN2012R2SERVERNAME

q

Transfer domain naming master

Transfer PDC

Transfer Schema Master

Transfer RID master

Transfer infrastructure master
Change DNS Properties of Servers and Workstation

On each server and workstation within the target domain require a NIC properties configuration update to point to the new Domain Controller. Open the DHCP management console, select Option no. 006 and under server scope options and add the IP address of your new Domain Controller as DNS server.

Removing the Windows 2008 R2 domain controller

1. On the Windows 2008 R2 server click Start, Click Run, type dcpromo, then click
2. After the Welcome to the Active Directory Installation Wizard page, be sure to leave the Delete the domain because this server is the last domain controller in the domain
3. On the Administrator Password Page, enter your password and click Next.
4. On the Summary page, click Next, wait for the process to end, then click
5. On the Completing the Active Directory Domain Services Installation Wizard, click
6. On the Active Directory Domain Services Installation Wizard page, click Restart Now to Restart the server.
7. After the reboot is completed, delete the Windows Server 2008 R2 server from the domain to a workgroup and remove any unnecessary record from Active Directory Sites and Services.

Note: Wait for all schema object to be cleaned automatically. Do not rush to clean any schema object or DNS record in new Domain Controller.

Data Loss Prevention (DLP) in Exchange 2013

Data Loss Prevention (DLP) is a mechanism introduced in Exchange 2013 to prevent accidental or malicious disclosure of information via email message. Built-in DLP solution in Exchange 2013 scan message header, message body and attachment based on DLP rule by the transport agent. There are certain conditions applied in Exchange 2013 DLP.

Notify Only Policy

The following conditions can be used:

• The recipient is
• The recipient is located
• The sender is
• The sender is a member of
• The sender is located

The following actions can’t be used:

• Reject the message and include an explanation
• Reject the message with the enhanced status code of
• Delete the message without notifying anyone

Block Message Policy

• Block the message, but allow the sender to override and send
• Block the message.

To add a notify only DLP policy:

1. Go to Exchange Administration Center, Go to Compliance management > Data loss prevention
2. Then go to Policies, Select Edit
3. On the Edit DLP policy page, select Rules.

• To add Policy Tips to an existing rule, highlight the rule and select Edit.
• To add a new blank rule that you can fully customize, select Add or plus sign and then select Create a new rule .

4. Select plus sign, select the sensitive information types, select Add, select OK, and then select OK.
5. In the Do the following box, select Notify the sender with a Policy Tip, and select an option in the Choose whether the message is blocked or can be sent drop-down list, and then select OK.
6. If you want to add additional conditions or actions, at the bottom of the window, select More options.
7. In the Choose a mode for this rule list, select whether you want the rule to be enforced. We recommend testing the rule first.
8. Select Save to finish.

To add a block message DLP policy:

1. In the Exchange Administration Center, go to Compliance management > Data loss prevention.
2. Select desired policy> Click Edit .
3. On the Edit DLP policy page, select Rules.

• To add Policy Tips to an existing rule, highlight the rule and select Edit .
• To add a new blank rule that you can fully customize, select Add .
• To add an action that will reveal a Policy Tip, select More options and then select the Add action

4. From the drop down list, select Notify the sender with a Policy Tip and then select Block the message.
5. Select OK, then select Save to finish modifying the rule and save your changes.

Supported Systems for Exchange 2013

Supported Domain Controller

• Windows Server 2012 R2 Standard or Datacenter ¹
• Windows Server 2012 Standard or Datacenter
• Windows Server 2008 R2 Standard or Enterprise SP1 or later
• Windows Server 2008 R2 Datacenter RTM or later
• Windows Server 2008 Standard or Enterprise SP1 or later (32-bit or 64-bit)
• Windows Server 2008 Datacenter RTM or later
• Windows Server 2003 Standard Edition with Service Pack 2 (SP2) or later (32-bit or 64-bit)
• Windows Server 2003 Enterprise Edition with SP2 or later (32-bit or 64-bit)

Supported Forest

Windows Server 2003 forest functionality mode or higher ²

1. Windows Server 2012 R2 is supported only with Exchange 2013 SP1 or later.
2. Windows Server 2012 R2 forest functionality mode is supported only with Exchange 2013 SP1 or later.

DNS Name Space

• Contiguous
• Noncontiguous
• Single label domains
• Disjoint

Mailbox, Client Access, and Management Tools

• Windows Server 2012 R2 Standard or Datacenter
• Windows Server 2012 Standard or Datacenter
• Windows Server 2008 R2 Standard with Service Pack 1 (SP1)
• Windows Server 2008 R2 Enterprise with Service Pack 1 (SP1)
• Windows Server 2008 R2 Datacenter RTM or later

Supported Client

• Outlook 2013
• Outlook 2010
• Outlook 2007
• Entourage 2008 for Mac, Web Services Edition
• Outlook for Mac 2011

Supported Coexistence

• Exchange 2007 SP3 Update Rollup 10
• Exchange 2010 SP3 Update Rollup 6

Supported Hybrid Deployment

• Latest version of Office 365

Relevant Articles

Exchange 2013 Upgrade Guide

Exchange 2013 Deployment

Unified Messaging in Exchange 2013

Publish Exchange 2013

Why you should not use yourdomain.local domain?

Microsoft recommended use of .local domain when Microsoft released Microsoft Small Business Server. Microsoft also understood that an SBS customer may not have in house expertise to manage Active Directory Domain and Exchange Server. Microsoft understood that SBS user will not have proper firewall. It is obvious that Exchange autodiscovery, single sign on for SharePoint and Lync Server was not in scenario at that time. So Microsoft recommended use of .local domain in Active Directory. Those who worked in SBS environment thought that they could take that concept now and implement .local domain in any organization which is a fundamental design flaw.

You have to understand  that .local domain was a past concept. Moving forward technology has changed a lot since then. You should change yourself when technology changes. But when I visit clients I see that old dog doesn’t learn new trick. Which means their autodiscovery doesn’t work. These clients end up with many issues including blaming Microsoft. You should ask yourself did you design your Active Directory and DNS correctly. Why you expect your autodiscovery to function correctly when your DNS is messy?

When you are promoting a new domain or a new forest, it is highly recommended that you use registered domain name for example yourdomain.com.au. Again those who worked in past SBS era they will raise concern of hacking, TLD etc. I would address their concern by putting the question to them, did you design and configure a correct firewall and security in your corporate infrastructure. If not then you should hire a security professional who will address your concern. Simply promoting a yourdomain.local domain will not secure your domain and you will have a false sense of security that your Active Directory is safe. In realty your corporate network might be open and vulnerable to hacking.

Here are why you should use yourdomain.com.au or registered domain in Active Directory.

• To implement correct Exchange Autodiscovery
• To discover correct registered domain for SharePoint and Lync Server
• To implement single sign on
• To install correct public certificates for Exchange, SharePoint and Lync. Note that Public Certificate Authority no longer issue certificate using .local domain
• To use correct UPN of your registered domain
• To setup correct local and public DNS
• To design correct Active Directory. You shouldn’t use SBS server as your model. Microsoft retired SBS for many reasons. Brutal truth is Microsoft didn’t want to lose poor customer who couldn’t afford an open license or software assurance so most of SBS users got OEM license through hardware vendor or a reseller.
• To follow the guidelines of IANA and IEEE when you deal with a domain.

What should you do if you already have a .local domain in SBS server?

If your SBS server is 2008, then create an Active Directory DNS zone using registered domain example: yourdomain.com.au then add HOST (A) record with PTR of webmail or mail and autodiscovery in yourdomain.com.au zone. Create public DNS record for webmail.yourdomain.com.au and autodiscover.yourdomain.com.au.

http://www.yourdomain.com.au (example registered domain) doesn’t resolve after creating yourdomain.com.au?

This happened when http://www.yourdomain.com.au is hosted with third party web hoster not internally. There is an easy fix, create a DNS forwarder or conditional forward for your http://www.yourdomain.com.au. Follow this URL to configure a conditional forwarder. For example: you can forward http://www.yourdomain.com.au to Google DNS server or the DNS server of your ISP or your web hoster who is actually hosting http://www.yourdomain.com.au. To find out who is hosting your website and their DNS record, go to https://www.easywhois.com/ type yourdomain.com.au and hit enter.

Further Study:

http://microsoftguru.com.au/2011/05/28/microsoft-active-directory-best-practice/ 

http://microsoftguru.com.au/2012/07/29/microsoft-active-directory-best-practice-part-ii/

http://www.mdmarra.com/2012/11/why-you-shouldnt-use-local-in-your.html 

http://technet.microsoft.com/en-us/library/cc757172%28v=ws.10%29.aspx

http://technet.microsoft.com/en-us/library/cc754941.aspx

http://technet.microsoft.com/en-us/library/cc794735%28v=ws.10%29.aspx

Exchange 2013 Upgrade, Migration and Co-existence

Migration Guide

Exchange 2007/2010 to Exchange 2013 Migration Step by Step Guide

How to Configure Unified Messaging in Exchange 2013 Step by Step

Mail flow in Exchange 2013

Source: Microsoft TechNet

Source: Microsoft TechNet

Protocol	Exchange 2007 & Exchange 2013	Exchange 2007 & Exchange 2013
Namespace	legacy.domain.com	no additional namespace
OWA	Non-silent redirection to legacy.domain.com	Proxy to CAS2010 Silent direction
EAS	Proxy to MBX2013	Proxy to CAS2010
Outlook Anywhere	Proxy to CAS2007	Proxy to CAS2010
Autodiscover	Redirect to CAS2007	Proxy to CAS2010
EWS	Autodiscover	Proxy to CAS2010
POP/IMAP	Redirect to CAS2007	Proxy to CAS2010
OAB	Redirect to CAS2007	Proxy to CAS2010
RPS	N/A	Proxy to CAS2010
ECP	N/A	Proxy to CAS2010

Exchange 2013 Perquisites

Supported Co-existence Scenario

• Exchange 2010 SP3
• Exchange 2007 SP3+RU10

Supported Client

• Outlook Anywhere Only, Outlook 2007 or later
• Outlook for Mac 2011
• Entourage 2008 for Mac

Active Directory

• Windows 2003 Forest Functional Level or higher
• At least one global catalog. two global catalog is highly recommended for redundancy purpose
• No support for RODC or ROGC

Namespace

• Contiguous
• Non-Contiguous
• Single level Domain
• disjoint

Operating Systems

• Windows Server 2008 R2 SP1
• Windows Server 2012 or Windows Server 2012 R2

Other Components

• Internet Information Service (IIS)
• .Net Framework 4.5
• Unified Communication Managed API

Cumulative Updates

• CU is a full exchange installer or binary
• Required for co-existence with Exchange 2007/2010

Upgrade from Exchange 2010 to Exchange 2013

1. Prepare

• Prepare Exchange 2010 with SP3
• Test Exchange using Test cmdlets
• Test Active Directory health status
• Prepare Active Directory Schema using Exchange 2013 schema

2. Deploy Exchange 2013

• Install both Exchange 2013 MBX and CAS servers
• Install Management Server on admin PC

3. Obtain and deploy Certificates

• Create Certificate CSR from Exchange 2013
• Sign the certificate from public CA
• Install Certificate and assign certificate to IIS,SMTP,POP,IMAP

OR

• Export certificate from Exchange 2010 and import into Exchange 2013

4. Configure Mail flow

• Create mail and autodiscover namespace and point to Exchange 2013
• Add Exchange 2013 MBX server into Send Connector
• Configure Frontend receive connector
• Create anonymous relay

5. Switch Primary Name Space

• Switch OWA, ActiveSync and SMTP traffic to Exchange 2013
• Use TMG/UAG to switch OWA and ActiveSync to Exchange 2013
• Switch port 25 forwarding to Exchange 2013
• Validate traffic flow to Exchange 2013

6. Move Mailboxes

• Build Exchange DAG
• Migrate user mailbox
• Migrate resource mailbox
• Migrate public folders

7. Repeat additional sites

8. Decommission Exchange 2010

Upgrade from Exchange 2007 to Exchange 2013

1. Prepare

• Prepare Exchange 2007 with SP3 +RU
• Test Exchange using Test cmdlets
• Test Active Directory health status
• Prepare Active Directory Schema using Exchange 2013 schema

2. Deploy Exchange 2013

• Install both Exchange 2013 MBX and CAS servers
• Install Management Server on admin PC

3. Obtain and deploy Certificates

• Create a certificate CSR from Exchange 2013 with legacy namespace
• Sign the certificate from public CA
• Install Certificate and assign certificate to Exchange 2013 IIS,SMTP,POP,IMAP
• Install same certificate into Exchange 2007

4. Configure Mail flow

• Create legacy DNS record pointing to Exchange 2007
• Create mail and autodiscover namespace and point to Exchange 2013 CAS
• Create Send Connector in Exchange 2013
• Configure Frontend receive connector
• Create anonymous relay

5. Switch Primary Name Space

• Switch OWA, ActiveSync and SMTP traffic to Exchange 2013
• Use TMG/UAG to switch OWA and ActiveSync to Exchange 2013
• Switch port 25 forwarding to Exchange 2013
• Validate traffic flow to Exchange 2013 using MCA and ExRCA

6. Move Mailboxes

• Build Exchange DAG
• Migrate user mailbox
• Migrate resource mailbox
• Migrate public folders

7. Repeat additional sites

8. Decommission Exchange 2007

Validate External Connectivity

• Use Microsoft connectivity analyzer https://testconnectivity.microsoft.com/?tabid=client 
• Use remote connectivity analyzer http://www.exrca.com 
• Use Test cmdlets

Certificate Best Practice

• Minimize number of certificates
• Minimize number of host name
• use split DNS for Exchange host name
• Don’t list machine name in certificates
• Use Subject Alternative Name Certificate or SAN certificates

Restart Transport Services and Information Store Service

• Patch Exchange Server using WSUS or ConfigMgr
• Reboot DAG member one by one
• Reboot CAS server one by one
• Management Tools
• User Exchange 2013 Administration Center to manage co-existence and migration tasks
• Use Exchange 2010 management console to move offline address book

Cutover Process

• Public folder migration is part of final cutover
• Exchange and Active Directory health check
• verify proposed and implemented Exchange 2013

Post Migration

• Shutdown Exchange 2010 servers for minimum 48 hours in working days
• Decommission Exchange 2010

Exchange 2007/2010 to Exchange 2013 Migration Step by Step Guide

Before you begin, create a work sheet in spreadsheet recording required information to migrate Exchange 2007/2010 to Exchange 2013. For this article, I am going to use following work sheet. This work sheet and migration guide are tested in production exchange migration which I did for few of my clients. Note that this article is not situation specific hence I can’t provide you a silver bullet for your situation.

Deployment Work Sheet

Version Readiness Check

Present Server	Proposed Server
Exchange 2007 SP3 OR 2010 SP3	Exchange 2013 CU3

Exchange Role Assignment

Exchange 2013 has two server roles; the Mailbox and Client Access server roles. You need at least one Client Access server and one Mailbox server in the Active Directory forest. If you’re separating your server roles, Microsoft recommend installing the Mailbox server role first.

Mailbox Role: The Mailbox server includes the Client Access protocols, the Transport service, the Mailbox databases, and Unified Messaging (the Client Access server redirects SIP traffic generated from incoming calls to the Mailbox server). The Mailbox server handles all activity for the active mailboxes on that server.

Client Access: The Client Access server provides authentication, limited redirection, and proxy services for all of the usual client access protocols: HTTP, POP and IMAP, and SMTP. The Client Access server, a thin and stateless server, doesn’t do any data rendering. With the exception of diagnostic logs, nothing is queued or stored on the Client Access server.

Server Name	Exchange Roles
AUPEREXMBX01,AUPEREXMBX02	Mailbox
AUPEREXCAS01,AUPEREXCAS02	CAS

Active Directory Schema and Forest

When you install Exchange 2013 for the first time, your Active Directory schema will be updated. This schema update is required to add objects and attributes to Active Directory to support Exchange 2013. Additionally, replicating the changes made to your schema may take several hours or days and is dependent on your Active Directory replication schedule. A forced replication can be performed after schema preparation.

Description	AD Forest	Domain Controller
Primary SMTP namespace	Superplaneteers.com	AUPERDC01,AUPERDC02
User principal name domain	Superplaneteers.com	AUPERDC01,AUPERDC02

Legacy Edge Transport

N/A

Network Configuration

Server Name	TCP/IP	DNS	Replication network
AUPEREXMBX01	10.10.10.11	10.10.10.2 10.10.10.3	192.168.100.11/24
AUPEREXMBX02	10.10.10.12	10.10.10.2 10.10.10.3	192.168.100.12/24
AUPEREXCAS01	10.10.10.13	10.10.10.2 10.10.10.3	N/A
AUPEREXCAS02	10.10.10.14	10.10.10.2 10.10.10.3	N/A

The network adapter name used within the operating system of mailbox server must be changed to closely match the associated network name. For example: Domain Network and Replication Network. The following binding order must be maintained within Windows operating systems:

1. First in Order- Domain adapter connected to the Active Directory network
2. Second in Order- Replication adapter connected to the heartbeat network.

Here is a guide how to change adapter binding order http://technet.microsoft.com/en-us/library/cc732472(v=ws.10).aspx Microsoft does not support multiple default gateways on a single server, no default gateway is required on the replication network card.

Disk layout

Server Name	C:	E:	F:	G:
AUPEREXMBX01	50 GB	50 GB	500GB	300GB
AUPEREXMBX02	50 GB	50 GB	500GB	300GB
AUPEREXCAS01	50 GB	50 GB	N/A	N/A
AUPEREXCAS02	50 GB	50 GB	N/A	N/A

Resilient Exchange Configuration

Purpose	Name	TCP/IP	Subnet	Type
DAG	AUPEREXDAG01	10.10.10.15	255.255.255.0	N/A
CAS NLB or Load Balancer	Mail.superplaneteers.com	10.10.10.16	255.255.255.0	Multicast

Exchange Administrator

User name	Privileges
ExMigrationAdmin	Domain Admins Domain user Schema Admin Enterprise Admin Organisation Management Local Administrator

Certificates

A public Secure Sockets Layer (SSL) certificate is a prerequisite in Exchange 2013. SSL helps to protect communication between your Exchange servers and clients and other mail servers by encrypting data and, optionally, identifying each side of the connection.

You can buy a third-party certificate from public CA such as Verisign. Certificates published by public CAs are trusted by most operating systems and browsers.

Common Name	Subject Alternative	Type	Assigned to
mail.superplaneteers.com	autodiscover.superplaneteers.com	SSL	IIS,SMTP,POP,IMAP

Supported Client

Exchange 2013 supports the following minimum versions of Microsoft Outlook and Microsoft Entourage for Mac:

• Outlook 2013 (15.0.4420.1017)
• Outlook 2010 Service Pack 1 with the Outlook 2010 November 2012 update (14.0.6126.5000).
• Outlook 2007 Service Pack 3 with the Outlook 2007 November 2012 update (12.0.6665.5000).
• Entourage 2008 for Mac, Web Services Edition
• Outlook for Mac 2011

Exchange 2013 does not support Outlook 2003.

Public DNS records

DNS record	Record Type	IP/Alias/FQDN	Priority
Mail.superplaneteers.com	A	203.17.x.x	N/A
superplaneteers.com	MX	Mail.superplaneteers.com	10
Autodiscover.superplaneteers.com	CNAME	Mail.superplaneteers.com	N/A

If you have hosted email security then your MX record must look like this. An example is given here for TrendMicro hosted email security.

DNS record	Record Type	IP/Alias/FQDN	Priority
Mail.superplaneteers.com	A	203.17.x.x	N/A
superplaneteers.com	MX	in.sjc.mx.trendmicro.com	10
Autodiscover.superplaneteers.com	CNAME	Mail.superplaneteers.com	N/A

Internal DNS records

DNS record	Record Type	Hardware Load Balancer VIP or CAS NLB IP
Mail.superplaneteers.com	A	10.10.10.16
Autodiscover.superplaneteers.com	A	10.10.10.16

If you don’t have CAS NLB or hardware load balancer then create Host(A) record of mail.superplaneteers.com and point to Exchange 2013 CAS Server.

Send Connector

Here I am giving an example of TrednMicro smart host. Do not add smart host without proper authorization from smart host provider otherwise you will not be able to send email from internal organisation to external destination.

Intended use	Address Space	Network Settings	Authentication	Smart Host
Internet	“*”	default	Basic, Exchange, TLS	relay.sjc.mx.trendmicro.com

Receive Connector

Name	Intended use	Network Settings	IP Range	Server(s)
Client Frontend	Client	default	All Available IPv4	AUPEREXMBX01 AUPEREXMBX02
Default Frontend	Inbound SMTP	default	All Available IPv4	AUPEREXMBX01 AUPEREXMBX02

Anonymous Relay

Relay	Authentication	Permission	Remote IP	SMTP
Anonymous Relay	TLS, Externally Secured	Anonymous, Exchange Servers	IP Address of Printers, Scanner, Devices, App Server	10.10.10.11 10.10.10.12

Port Forwarding in Cisco Router

Rule	Source Address	Destination Address	NATed Destination	Port
OWA	Any	203.17.x.x	10.10.10.16	443
SMTP	Any	203.17.x.x	10.10.10.16	25

Again if you don’t have CAS NLB or load balancer your NATed destination is Exchange 2013 CAS server.

Mailbox Storage

Storage Group Type	Database location
Mailbox storage	F:Exchange Data
Mailbox storage logs	G:Exchange Log

Email address Policy

Email Address Policy

%g.%s@superplaneteers.com

Virtual Directory for internal and external network

Virtual directory	Internal and External URL value
Autodiscover	https://autodiscover.superplaneteers.com/autodiscover/autodiscover.xml
ECP	https://mail.superplaneteers.com/ecp
EWS	https://mail.superplaneteers.com/EWS/Exchange.asmx
Microsoft-Server-ActiveSync	https://mail.superplaneteers.com/Microsoft-Server-ActiveSync
OAB	https://mail.superplaneteers.com/OAB
OWA	https://mail.superplaneteers.com/owa
PowerShell	http://mail.superplaneteers.com/PowerShell

Since you have finished your work sheet, now you are ready to virtualize Exchange servers on Hyper-v.

1. Virtualize Windows Server 2012 R2

2. Configure TCP/IP properties

3. Disable Windows Firewall

4. Join Windows server 2012 R2 to domain.

Download following software as prerequisites.

1. Microsoft Exchange Server 2010 Service Pack 3 (SP3) OR Exchange Server 2007 Service Pack 3

2. Cumulative Update 3 for Exchange Server 2013 (KB2892464)

3. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit

4. Microsoft Office 2010 Filter Pack 64 bit

5. Microsoft Office 2010 Filter Pack SP1 64 bit

Additional Prerequisites if you would like to install Exchange 2013 on Windows Server 2008 R2 SP1.

1. Microsoft .NET Framework 4.5
2. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit
3. Microsoft Office 2010 Filter Pack 64 bit
4. Microsoft Office 2010 Filter Pack SP1 64 bit
5. Microsoft Knowledge Base article KB974405 (Windows Identity Foundation)
6. Knowledge Base article KB2619234 (Enable the Association Cookie/GUID that is used by RPC over HTTP to also be used at the RPC layer in Windows 7 and in Windows Server 2008 R2)
7. Knowledge Base article KB2533623 (Insecure library loading could allow remote code execution)

Windows Firewall

Open Control Panel > Windows Firewall. Turn off Firewall components (Domain, private and Public) completely.

Preparing Base Windows Server 2012 for Exchange 2013

Mailbox Server Role in Windows Server 2012 R2

To install prerequisites in Windows Server 2012, open Windows PowerShell as an administrator. Execute the following cmdlet one by one.

Import-Module ServerManager

Install-WindowsFeature RSAT-ADDS

Install-WindowsFeature AS-HTTP-Activation, Desktop-Experience, NET-Framework-45-Features, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation

Reboot Windows Server 2012

Client Access Server Role in Windows Server 2012 R2

To install prerequisites in Windows Server 2012, open Windows PowerShell as an administrator, Execute the following cmdlet one by one.

Import-Module ServerManager

Install-WindowsFeature RSAT-ADDS

Install-WindowsFeature AS-HTTP-Activation, Desktop-Experience, NET-Framework-45-Features, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation

Reboot Windows Server 2012

If you are installing Exchange 2013 on Windows Server 2008 R2 SP1.

Prepare mailbox role Windows Server 2008 R2 SP1

Open Windows PowerShell as an administrator, Execute the following cmdlets one by one.

Import-Module ServerManager

Add-WindowsFeature Desktop-Experience, NET-Framework, NET-HTTP-Activation, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Web-Server, WAS-Process-Model, Web-Asp-Net, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI

Reboot Windows Server 2008 R2

Prepare Client Access in Windows Server 2008 R2

Open Windows PowerShell, Execute the following cmdlet one by one.

Import-Module ServerManager

Add-WindowsFeature Desktop-Experience, NET-Framework, NET-HTTP-Activation, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Web-Server, WAS-Process-Model, Web-Asp-Net, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI

Reboot Windows Server 2008 R2

Install Service pack 3 on exchange 2010

Upgrading to SP3 requires a schema update, review the Active Directory Schema changes beforehand. Upgrade your Exchange servers to SP3. This should be performed in the following order:

1. CAS servers

2. Hub and/or Edge servers

3. Mailbox servers

4. Unified Messaging servers

Upgrade Exchange 2010 to Exchange 2010 SP3 level

1. Once the files are extracted, locate and run setup.exe as an administrator

2. Select Install Microsoft Exchange Upgrade.

3. Select Next at the welcome screen. Read and accept the license terms, then select Next.

4. If you’ve got all the requirements you’ll see all the green checks, Select Upgrade to begin the upgrade

5. Select Next to start the upgrade.

6. When the upgrade is complete, select Finish.

7. Reboot the server to allow changes to take affect.

Prepare Active Directory Schema

Before you prepare Active Directory, make sure your Active Directory is healthy. Follow the procedure for AD health check.

1. Prepare Active Directory in an Active Directory site where you want to install Exchange 2013.

2. Domain Controller must be Server 2008 Standard/Enterprise (x86/x64) OR Server 2008 R2 Standard / Enterprise OR Windows Server 2012 OR Windows Server 2012 R2.

3. Each domain needs at least one writeable global catalog server

4. Ensure AD replication is working properly in each site / domain

5. Ensure Active Directory is healthy. Visit active directory health check

6. Run the following command in a domain controller, Open command prompt as an administrator

repadmin /showrepl

repadmin /replsummary

repadmin /syncall

netdom query fsmo

Dcdiag /e

Netdiag

7. Open Active Directory Sites and Services MMC, make sure all domain controllers are global catalog.

8. Start Menu, Run, Type eventvwr to open event view, Review event logs to see everything is working as per normal

9. Start Menu, Run> Services.msc to open services, Check DNS server, DNS Client, File replication services are started and set to automatic

10. Open SYSVOL in all domain controllers and check everything is same in all domain controllers.

Now you are ready to prepare Active Directory Domain and Forest.

1. Extract the Exchange2013-x64-cu3.EXE package you have downloaded from Microsoft web site to a common location. In my example I will use E:EXCHANGE2013

2. Open a command prompt as an Administrator, and navigate to the directory in which you extracted the files to. In the case of this example it will be E:Exchange2013. You should see a Setup.exe file located there.

3. Run the following cmd:

• Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms

OR

• Setup.exe /PS /IacceptExchangeServerLicenseTerms

4. Run the following cmd:

• Setup.exe /PrepareAD /OrganizationName:<NAMEHERE> /IAcceptExchangeServerLicenseTerms

OR

• Setup.exe /PAD /OrganizationName:<NAMEHERE> /IAcceptExchangeServerLicenseTerms

Now replicate Active Directory manually or wait for replication to complete. Verify event logs in Domain controllers to see any unexpected error or logs pops up or not. If everything looks fine then go ahead and install Exchange 2013.

Installing Exchange 2013 CU3

1. After you have downloaded Exchange 2013 CU2, log on to the computer on which you want to install Exchange 2013.
2. Navigate to the network location of the Exchange 2013 installation files.
3. Start Exchange 2013 Setup by right clicking Setup.exe select Run as administrator
4. On the Check for Updates page, choose whether you want Setup to connect to the Internet and download product and security updates for Exchange 2013. Select Don’t check for updates right now, you can download and install updates manually later. Click Next to continue.
5. The Introduction page begins the process of installing Exchange into your organization. Click Next to continue.
6. On the License Agreement page, review the software license terms. If you agree to the terms, select I accept the terms in the license agreement, and then click Next.
7. On the Recommended settings page, select whether you want to use the recommended settings. If you select Use recommended settings, Exchange will automatically send error reports and information about your computer hardware and how you use Exchange to Microsoft. click Next.
8. On the Server Role Selection page, select both Mailbox role and Client Access role or separate role based on your design. The management tools are installed automatically if you install any other server role.
   Select Automatically install Windows Server roles and features that are required to install Exchange Server to have the Setup wizard install required Windows prerequisites. You may need to reboot the computer to complete the installation of some Windows features. If you don’t select this option, you must install the Windows features manually. Click Next to continue.
9. On the Installation Space and Location page, click Browse to choose a new location. I strongly recommend you installing Exchange 2013 on a separate partition other then C: drive. Click Next to continue.
10. On the Malware Protection Settings page, choose whether you want to enable or disable malware scanning. If you disable malware scanning, it can be enabled in the future. Unless you have a specific reason to disable malware scanning, we recommend that you keep it enabled. Click Next to continue.
11. On the Readiness Checks page, view the status to determine if the organization and server role prerequisite checks completed successfully. click Next to run the prerequisite check again. Be sure to also review any warnings that are reported. If all readiness checks have completed successfully, click Install to install Exchange 2013.
12. On the Completion page, click Finish.
13. Restart the computer after Exchange 2013 has completed.
14. Once rebooted log on to Exchange server and review Event Logs in Exchange Server.
15. Repeat the steps for all Exchange Server 2013 in your organisation.

Create a Test mailbox

1. Open the EAC by browsing to the URL of your Client Access server. For example, https://AUPEREXCAS01/ecp?ExchClientVer=15.

2. Enter the user name and password of the account you used to install Exchange 2013 in Domainuser name and Password, and then click Sign in.

3. Go to Recipients > Mailboxes. On the Mailboxes page, click Add and then select User mailbox.

4. Provide the information required for the new user and then click Save.

5. Go to Permissions > Admin Roles. On the Admin Roles page, select Organization Management and click Edit .

6. Under Members, click Add .

7. Select the Exchange 2013 mailbox you just created, click Add, then click OK. Then click Save.

Install Exchange 2013 certificates

Depending on your requirements, you can configure wild card certificate or a SAN certificate. I will go for SAN certificate to avoid further configuration such as certificate principal name configuration. In this example, I will create a SAN certificate which is as follows.

1. Open the EAC by browsing to the URL of your Client Access server. For example, https://AUPEREXCAS01/ecp?ExchClientVer=15.
2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
3. Go to Servers > Certificates. On the Certificates page, make sure your Client Access server is selected in the Select server field, and then click New .
4. In the New Exchange certificate wizard, select Create a request for a certificate from a certification authority and then click Next.
5. Specify a name for this certificate and then click Next.
6. If you want to request a wildcard certificate, select Request a wild-card certificate and then specify the root domain of all subdomains in the Root domain field. If you don’t want to request a wildcard certificate and instead want to specify each domain you want to add to the certificate, leave this page blank. Click Next.
7. Click Browse and specify an Exchange server to store the certificate on. The server you select should be the Internet-facing Client Access server. Click Next.
8. For each service in the list shown, verify that the external or internal server names that users will use to connect to the Exchange server are correct. For example: CN=mail.superplaneteers.com and SAN=autodiscover.superplaneteers.com
9. These domains will be used to create the SSL certificate request. Click Next.
10. Add any additional domains you want included on the SSL certificate.
11. Select the domain that you want to be the common name for the certificate and click Set as common name. For example, mail.superplaneteers.com. Click Next.
12. Provide information about your organization. This information will be included with the SSL certificate. Click Next.
13. Specify the network location where you want this certificate request to be saved. Click Finish.

After you’ve saved the certificate request, submit the request to your certificate authority (CA) which is public CA. Clients that connect to the Client Access server must trust the CA that you use. After you receive the certificate from the CA, complete the following steps:

1. On the Server > Certificates page in the EAC, select the certificate request you created in the previous steps.
2. In the certificate request details pane, click Complete under Status.
3. On the Complete pending request page, specify the path to the SSL certificate file and then click OK.
4. Select the new certificate you just added, and then click Edit .
5. On the certificate page, click Services.
6. Select the services you want to assign to this certificate. At minimum, you should select IIS but you can also select IMAP, POP, SMTP and UM call router if you use these services. Click Save.
7. If you receive the warning Overwrite the existing default SMTP certificate?, click Yes.

To re-use existing certificate follow the steps below

1. Log on directly to your Exchange 2010 Client Access server with an administrator user account.
2. Open an empty Microsoft Management Console (MMC).
3. Click File, then Add/Remove Snap-in.
4. In the Add or Remove Snap-ins window, select Certificates and then click Add >.
5. In the Certificates snap-in window that appears, select Computer account and click Next.
6. Select Local computer and click Finish. Then click OK.
7. Under Console Root, expand Certificates (Local Computer), Personal, and then Certificates.
8. Select the 3rd-party certificate that’s used by Exchange 2010 that matches the host names you’ve configured on the Exchange 2013 server. This must be a 3rd-party certificate and not a self-signed certificate.
9. Right-click on the certificate and select All Tasks and then Export….
10. In the Certificate Export Wizard, click Next.
11. Select Yes, export the private key and click Next.
12. Make sure Personal Information Exchange – PKCS #12 (.PFX) and Include all certificates in the certification path if possible are selected. Make sure no other options are selected. Click Next.
13. Select Password and enter a password to help secure your certificate. Click Next.
14. Specify a file name for the new certificate. Use the file extension .pfx. Click Next and then click Finish.
15. You’ll receive a confirmation prompt if the certificate export was successful. Click OK to close it.
16. Copy the .pfx file you created to your Exchange 2013 Client Access server.

After you’ve exported the certificate from your Exchange 2010 server, you need to import the certificate on your Exchange 2013 server using the following steps.

1. Log on directly to your Exchange 2013 Client Access server with an administrator user account.
2. Open an empty Microsoft Management Console (MMC).
3. Click File, then Add/Remove Snap-in.
4. In the Add or Remove Snap-ins window, select Certificates and then click Add >.
5. In the Certificates snap-in window that appears, select Computer account and click Next.
6. Select Local computer and click Finish. Then click OK.
7. Under Console Root, expand Certificates (Local Computer), and then Personal.
8. Right-click Personal and select All Tasks and then Import….
9. In the Certificate Import Wizard, click Next.
10. Click Browse and select the .pfx file you copied to your Exchange 2013 Client Access server. Click Open and then click Next.
11. In the Password field, enter the password you used to help secure the certificate when you exported it on the Exchange 2010 Client Access server.
12. Verify that Include all extended properties is selected and click Next.
13. Verify that Place all certificates in the following store is selected and Personal is shown in Certificate store. Click Next. Click Finish.
14. You’ll receive a confirmation prompt if the certificate import was successful. Click OK to close it.

Now that the new certificate has been imported on your Exchange 2013 Client Access server, you need to assign it to your Exchange services using the following steps.

1. Open the EAC by browsing to the URL of your Client Access server. For example, https://Ex2013CAS/ECP.
2. Open the EAC by browsing to the URL of your Client Access server. For example, https://Ex2013/ECP.
3. Enter your user name and password in Domainuser name and Password, and then click Sign in.
4. On the Server > Certificates page in the EAC, select the new certificate you just added, and then click Edit .
5. On the certificate page, click Services.
6. Select the services you want to assign to this certificate. At minimum, you should select IIS but you can also select IMAP, POP, SMTP and UM call router if you use these services. Click Save.
7. If you receive the warning Overwrite the existing default SMTP certificate?, click Yes.

Configure Exchange 2013 external and internal URLs

1. Open the EAC by browsing to the URL of your Client Access server. For example, https://AUPEREXCAS01/ecp?ExchClientVer=15.
2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
3. Go to Servers > Servers, select the name of the Internet-facing Exchange 2013 Client Access server and then click Edit .
4. Click Outlook Anywhere.
5. In the Specify the external hostname field, specify the externally accessible FQDN of the Client Access server. For example, mail.superplaneteers.com.
6. While you’re here, let’s also set the internally accessible FQDN of the Client Access server. In the Specify the internal hostname field, insert the FQDN you used in the previous step. For example, mail. superplaneteers.com.
7. Click Save.
8. Go to Servers > Virtual directories and then click Configure external access domain .
9. Under Select the Client Access servers to use with the external URL, click Add .
10. Select the Client Access servers you want to configure, and then click Add. After you’ve added all the Client Access servers you want to configure, click OK.
11. In Enter the domain name you will use with your external Client Access servers, type the external domain you want to apply. For example, mail.superplaneteers.com. Click Save.

Configure External and Internal URL to be same

1. Open the Exchange Management Shell on your Exchange 2013 Client Access server.
2. Store the host name of your Client Access server in a variable that will be used in the next step. For example, In my case, mail.superplaneteers.com

$HostName = “mail.superplaneteers.com “

3. Run each of the following commands in the Shell to configure each internal URL to match the virtual directory’s external URL.

Set-EcpVirtualDirectory “$HostNameECP (Default Web Site)” -InternalUrl ((Get-EcpVirtualDirectory “$HostNameECP (Default Web Site)”).ExternalUrl)

Set-WebServicesVirtualDirectory “$HostNameEWS (Default Web Site)” -InternalUrl ((get-WebServicesVirtualDirectory “$HostNameEWS (Default Web Site)”).ExternalUrl)

Set-ActiveSyncVirtualDirectory “$HostNameMicrosoft-Server-ActiveSync (Default Web Site)” -InternalUrl ((Get-ActiveSyncVirtualDirectory “$HostNameMicrosoft-Server-ActiveSync (Default Web Site)”).ExternalUrl)

Set-OabVirtualDirectory “$HostNameOAB (Default Web Site)” -InternalUrl ((Get-OabVirtualDirectory “$HostNameOAB (Default Web Site)”).ExternalUrl)

Set-OwaVirtualDirectory “$HostNameOWA (Default Web Site)” -InternalUrl ((Get-OwaVirtualDirectory “$HostNameOWA (Default Web Site)”).ExternalUrl)

Set-PowerShellVirtualDirectory “$HostNamePowerShell (Default Web Site)” -InternalUrl ((Get-PowerShellVirtualDirectory “$HostNamePowerShell (Default Web Site)”).ExternalUrl)

To verify that you have successfully configured the internal URL on the Client Access server virtual directories, do the following:

1. In the EAC, go to Servers > Virtual directories.
2. In the Select server field, select the Internet-facing Client Access server.
3. Select a virtual directory and then click Edit .
4. Verify that the Internal URL field is populated with the correct FQDN.

Move Arbitration Mailboxes

Follow the below steps to move all arbitration and discovery search mailboxes to 2013 database.

Open Exchange Management Shell with run as administrator and run the following cmds

Get‐Mailbox –Arbitration | New-MoveRequest –TargetDatabase TargetDBName

Get-Mailbox “*Discovery*” | New-MoveRequest –TargetDatabase TargetDBName

OR

Type the following comdlets in EMS to find arbitration mailboxes and migrate using migration wizard.

Get-Mailbox –Arbitration >C:Arbitration.txt

Get-Mailbox “*Discovery*” >C:Discovery.txt

1. In the EAC, go to Recipients > Migration.
2. Click New , and then click Move to a different database.
3. On the New local mailbox move page, click Select the users that you want to move, and then click Add .
4. On the Select Mailbox page, add the mailbox that has the following properties:
   • The display name is Microsoft Exchange.
   • The alias of the mailbox’s email address is SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}.
5. Click OK, and then click Next.
6. On the Move configuration page, type the name of the migration batch, and then click Browse next to the Target database box.
7. On the Select Mailbox Database page, add the mailbox database to move the system mailbox to. Verify that the version of the mailbox database that you select is Version 15. x, which indicates that the database is located on an Exchange 2013 server.
8. Click OK, and then click Next.
9. On the Start the batch page, select the options to automatically start and complete the migration request, and then click New.

Enable and configure Outlook Anywhere

To allow your Exchange 2013 Client Access server to redirect connections to your Exchange 2010 servers, you must enable and configure Outlook Anywhere on all of the Exchange 2010 servers in your organization. If some Exchange 2010 servers in your organization are already configured to use Outlook Anywhere, their configuration must also be updated to support Exchange 2013. When you use the steps below to configure Outlook Anywhere, the following configuration is set on each Exchange 2010 server:

1. Open the Exchange Management Shell on your Exchange 2010 Client Access server.
2. Store the external host name of your Exchange 2013 Client Access server in a variable that will be used in the next steps. For example, mail.superplaneteers.com.

$Exchange2013HostName = “mail.superplaneteers.com”

Run the following command to configure Exchange 2010 servers that already have Outlook Anywhere enabled to accept connections from Exchange 2013 servers.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Get-ClientAccessServer | Where {$_.OutlookAnywhereEnabled -Eq $True} | ForEach {Set-OutlookAnywhere “$_RPC (Default Web Site)” -ClientAuthenticationMethod Basic -SSLOffloading $False -ExternalHostName $Exchange2013HostName -IISAuthenticationMethods NTLM, Basic}

If you didn’t enable Outlook Anywhere in Exchange 2010 already, Run the following command to enable Outlook Anywhere and configure Exchange 2010 to accept connections from Exchange 2013 servers.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Get-ClientAccessServer | Where {$_.OutlookAnywhereEnabled -Eq $False} | Enable-OutlookAnywhere -ClientAuthenticationMethod Basic -SSLOffloading $False -ExternalHostName $Exchange2013HostName -IISAuthenticationMethods NTLM, Basic

Configure service connection point (SCP)

Autodiscover uses an Active Directory object called the service connection point (SCP) to retrieve a list of AutoDiscover URLs for the forest in which Exchange is installed. When you install Exchange 2013, you need to update the SCP object to point to the Exchange 2013 server. This is necessary because Exchange 2013 servers provide additional AutoDiscover information to clients to improve the discovery process.

You must update the SCP object configuration on every Exchange server in the organization. You need to use the version of the Exchange Management Shell that corresponds to the version of the Exchange servers you’re updating.

Perform the following steps to configure the SCP object on your Exchange 2010 servers.

1. Open the Exchange Management Shell on your Exchange 2010 Client Access server.
2. Store the AutoDiscover host name of your Exchange 2013 Client Access server in a variable that will be used in the next step. For example, autodiscover.superplaneteers.com.

$AutodiscoverHostName = “autodiscover.superplaneteers.com”

Run the following command to set the SCP object on every Exchange 2010 server to the AutoDiscover URL of the new Exchange 2013 server.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Set-ClientAccessServer -AutoDiscoverServiceInternalUri https://$AutodiscoverHostName/Autodiscover/Autodiscover.xml

Perform the following steps to configure the SCP object on your Exchange 2013 servers.

1. Open the Exchange Management Shell on your Exchange 2013 Client Access server.
2. Store the AutoDiscover host name of your Exchange 2013 Client Access server in a variable that will be used in the next step. For example, autodiscover.superplaneteers.com.

$AutodiscoverHostName = “autodiscover.superplaneteers.com”

Run the following command to set the SCP object on every Exchange 2013 server to the AutoDiscover URL of the new Exchange 2013 server.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 15*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Set-ClientAccessServer -AutoDiscoverServiceInternalUri https://$AutodiscoverHostName/Autodiscover/Autodiscover.xml

Configure Exchange 2013 Mail flow

Receive connectors

There are four receive connectors in Exchange 2013. They are:

· Default <server name>   Accepts connections from Mailbox servers running the Transport service and from Edge servers.

· Client Proxy <server name>   Accepts connections from front-end servers. Typically, messages are sent to a front-end server over SMTP.

· Default FrontEnd <server name>   Accepts connections from SMTP senders over port 25. This is the common messaging entry point into your organization.

· Outbound Proxy Frontend <server name>   Accepts messages from a Send Connector on a back-end server, with front-end proxy enabled.

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server. Click Mail flow, Click Receive Connector

2. Select Default Frontend AUPERMBX01, Click on Edit or Pencil icon, On the Security Parameter, Select Anonymous, Click Save.

3. Repeat the steps for Default Frontend AUPERMBX02.

Send connector:

All you have to do is to add Exchange 2013 mailbox servers to the existing send connector as shown below:

Open Exchange management Shell as an administrator, execute the following command.

Set-SendConnector –Identity Outbound –SourceTransportServers AUPEREXMBX01, AUPEREXMBX02

OR

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server. Click Mail flow, Click Send Connector, Click Edit or Pencil icon

2. Click on scoping and + icon on Source Server parameter to add the server

3. Select the Exchange 2013 Mailbox servers (AUPEREXMBX01 and AUPEREXMBX02) and add them and Click save.

4. Send connector configuration completed.

Configure a smart host if necessary

1. In the EAC https://AUPEREXCAS01/ecp?ExchClientVer=15, navigate to Mail flow > Send connectors, and then click Add .

2. In the New send connector wizard, specify a name for the send connector and then select Custom for the Type. You typically choose this selection when you want to route messages to computers not running Microsoft Exchange Server 2013. Click Next.

3. Choose Route mail through smart hosts, and then click Add . In the Add smart host window, the fully qualified domain name (FQDN), such as relay.sjc.mx.trendmicro.com. Click Save.

4. Under Address space, click Add . In the Add domain window, make sure SMTP is listed as the Type. For Fully Qualified Domain Name (FQDN), enter * to specify that this send connector applies to messages sent to any domain. Click Save.

5. For Source server, click Add . In the Select a server window, choose a server and click Add . Click OK.

6. Click Finish.

Anonymous Relay

Create a new receive connector using Exchange Administration Center with the following parameters.

• Name: Anonymous Relay
• Role: Frontend Transport
• Type: Custom
• Available IP: Exchange 2013 server IP
• Port: 25
• Security: Anonymous
• Authentication: TLS, Externally Secured
• Permission: Exchange Servers, Anonymous users

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server. Click Mail flow, Click Receive Connector, Click Add or + icon

2. Select an Exchange Mailbox Server name AUPEREXMBX01, Type Anonymous Relay on the name, Click Frontend transport, Select Custom, Click Next..

3. On the Network Adapter Binding, Add Exchange 2013 MBX Server IP (10.10.10.11) and port 25. On the remote network settings, add printer, scanner, device and application server IPs. Click Save to create Anonymous Relay.

4. Select newly created Anonymous relay, Click Edit or Pencil Icon, Click Security parameter, Select TLS, Externally Secured in Authentication and Select Exchange Servers, Anonymous users in Permission groups.

5. Open Exchange 2013 Management Shell and execute the following

Get-ReceiveConnector “Anonymous Relay” | Add-ADPermission -User “NT AUTHORITYANONYMOUS LOGON” -ExtendedRights “Ms-Exch-SMTP-Accept-Any-Recipient”

6. Open Exchange management Shell in Exchange 2010 execute cmdlet

Get-ReceiveConnector –Identity “Anonymous relay” | Fl

From PowerShell Windows copy all the IP addresses of printer and scanner to a notepad

7. Edit Anonymous Relay in Exchange 2013 Administration center and add all the IPs addresses you copied in previous step into remote network setting of Exchange 2013 relay.

8. Repeat step 1 to step 7 on all mailbox servers.

Configure Public Name Space

At this stage, you are ready to configure public DNS record. Update your public DNS record including Hosted Email Security. You only need to configure public DNS if you are changing public IPs and hosted email security otherwise you just have to change the port 443 and port 25 forwarding rule in internal Cisco router in your organization.

You public DNS must look similar to this table.

superplaneteers.com	MX	Mail.superplaneteers.com
mail.superplaneteers.com	A	203.17.x.x (Public IP)
autodiscover.superplaneteers.com	A	203.17.x.x (Public IP)

Request your ISP who provided you 203.17.x.x public IP to create reverse DNS record for mail.superplaneteers.com. This is very important for Exchange to function correctly. When you send email to a destination, many destination server checks reverse DNS. If reverse DNS is wrong you could be banned from sending email to destination server. Note that outlook.com check reverse DNS and SPF records of domain sending email to an outlook address.

Configure TMG/UAG

If you are publishing internet facing Exchange 2013 CAS using TMG or UAG, follow the URL below and publish Outlook Web App and Active Sync.

Publish-exchange-server-2010-using-forefront-uag-2010-step-by-step/

Publish-outlook-web-access-and-exchange-servers-using-forefront-tmg-2010/

Create internal DNS Record

Create Host(A) record with reverse DNS in the forward lookup zone of forest superplaneteers.com. Internal DNS records must look similar to this table.

FQDN	Record Type	IP Address
Mail.superplaneteers.com	A	10.10.10.16
Autodiscover.superplaneteers.com	A	10.10.10.16

If you don’t have CAS NLB or load balancer then your internal host(A) record must point to Exchange 2013 CAS server.

Open PowerShell as an administrator, execute the following

Resove-Dnsname mail.superplaneteers.com

Nslookup mail.superplaneteers.com

Configure Offline Address Book

To create a new offline address book and set the same OAB on all mailbox databases at once, run the following command. The command example uses “Default Offline Address Book” for the name of the OAB.

Open Exchange Management Shell, execute the cmdlets

New-OfflineAddressBook -Name “Default Offline Address Book” -AddressLists “Default Global Address List”

Restart-Service MSExchangeMailboxAssistants

Wait a few minutes and check if the OAB files is created in C:Program FilesMicrosoftExchange ServerV15ClientAccessOAB<newGUID>

Try to access the new OAB in IE: https://mail.superplaneteers.com/oab/<newguid/oab.xml

Get-MailboxDatabase | Set-MailboxDatabase -OfflineAddressBook “Default Offline Address Book (Ex2013)”

To Change the generation server open Exchange 2010 Management Shell and run the following command:

Move-OfflineAddressBook –Identity “Default Offline Address Book” –Server AUPERCAS01,AUPERCAS02

Configure new transport rule in Exchange 2013 or Export transport rules from legacy Exchange.

Follow this reference if you are migrating from Exchange 2007

You cannot migrate transport rules from Exchange Server 2007 to Exchange Server 2013

The following cmdlet example exports all your Transport Rules to the XML file, ExportedRules.xml, in the “c:TransportRules” folder:

Export-TransportRuleCollection -FileName “c:TransportRulesExportedRules.xml”

The following example cmdlet imports your transport rule collection from the XML file ExportedRules.xml in the “C:TransportRules” folder

[Byte[]]$Data = Get-Content -Path “C:TransportRulesExportedRules.xml” -Encoding Byte -ReadCount 0 Import-TransportRuleCollection -FileData $Data

To create new Transport rule,

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server.

2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
3. Click Mail Flow, Click Rules, Click Add or + Icon, Type the Name of Rule, Select rule conditions, Click More Option.
4. Select Date when you would like to activate the rule
5. Click whether you would like to enforce the rule or test the rule
6. Follow the wizard to finish the rule settings.

Move mailboxes to Exchange 2013

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server.
2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
3. Go to Recipients > Migration, click Add and then select Move to a different database.
4. Under Select the users that you want to move, click Add .
5. In the Select Mailbox window, select the mailboxes you want to move, click Add and then OK.
6. Verify that the mailboxes you want to move are listed and then click Next.
7. Specify a name for the new mailbox move and verify that Move the primary mailbox and the archive mailbox if one exists is selected.
8. Under Target database, click Browse.
9. In the Select Mailbox Database window, select a mailbox database on the Exchange 2013 server that you want to move the mailboxes to, click Add and then OK.
10. Verify that the mailbox database displayed in Target database is correct and then click Next.
11. Decide which user should receive the mailbox move report once the move is complete. By default, the current user will receive the move report. If you want to change which user receives the report, click Browse and select a different user.
12. Verify Automatically start the batch is selected.
13. Decide whether you want to have mailbox moves automatically complete. During the finalization phase, the mailbox is unavailable for a short time. If you choose to complete the mailbox move manually, you can decide when the move is finalized. For example, you might want to finalize the move during off-work hours. Select or clear Automatically complete the migration batch.

14. Click Finish.

OR

Open Exchange Management Shell

Get-Mailbox –Database “Exchange 2010 database name’ | New-MoveRequest –targetdatabase “Exchange 2013 database name”

Get-MoveRequest

Migrate Room or Resource mailboxes

Open EMS and execute the cmdlets

Get-Mailbox -RecipientTypeDetails roommailbox -database SOURCEDBNAME | new-moverequest -targetdatabase TARGETDBNAME

Upgrade Distribution groups

Open Exchange management Shell as an administrator, execute the following command.

Get-DistributionGroup -resultsize unlimited | Set-DistributionGroup –ManagedBy “CN=Organization

Management,OU=Microsoft Exchange Security Groups,DC=superplaneteers,DC=com”

Get-DistributionGroup -resultsize unlimited | Set-DistributionGroup –ForceUpgrade

Upgrading Distribution Groups with multiple owners to Exchange 2013

Open Exchange management Shell as an administrator, execute the following command.

foreach ($DL in (Get-DistributionGroup -ResultSize Unlimited)) { $owners = Get-ADPermission $DL.identity | ?{$_.User -notlike “*Exchange*” -and $_.User -notlike “S-*” -and $_.User -notlike “*Organization*” -and $_.User -notlike “NT*” -and $_.User -notlike “*Domain Admins*” -and $_.User -notlike “*Enterprise Admins” -and $_.User -notlike “BUILTIN*” -and $_.User –notlike “*Delegated Setup*”}  | %{$_.user.tostring()};Set-DistributionGroup $DL -BypassSecurityGroupManagerCheck -ManagedBy $owners }

Reference http://blogs.technet.com/b/microsoft_exchange_tips/archive/2013/11/07/upgrading-distribution-groups-with-multiple-owners-to-exchange-2013.aspx

Migrate Public Folder

In Exchange 2013, public folders were re-engineered using mailbox infrastructure to take advantage of the existing high availability and storage technologies of the mailbox database. Public folder architecture uses specially designed mailboxes to store both the public folder hierarchy and the content. This also means that there’s no longer a public folder database. High availability for the public folder mailboxes is provided by a database availability group (DAG).

There are two types of public folder mailboxes: the primary hierarchy mailbox and secondary hierarchy mailboxes. Both types of mailboxes can contain content:

• Primary hierarchy mailbox   The primary hierarchy mailbox is the one writable copy of the public folder hierarchy. The public folder hierarchy is copied to all other public folder mailboxes, but these will be read-only copies.
• Secondary hierarchy mailboxes   Secondary hierarchy mailboxes contain public folder content as well and a read-only copy of the public folder hierarchy.

There are two ways you can manage public folder mailboxes:

• In the Exchange admin center (EAC), navigate to Public folders > Public folder mailboxes.

Before you migrate public folder, I would recommend creating new separate mailbox database in Exchange 2013 then start the migration process.

Step1: Perform Perquisites
Download all four of the Microsoft Exchange 2013 public folder migration scripts and save the script in C:PFScripts
Prerequisites in Exchange 2010 Server
Open Exchange Management Shell in Exchange 2010 server, run the following cmdlets one by one.
Run the following command to take a snapshot of the original source folder structure.
Get-PublicFolder -Recurse | Export-CliXML C:PFMigrationLegacy_PFStructure.xml

Run the following command to take a snapshot of public folder statistics such as item count, size, and owner
Get-PublicFolderStatistics | Export-CliXML C:PFMigrationLegacy_PFStatistics.xml

Run the following command to take a snapshot of the permissions.
Get-PublicFolder -Recurse | Get-PublicFolderClientPermission | Select-Object Identity,User -ExpandProperty AccessRights | Export-CliXML C:PFMigrationLegacy_PFPerms.xml

Save the information from the preceding commands for comparison at the end of the migration.
In Exchange 2010, to locate public folders that have a backslash in the name, run the following command:
Get-PublicFolderStatistics -ResultSize Unlimited | Where {$_.Name -like “**”} | Format-List Name, Identity

In Exchange 2007, to locate public folders that have a backslash in the name, run the following command:
Get-PublicFolderDatabase | ForEach {Get-PublicFolderStatistics -Server $_.Server | Where {$_.Name -like “**”}}

If any public folders are returned, you can rename them by running the following command:
Set-PublicFolder -Identity <public folder identity> -Name <new public folder name>

Make sure there isn’t a previous record of a successful migration. If there is, you’ll need to set that value to $false. If the value is set to $true the migration request will fail.
The following example checks the public folder migration status.
Get-OrganizationConfig | Format-List PublicFoldersLockedforMigration, PublicFolderMigrationComplete

Set-OrganizationConfig -PublicFoldersLockedforMigration:$false -PublicFolderMigrationComplete:$false

Prerequisites on Exchange 2013
Make sure there are no existing public folder migration requests. If there are, clear them.
Get-PublicFolderMigrationRequest | Remove-PublicFolderMigrationRequest -Confirm:$false

To make sure there are no existing public folders on the Exchange 2013 servers, run the following commands.
Get-Mailbox -PublicFolder
Get-PublicFolder

If the above commands return any public folders, use the following commands to remove the public folders.
Get-MailPublicFolder | where $_.EntryId -ne $null | Disable-MailPublicFolder -Confirm:$false
Get-PublicFolder -GetChildren | Remove-PublicFolder -Recurse -Confirm:$false
Get-Mailbox -PublicFolder |Remove-Mailbox -PublicFolder -Confirm:$false

Step2: Generate CSV Files
On the Exchange 2010 server, run the Export-PublicFolderStatistics.ps1 script to create the folder name-to-folder size mapping file.
.Export-PublicFolderStatistics.ps1 <Folder to size map path> <FQDN of source server>

Run the PublicFolderToMailboxMapGenerator.ps1 script to create the public folder-to-mailbox mapping file. This file is used to create the correct number of public folder mailboxes on the Exchange 2013 Mailbox server.
.PublicFolderToMailboxMapGenerator.ps1 <Maximum mailbox size in bytes> <Folder to size map path> <Folder to mailbox map path>

<Folder to size map path> is  \AUPEREX2010c$PFstat.csv
<Maximum mailbox size in bytes> is 20000000
<Folder to mailbox map path> is \AUPEREX2010c$PFMigrationmapgen.csv

Step3: Create public folder mailboxes on Exchange 2013
Run the following command to create the first public folder mailbox on the Exchange 2013 Mailbox server.
New-Mailbox -PublicFolder <Name> -HoldForMigration:$true –database “Exchange 2013 database”

Run the following command to create additional public folder mailboxes as needed based on the .csv file generated from the PublicFoldertoMailboxMapGenerator.ps1 script.

$numberOfMailboxes = 25;
for($index =1 ; $index -le $numberOfMailboxes ; $index++)
{
$PFMailboxName = “Mailbox”+$index;  if($index -eq 1) {New-Mailbox -PublicFolder $PFMailboxName -HoldForMigration:$true -IsExcludedFromServingHiearchy:$true;}else{NewMailbox-PublicFolder $PFMailboxName -IsExcludedFromServingHierarchy:$true}
}

Step4: Start Migration request

Legacy system public folders such as OWAScratchPad and the schema-root folder subtree in Exchange 2007 won’t be recognized by Exchange 2013 and will be treated as bad items. This will cause the migration to fail. As part of the migration request, you must specify a value for the BadItemLimit parameter.

From the Exchange 2013 Mailbox server, run the following command:

$PublicFolderDatabasesInOrg = @(Get-PublicFolderDatabase)
$BadItemLimitCount = 5 + ($PublicFolderDatabasesInOrg.Count -1)
New-PublicFolderMigrationRequest -SourceDatabase (Get-PublicFolderDatabase -Server <Source server name>) -CSVData (Get-Content <Folder to mailbox map path> -Encoding Byte) -BadItemLimit $BadItemLimitCount

To verify that the migration started successfully, run the following command.
Get-PublicFolderMigrationRequest | Get-PublicFolderMigrationRequestStatistics -IncludeReport | Format-List

Step 5: Lock Source Server
On the Exchange 2010 server, run the following command to lock the legacy public folders for finalization.

Set-OrganizationConfig -PublicFoldersLockedForMigration:$true

Step6: Finalize public folder migration
Set-PublicFolderMigrationRequest -Identity PublicFolderMigration -PreventCompletion:$false
Resume-PublicFolderMigrationRequest -Identity PublicFolderMigration

Step7: Test Public Folder Migration
Run the following command to assign some test mailboxes to use any newly migrated public folder mailbox as the default public folder mailbox
Set-Mailbox -Identity <Test User> -DefaultPublicFolderMailbox <Public Folder Mailbox Identity>

Log on to Outlook 2007 or later with the test user identified in the previous step, and then perform the following public folder tests:

Post Migration Check

1. Verify Internal and external DNS records and aliases of autodiscover and mail are pointing to Exchange 2013 CAS server or load balancer VIP or CAS NLB IP. At this stage do not delete Host(A) record of legacy exchange servers until you decommission them.

2. Point your Spam Guard or hosted email security to forward all the emails to exchange 2013 to receive incoming mail via Exchange 2013.

3. Configure Spam Guard or hosted email security to accept emails from all Exchange 2013 Mailbox servers.

4. Configure smart host if necessary.

5. Configure all other application to send email via the Exchange 2013 Mailbox Servers

6. Test inbound and outbound email from outlook client and mobile devices.

7. Start Monitoring Exchange, Open EMS and execute Get-mailbox –monitoring

8. Go to https://testconnectivity.microsoft.com/ to test connectivity of Exchange 2013

9. Go to http://mxtoolbox.com/ to test your MX, Reverse DNS and DNS records.

Decommission Legacy Exchange Server

Before you decommission legacy Exchange server, make sure you have completed the following tasks

1. Make sure public and internal DNS, MX and CNAME are correct.
2. Move all user mailboxes to Exchange 2013.
3. Move all room mailboxes to Exchange 2013.
4. Move all public folders to Exchange 2013
5. Move all arbitration mailboxes to Exchange 2013.
6. Move all Discovery Search mailboxes to Exchange 2013
7. Add all Exchange 2013 mailbox servers in all the send connectors and remove the Exchange 2007/2010 servers from Send Connector.
8. Create new anonymous relay receive connectors in Exchange 2013 and all IPs in remote network settings properties of relay
9. Ensure you have configured Autodiscover correctly at AutoDiscoverServiceInternalUri properties if all CAS 2013. Issue Get-ClientAccessServer | fl cmdlet to view internal url of autodiscover.

10. Remove Exchange 2010 CAS arrays. Execute Get-clientaccessarray | remove-ClientAccessArray in Exchange 2010 management shell

11. Point all the applications to use Exchange 2013 SMTP.

12. Test inbound and outbound email from various supported clients.

Now is the time to shutdown legacy exchange servers in your organization and test Exchange 2013 mail flow again. Make sure you shut down the server during working hours and working days. Keep the legacy exchange down for at least 48hrs. To decommission legacy Exchange follow the steps

1. Bring all legacy servers online means power on all servers which were down in previous step.

2. Remove all Public Folder replicas else Public Folder Database will not be removed. To remove public folder replicas, open Exchange Management Console in exchange 2010, Click Tools, Open Public Folder Management Console, Select Default Public Folder, Click properties, Click Replication, Remove exchange 2010 database from replication. Repeat the same for systems public folder.

3. Remove Exchange 2007/2010 mailbox database and Public folder databases from EMC or EMS.

4. Go to Control Panel to remove Exchange 2007/2010. On Program and Features screen click on Uninstall. On the Maintenance Mode page of the Exchange Server 2007/2010 Setup wizard begins the process of removing your Exchange installation. Click Next to continue.    

5. On the Server Role Selection page, uncheck in 2007/2010 all Exchange server roles and Exchange management tools to remove. In Exchange 2007 CCR remove passive node first then follow the same steps on active node. Click next to continue.

6. On the Readiness Checks page, view the status to determine if the organization and server role prerequisite checks completed successfully. If the prerequisites check doesn’t complete successfully, review the Summary page and fix any issues that are preventing Setup from removing exchange 2007/2010. If the checks have completed successfully, click Uninstall to remove the entire installation of Exchange 2007/2010.

7. On the Completion page, click Finish.

8. Verify the setup log files and folder located at c:ExchangeSetupLogs.

9. Uninstall Internet Information Services (IIS) from windows Server 2008 or add/remove program and features in Windows Server 2003.

10. Disjoin the legacy Exchange servers from the Domain.

11. Delete Host(A) DNS record of Legacy Exchange Server. Delete ONLY legacy DNS record.

References

http://technet.microsoft.com/en-us/library/ee332361(EXCHG.141).aspx

http://technet.microsoft.com/en-us/library/bb123893(EXCHG.80).aspx

http://technet.microsoft.com/en-US/exdeploy2013/Checklist?state=2284-W-CABEAgAAQAAACQEAAQAAAA~~

http://support.microsoft.com/kb/2846555

http://support.microsoft.com/?kbid=940726

http://www.petenetlive.com/KB/Article/0000036.htm

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-1-step-by-step-exchange-2007-to-2013-migration.aspx

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-2-step-by-step-exchange-2007-to-2013-migration.aspx

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-3-step-by-step-exchange-2007-to-2013-migration.aspx

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-4-step-by-step-exchange-2007-to-2013-migration.aspx

http://www.expta.com/2013/05/owa-2013-cu1-redirection-is-broken-for.html

How to Configure Unified Messaging in Exchange 2013 Step by Step

There are many ways you can achieve unified messaging functionality in Exchange 2013. It all depends on your Exchange, Lync and telephony infrastructure.

Before you begin, you have to install Exchange language pack for non-English Exchange deployment. For English deployment you don’t need to install language pack.

Depending on your Exchange 2013 version, Download Exchange Language Pack from the following web sites.

http://www.microsoft.com/en-au/download/details.aspx?id=35368

http://www.microsoft.com/en-au/download/details.aspx?id=39713

http://www.microsoft.com/en-au/download/details.aspx?id=41176

Right click the UMLanguagePack.Country-Code.exe file, Click Run As Administrator.

In the Exchange 2013 Setup wizard, on the License Agreement page,  select I accept the terms in the license agreement, and then click Next then click Install.

Click Finish to complete the installation of the UM language pack.

Scenario#1

If you have a Cisco Call Manager for IP telephony then you just need to perform few tasks in Exchange 2013 to integrate Exchange and Cisco Call Manager. Here are the steps to accomplish unified messaging in Exchange 2013 with Cisco Call Manager.

Step1: Create a Service Account named domainnamesa-ExchangeUC  and set password and account to be never expired. Set user cannot change password.  

Step2: Open Exchange 2013 Management Shell as an administrator (Account must be a member of Exchange organisation management role). issue the following command. 

New-ManagementRoleAssignment –Name:UMServicesConnectionACC –Role:ApplicationImpersonation -User:”domainanemsa-ExchangeUC “

Get-ManagementRoleAssignment

Step3: Create an anonymous relay in Exchange 2013. Here is a guideline. 

Name: Anonymous Relay

Role: Frontend Transport

Type: Custom

Available IP: Exchange 2013 server IP

Port: 25

Authentication: TLS, Externally Secured

Permission: Exchange Servers, Anonymous users

Open Exchange Management Shell and execute the following

Get-ReceiveConnector “Anonymous Relay” | Add-ADPermission -User “NT AUTHORITYANONYMOUS LOGON” -ExtendedRights “Ms-Exch-SMTP-Accept-Any-Recipient”

Now add Cisco Call Manager IP address into remote network settings properties of anonymous relay.

Step4: Export Exchange Client Access Certificate from Exchange 2013 as .pfx format (public key included) and import into computer account of windows machine then export as .cer format certificate into Cisco Unity. reference http://www.digicert.com/ssl-support/pfx-import-export-iis.htm

Step5: Configure Cisco Unity for Unified Messaging. Follow this link to configure Cisco Call Manager. Detailed guide is available in Cisco Unity and Microsoft Exchange configuration guide.

Scenario#2

There are other ways to achieve same result if you decide Exchange 2013 to manage dial plan, auto attendant, hunt group and voice delivery etc. In this scenario, you have configure lot more then previous steps. There is no concrete steps for your scenario or your IP telephony systems. But here is what you have to do to accomplish unified messaging between IP-PBX and Exchange 2013. I assume your Exchange 2013 and IP-PBX are working per normal.  

Step1: Create a Service Account named domainnamesa-ExchangeUC and set password and account to be never expired. Set user cannot change password in the properties of sa-ExchangeUC account.

Step2: Export Exchange Client Access Certificate from Exchange 2013 as .pfx format (public key included) and import into computer account of a windows machine then export as .cer format certificate into IP-PBX.

Step3: Configure IP-PBX to connect to Exchange 2013 using service account you have created in previous step.

Step4: Create a virtual extension number. This extension number will be used in a Exchange 2013 only.  

Step5: Create a dial plan

In the Exchange admin center (EAC), navigate to Unified Messaging > UM dial plans, and then click Add .

On the New UM Dial Plan page, complete the following boxes:

Name: ExchangeUC Dial Plan

Extension Length: 4 or Exact length used in IP-PBX

Dial plan type: Telephone extension

VoIP security mode: Unsecured

Country/Region code: +61 (for australia)

Click Save.

Step6: Create a PIN Policy

In the EAC, navigate to Unified Messaging > UM dial plans. In the list view, click the ExchangeUC Dial Plan you have created in previous step and then click Edit .

On the UM Dial Plan page, under UM Mailbox Policies, select the UM mailbox policy you want to edit, and then click Edit .

Click Properties. On the UM mailbox policy page, click PIN policies.

On the PIN Policies page, configure the following PIN settings

PIN Length: 5

PIN Cycle: 5

Enforce PIN lifetime: 60

Sign-in failure: 5

Sign-in lockout:15

Click Save.

Step8: Add a DNS record in the forward lookup zone of Active Directory DNS

lets say DNS Name: IPPBX.domainname.com and corresponding IP: 10.10.70.240

Step8: Add UM IP Gateway

In the EAC, navigate to Unified Messaging > UM IP Gateways, and then click Add .

On the New UM IP gateway page, enter the following information:

Name: Cisco Unity or 3CX whichever is your gateway

Address: FQDN or IP Address of IP-PBX

UM Dial Plan: ExchangeUC Dial Plan

Click Save.

Step9: Create Auto Attendant

In the EAC, navigate to Unified Messaging > UM dial plans, select the ExchangeUC Dial Plan for which you want to add an auto attendant, and then click Edit .

On the UM Dial Plan page, under UM Auto Attendants, click Add .

On the New UM auto attendant page, complete the following boxes:

Name: ExchangeUC Auto Attendant

Uncheck “Create this auto attendant as enabled”

Uncheck “Set the auto attendant to respond to voice commands”

Access Number: click Add and add virtual extension number you have created in step 4.

Click Save.

Step 10 (Optional):

In the EAC, navigate to Unified Messaging > UM dial plans. In the list view, select the ExchangeUC Dial Plan and then click Edit .

On the UM Dial Plan page, under UM Hunt Groups, click Add .

On the New UM Hunt Group page, complete the following boxes:

Associated UM IP gateway: IPPBX.domainname.com

Name: ExchangeUC Hunt Group

Dial plan   Click Browse to select the ExchangeUC Dial Plan

Pilot identifier: a string that uniquely identifies the pilot identifier obtained from IP-PBX.

Click Save.

Step11: Setup UM Dial Plan Policies

In the EAC, navigate to Unified Messaging > UM dial plans. In the list view, select the ExchangeUC Dial Plan and then click Edit .

On the UM Dial Plan page, under UM Mailbox Policies, click New .

On the New UM mailbox policy page, in the Name box, enter the name of ExchangeUC mailbox policy.

Click Save.

Step12: Enable User for Voice Mail

In the EAC, click Recipients. In the List view, select the user whose mailbox you want to enable for Unified Messaging.

In the Details pane, under Phone and Voice Features, click Enable.

On the Enable UM mailbox page, click the Browse and select ExchangeUC mailbox policy, and then click OK.

On the Enable UM mailbox page, complete the following boxes:

Extension Number: Type the extension number you have created in IP-PBX for this mailbox

PIN Settings: Type a 5 digit PIN number

Click Finish.

Now you have successfully configured Unified Messaging in Exchange 2013. However if you have Lync 2013 in your organisation. you will have to perform the following steps in Exchange 2013 to integrate Lync and Exchange.

Step1: Set Dial Start-up mode to dual

Open Exchange Management Shell, Enter the following command

Set-UmService -Identity “FQDN of Exchange Server” -DialPlans “ExchangeUC Dial Plan” -UMStartupMode “Dual”

Step2: Assign Exchange Certificate to UM

Type Get-ExchangeCertificate and copy the thumbprint in notepad

Enable-ExchangeCertificate -Server “FQDN of Exchange Server” -Thumbprint “EA5A332496CC05DA69B7578A110D22d” -Services “UM”

I assume that you already assigned this certificate to IIS, SMTP services. Restart the MsExchangeUM service on the Exchange server.

Step3: Assign certificate to call router

Set-UMCallRouterSettings -Server “FQDN of Exchange Server” -UMStartupMode “Dual” -DialPlans “ExchangeUC Dial Plan”
Enable-ExchangeCertificate -Server “FQDN of Exchange Server” -Thumbprint “45BAA32496CC891169B75B9811320F78A1075DDA” –Services “IIS”, “UMCallRouter”

Restart the MsExchangeUM service on the Exchange server.

Step4: Test UM Service

$credential = Get-Credential “DomainNameUser1”

Test-CsExUMConnectivity -TargetFqdn “FQDN of Exchange Server” -UserSipAddress “sip:User1@DomainName.com” -UserCredential $credential

$credential = Get-Credential “DomainNameUser2”

Test-CsExUMVoiceMail -TargetFqdn “FQDN of Exchange Server” -ReceiverSipAddress “sip:user1@DomainName.com” -SenderSipAddress “sip:user2@DomainName.com” -SenderCredential $credential

References:

http://technet.microsoft.com/en-us/library/jj673564%28v=exchg.150%29.aspx

http://technet.microsoft.com/en-us/library/jj150478%28v=exchg.150%29.aspx

Transition from Exchange 2010 to Exchange 2013 Step by Step

 

BUY IT NOW:
Amazon USA
Amazon UK
BARNES & NOBLE
Book World

Assumptions:

You have the following infrastructure operational and functioning as desired.

1. Domain Controller
2. Certificate Authority
3. Exchange Server 2010 SP2 DAG
4. FF TMG 2010 SP2

Current Exchange Version:

Prerequisites:

1. Windows Server 2012 installed on computers which will house Exchange Server 2013.
2. Windows Media Foundation. Use Add Roles and features Wizard to install Media Foundation on Windows Serer 2012.
3. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit
4. Microsoft Office 2010 Filter Pack 64 bit
5. Microsoft Office 2010 Filter Pack SP1 64 bit
6. Download Exchange 2010 SP3
7. Cumulative Update 1 for Exchange Server 2013

Step1: Perform a Server Switch Over for a Exchange 2010 SP2 DAG Member

Before you upgrade Exchange Server 2010 SP2 to Exchange 2010 SP3, you must perform a server switch over if you have Exchange DAG. You need to be assigned permissions before you can perform this procedure. use Exchange Management Shell and Run the following Command.

Move-ActiveMailboxDatabase -Server EXCHMBXSRV01 -ActivateOnServer EXCHMBXSRV02

Step2: Install Service Pack 3 on Exchange Server 2010 SP2

Download and Extract Exchange Server 2010 SP3 on the DAG member where you want run the Exchange 2010 Sp3 installer. Now follow the screen shot and upgrade Exchange Server 2010 SP2 to Exchange Server 2010 SP3.

you will be prompted for an warning which is A transient communication failure causes a Windows Server 2008 R2 failover cluster to stop working. Ignore the warning and continue. Once SP3 installed. Check the version which is as follows.

 

Repeat the step 2 in all Exchange Server in your Exchange Organization.

Step3: Prepare Windows Server 2012

Download Windows Server 2012 and install the following prerequisites on Windows Server 2012.

Windows Media Foundation. Use Add Roles and features Wizard to install Media Foundation on Windows Serer 2012.

Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit

Microsoft Office 2010 Filter Pack 64 bit

Microsoft Office 2010 Filter Pack SP1 64 bit

Exchange 2013 setup automatically install features required by Exchange. Alternatively you can use the following PowerShell Command to install all the features at that same time. A reboot is required after installing features.

Step4: Prepare Active Directory and Active Directory Schema

Run the following command to prepare AD Schema and Active Directory.

setup /PrepareSchema /IAcceptExchangeServerLicenseTerms

setup /PrepareAD /OrganizationName:<organization name> /IAcceptExchangeServerLicenseTerms

since we already have an Exchange Organization, we don’t need to type Organization again. the following command is enough to prepare Active Directory.  setup /PrepareAD /IAcceptExchangeServerLicenseTerms

Step5: Install CU1 for Exchange Server 2013

Log on to the computer on which you want to install Exchange 2013. After you have downloaded Exchange 2013 CU1, Copy Exchange-X64.exe file into Windows Server 2012 where you want to install Exchange Server 2013 . Extract the installer by double clicking the Exchange-x64.exe installer.

1. On the Check for Updates page, Select Don’t check for updates right now, you can download and install updates manually later. We recommend that you download and install updates now. Click Next to continue. at this stage setup will copy the content and initialize installer.
2. The Introduction page begins the process of installing Exchange into your organization. Click Next to continue.
3. On the License Agreement page, Select I accept the terms in the license agreement, and then click Next.
4. On the Recommended settings page, select whether you want to use the recommended settings. If you select Use recommended settings, click Next.
5. On the Server Role Selection page, select both Mailbox role and Client Access role. Select Automatically install Windows Server roles and features that are required to install Exchange Server to have the Setup wizard install required Windows prerequisites. You may need to reboot the computer to complete the installation of some Windows features.  Click Next to continue.
6. On the Installation Space and Location page, either accept the default installation location or click Browse to choose a new location. Make sure that you have enough disk space available in the location where you want to install Exchange. Click Next to continue.
7. On the Malware Protection Settings page, choose keep it enabled. Click Next to continue.
8. On the Readiness Checks page, view the status to determine if the organization and server role prerequisite checks completed successfully. Reboot the server from Server Manager>All Servers>Right Click on Server>Click Shutdown Local Server, Select Reboot, Click Ok.
9. Be sure to also review any warnings that are reported. If all readiness checks have completed successfully, click Install to install Exchange 2013.
10. On the Completion page, click Finish.
11. Restart the computer after Exchange 2013 has completed.

On a co-existence scenario if you type https://FQDN of Client Access Server/ecp you will see only Mailboxes.

If you type https://FQDN of Client Access Server/ecp?ExchClientVer=15  on internet explorer you will see detailed Exchange Administration Center. 

Step6: Install Certificates on Exchange Server 2013 CAS Server(s)

Step7: Configure Outlook Web Access in Exchange 2013

Step8: Configure Send/Receive Connector

Open Exchange Administration Center using https://FQDN of Client Access Server/ecp?ExchClientVer=15 url. Create new Send Connector using this procedure.

1. In the EAC, navigate to Mail flow > Send connectors, and then click Add .
2. In the New send connector wizard, specify a name for the send connector and then select Internet for the Type. Click Next.
3. Verify that MX record associated with recipient domain is selected, which specifies that the connector uses the domain name system (DNS) to route mail. Click Next.
4. Under Address space, click Add . In the Add domain window, make sure SMTP is listed as the Type. For Fully Qualified Domain Name (FQDN), enter *, which indicates that this send connector applies to messages addressed to any domain. Click Save.
5. Make sure Scoped send connector is not selected and then click Next.
6. For Source server, click Add . In the Select a server window, select a Mailbox server that will be used to send mail to the Internet via the Client Access server and click Add . After you’ve selected the server, click Add . Click OK.
7. Click Finish.

New-SendConnector –Internet –Name MysendConnector –AddressSpace Superplaneteers.com

Similarly you can use New-ReceiveConnector Cmdlet to create receive connector.

Step9: Test Internal/External Mail Flow using new Send Connector

Open internet explorer and type Https://FQDN of CAS Server/OWA  Log on to OWA using domain nameusername and password and check email

Step10: Migrate Mailboxes, DL, Public Folder from Exchange 2010 to Exchange 2013

Before you start migrating Exchange mailboxes, se the Exchange Management Console to enable circular logging otherwise a large log will be generated when migrating mailboxes.  you can enable circular logging in all mailbox database using the following power shell command

Get-MailboxDatabase | Set-MailboxDatabase –circularloggingenabled $true

Set-StorageGroup -Identity “First Storage Group” -CircularLoggingEnabled $true

Open Exchange Administration Center using https://FQDN of Client Access Server/ecp?ExchClientVer=15 url, In the EAC, navigate to Recipients > Migration, and then click Add .

In the New local mailbox move wizard, select the user you want to move click OK and then click Next.

 

On the Move configuration page, specify a name for the new batch. Select which options you want for the archive mailbox, and mailbox database location and click New. follow the screen to complete migration.

 

To migrate entire mailboxes from an existing Exchange 2010 DAG to new Exchange 2013 DAG using Exchange Management Shell in Exchange Server 2013 and run the following cmdlets.

Get-Mailbox -Database Manager-DB01 | New-MoveRequest -TargetDatabase Manager-DB02 -BatchName “DB01toDB02”

To find out more about New-MoveRequest cmdlet type Get-Help New-MoveRequest –Example or visit Move and Migration Cmdlets 

Step11: Publish Exchange OWA to External Clients

Step12: Migrate Public Folder.

Step13: Migrate Exchange UM

Step14: Retire Exchange Server 2010

A detailed migration steps are available in this book.

 

BUY IT NOW:
Amazon USA
Amazon UK
BARNES & NOBLE
Book World

First Cumulative Update for Exchange 2013

Cumulative update 1 for Exchange Server 2013 (KB2816900)

Update Rollup 10 for Exchange Server 2007 Service Pack 3 (KB2788321)

Details can be found here

Exchange 2007/2010 SP3 Released

 

Exchange 2007/2010 SP3 released.

Download Exchange 2007 SP3

Download Exchange 2010 SP3

Active Directory Certificate Services Best Practices

AD CS is composed of several role services that perform several tasks. One or more of these role services can be installed on a server as required. These role services are as follows:

• Certification Authority— This role service installs the core CA component, which allows a server to issue, revoke, and manage certificates for clients. This role can be installed on multiple servers within the same root CA chain.
• Certification Authority Web Enrollment— This role service handles the web-based distribution of certificates to clients. It requires Internet Information Services (IIS) to be installed on the server.
• Online Responder— The role service responds to individual client requests regarding information about the validity of specific certificates. It is used for complex or large networks, when the network needs to handle large peaks of revocation activity, or when large certificate revocation lists (CRLs) need to be downloaded.
• Certificate Enrollment Web Service— This new service enables users and computers to enroll for certificates remotely or from non-domain systems via HTTP.
• Certificate Enrollment Web Policy Service— This service works with the related Certificate Enrollment Web Service but simply provides policy information rather than certificates.
• Network Device Enrollment Service— This role service streamlines the way that network devices such as routers receive certificates.

Active Directory Certificate Services Hierarchy

Public Key Infrastructure must be deployed in hierarchical order to securely deliver certificates to clients, application and servers. The best way to achieve this is to deploy a Standalone Offline Root CA and Online Enterprise Subordinate CA. Offline Root CA meaning you have to shut down the CA once you obtain the CRL chain for subordinate CA. Subordinate stays powered on and joined to the domain. Offline Root CA works in a workgroup not a domain member.

Standalone offline Root CA:

Benefits:

• Principal component of PKI infrastructure
• Provide CRL sign off capacity for subordinate authority
• Provide Web Enrolment for Sub-ordinate Certificate Authority
• Maintain CAPolicy.inf to record OID and certificate authority validity period

Online Enterprise Subordinate CA

Benefits:

• Subordinate Component of PKI infrastructure
• Present and issue Certificates to clients
• Sign off Web Certificates for application
• Management point of Certificate Infrastructure
• Maintain CAPolicy.inf to record OID and certificate authority validity period

Certificate Services Best practices

• Analyze and plan necessity of Active Directory Certificates or public key infrastructure (PKI) in your organization before deploying certification authorities (CAs)
• Place database and transaction log files on separate hard drives possibly SAN
• Keep the root certification authority offline and secure its signing key by hardware and keep it in a vault to minimize potential for key compromise
• When changing security permissions for the certification authority (CA), always use the Certification Authority snap-in
• Do not issue certificates to users or computers directly from the root certification authority
• Always point client to subordinate certificate any certificates
• Back up the CA database, the CA certificate, and the CA keys
• Ensure that key lifetimes are long enough to avoid renewal issues
• Review the concepts of security permissions and access control, since enterprise certification authorities issue certificates based on the security permissions of the certificate requester
• Use Secure Sockets Layer (SSL) when using Web-based certificate enrollment

Certificate Provider

You have to select RSA#Microsoft Software Key Storage Provider” with sha1 if there is any Windows XP Client otherwise select RSA#Microsoft Software Key Storage Provider” with sha256 as certificate provider.

Cryptographic Key Length

Use 2048 bit cryptographic length for both offline Root CA and Subordinate CA.

Templates

• Plan certificate templates before deployment
• Only Publish templates that are necessary
• Duplicate new templates from existing templates closest in function to the intended template
• Do not exceed the certificate lifetime of the issuing certification authority
• Do not delete the Certificate Publishers security group

Validity Period

• Offline Standalone Root CA- 10 Years
• Online Enterprise Subordinate CA- 10 Years

Revocation List

The following sections summarize how certificate revocation checking works.

• Basic chain and certificate validation
• Validating revocation information
• Network retrieval and caching

Revocation Best Practice

• Leave the default revocation checking behavior instead of using CRLs for revocation checking
• Instead of creating long listings of URLs for OCSP and CRL retrieval, consider limiting the lists to a single OCSP and a single CRL URL
• Use CryptoAPI 2.0 Diagnostics to Troubleshoot Revocation Settings
• Use Group Policy to Define Revocation Behavior

Audit Policy

Select the following Audit Policy for both Certificate Authority

• Backup and restore the CA database
• Change CA configuration
• Change CA security settings
• Issue and manage certificate request
• Revoke certificates and publish CRL

Backup Certificate Authority

• Backup Public Key
• Backup CA database
• Retention: Daily increment/Monthly Full

Security Permission on Template

The following table summarize certificate security permission in AD CS.

Domain Computers	Auto-Enroll	Read Only
Domain Users	Auto-Enroll	Read Only
Wintel Administrator	Full Control	Full Control

Security Permission on Servers

You must create role separation in Active Directory Certificate Services to provide greater control on Certificate Authority. To enable Role separation, Open Elevated command prompt and type certutil -setreg caRoleSeparationEnabled 1. The following table describe role separation for AD CS.

CA Administrator	Full Permission
Certificate Manager	Issue and Manage Certificates
Auditor	Manage auditing and security logLocal Security Settings/ Security Settings/Local Policies/User Rights Assignments
Backup Operator	Back up file and directories Local Security Settings/ Security Settings/Local Policies/User Rights Assignments
Enrollees	Authenticated Users

The Following are the messy configurations you must avoid when installing a Certificate Authority.

• Do not install Certificate Authority on any Domain Controller or server with other roles unless you are a small business and you have only one or two servers in your organization. In this case, you don’t have any choice.
• Do not install both certificate authority in two different operating systems such as Windows Server 2003 and Windows Server 2008.
• Do not keep CAs in different patch and update level.
• Do not use 1024 bit encryption length.

Relevant Articles:

Microsoft Active Directory Best Practice Part II

Microsoft Active Directory—Best Practice

Microsoft Active Directory Best Practice Part II

I have written Active Directory Best Practice last year. I received huge feedback on this article. Recently I had to deal with an Active Directory disaster. I believe time is perfect to write part II on this same topics and educate others so that they learn Active Directory and prepare themselves for disaster recover.  In this article I am also writing about Active Directory Design and the elements of the design. You may think you know Active Directory but have a look what you don’t know!

Readers who may benefit from this article:

Technical Architect, Systems Engineer, Systems Administrator, Active Directory Designer

Active Directory FSMO Role Design Best Practice

Scope of AD Design

1. Provide Compliance, Governance and Oversee Network Authentication
2. Secure Servers, Users and Computers
3. Provide DNS Resolution
4. Create central repository of all IT objects and assets

What are the elements of Active Directory Design?

1. Forest Plan
2. Domain Plan
3. Organizational Unit Plan
4. Site and Services Plan

1. Key Consideration for Forest Plan

• Determine the number of forests for your network
• Create a forest change control policy
• Understand the impact of changes to the forest after deployment

Multi-Master Model:

A multi-master enabled database, such as the Active Directory, provides the flexibility of allowing changes to occur at any DC in the enterprise, but it also introduces the possibility of conflicts that can potentially lead to problems once the data is replicated to the rest of the enterprise. One way Windows deals with conflicting updates is by having a conflict resolution algorithm handle discrepancies in values by resolving to the DC to which changes were written last (that is, “the last writer wins”), while discarding the changes in all other DCs. Although this resolution method may be acceptable in some cases, there are times when conflicts are just too difficult to resolve using the “last writer wins” approach. In such cases, it is best to prevent the conflict from occurring rather than to try to resolve it after the fact. For certain types of changes, Windows incorporates methods to prevent conflicting Active Directory updates from occurring.

Single-Master Model:

To prevent conflicting updates in Microsoft AD, the Active Directory performs updates to certain objects in a single-master fashion. In a single-master model, only one DC in the entire directory is allowed to process updates. This is similar to the role given to a primary domain controller (PDC) in earlier versions of Windows, in which the PDC is responsible for processing all updates in a given domain.
Microsoft Active Directory extends the single-master model found in earlier versions of Windows to include multiple roles, and the ability to transfer roles to any domain controller (DC) in the enterprise. Because an Active Directory role is not bound to a single DC, it is referred to as a Flexible Single Master Operation (FSMO) role. Currently in Windows there are five FSMO roles:

• Schema master
• Domain naming master
• RID master
• PDC emulator
• Infrastructure daemon

2. Domain Plan

The domain plan is perhaps the most complicated aspect of the Active Directory design process. The planning process described below is divided into three parts:
• Determining the number of domains
• DNS and Domain Names
• Post Deployment Change management

Who are the administrator and who are delegated in Active Directory?

• Current domain administrators who are responsible for user accounts, groups, and computers
• Teams that manage and monitor the physical networks
• Team that manage DNS
• Security teams

The steps to creating a domain plan for a forest are:
• Determine the number of domains in each forest
• Choose a forest root domain
• Assign a DNS name to each domain to create a domain hierarchy
• Plan DNS server deployment
• Optimize authentication with short cut trusts
• Understand the impact of changes to the domain plan after deployment

Active Directory domains are named with DNS names that are the locator services for the Active Directory. Clients query DNS to locate services such as LDAP and Kerberos Key Distribution Centers. Also, a client uses DNS to determine what site it is in and what site its domain controller is in.

3. Organization Unit Plan

OU is the logical presentation of Company organogram, departmental organogram and Site/divisional organogram. OU design and planning is another very complex aspect of the design. However, changes to the design after deployment, are relatively easy to accomplish. A well-designed OU plan will ensure a return on investment for your AD effort. The decisions on OU design, GPO, security groups, and delegation are critical; however these aspects of AD are designed to handle the changes to your directory.

Here are some reasons why complexity should be handled at the OU level.
• Changing the OU Structure is fairly easy
• OUs are very flexible when used in conjunction with security groups and Group Policy Objects
• OUs offer a type of security boundary
• GPOs as a parent OU are inherited by a child OU (remember this does not happen at the domain level: a child domain does not inherit policy from its parent domain in the domain name space)
• OUs can be delegated administration rights, thus saving the cost of adding a domain just for administrative reasons
• The initial OU design requirements can be influenced by the down level domain migration requirements. The OU infrastructure can be redesigned after the migration

4. Site and Services Plan

An Active Directory site topology is a logical representation of a physical networks (WAN & LAN). Site topology is defined on a per-forest basis. Active Directory clients and servers use the site topology of a forest to route query and replication traffic efficiently. A site topology also helps you to decide where to place domain controllers on your network. Keep the following definition in mind when designing the site plan.

A site is defined as a set of IP sub networks connected by fast reliable connectivity. As a rule of thumb, networks with LAN speed or better are considered as fast networks.

To create a site topology for a forest, use the following process:

• Define sites and site links using your physical topology as a starting point. (Site links are connection objects, used to connect two sites, which are normally connected as a Wide Area Network)
• Place servers into sites
• Understand how changes to your site topology after deployment will impact end users

How many parties involve in Site Design

• Teams that manage and monitor the TCP/IP networks. (Network Team)
• Domain administrators for each domain in the forest (Wintel Team)

Writable DC or RODC?

Certain domain and enterprise-wide operations that are not well suited to multi-master updates must be performed on a single domain controller in the domain or in the forest. The purpose of having a single-master owner is to define a well-known target for critical operations and to prevent the introduction of conflicts or latency that could be created by multi-master updates. Having a single-operation master means that the relevant FSMO role owner must be online, discoverable, and available on the network by computers needing to perform FSMO dependent operations.

As per above statement, you can adopt HUB-SPOKE model with writable DC in Head Office and RODC in Site office with small number of users. However if you have sites with many users accessing DFS data, Printing and NTFS files randomly than its better to have writable DCs in all sites as well. If you are using MPLS service such as Telstra IP-WAN enterprise managed network than you definitely on a mesh WAN topology in that case you can happily have writable DCs on sites with mesh topology configured AD Sites and Services. However you are in SMB market with only several sites and low bandwidth than I would recommend RODC as your site domain controller.

 Relate the design with your organization or corporate scenario

• Design 1: Single Forest with a Single Domain
• Design 2: Single Forest with Multiple Domains
• Design 3: Multiple Forests

Ask yourself/client the following questions and find correct answer not reasonable answer

• How many Forests?
• How Many Domains?
• What is the best DNS Design for the Domain Name space?
• What are the Security verses Ease of Management Tradeoffs?

Understand FSMO Role Holder’s tasks and functionality: The operations masters, their scope and functionality are shown in the following table.

FSMO Role	Scope	Function and availability requirements
Schema Master	Enterprise	Used to introduce manual and programmatic schema updates, and this includes those updates that are added by Windows ADPREP /FORESTPREP, by Microsoft Exchange, and by other applications that use Active Directory Domain Services (AD DS). Must be online when schema updates are performed.
Domain Naming Master	Enterprise	Used to add and to remove domains and application partitions to and from the forest. Must be online when domains and application partitions in a forest are added or removed.
Primary Domain Controller	Domain	Receives password updates when passwords are changed for the computer and for user accounts that are on replica domain controllers. Consulted by replica domain controllers that service authentication requests that have mismatched passwords. Default target domain controller for Group Policy updates. Target domain controller for legacy applications that perform writable operations and for some admin tools. Must be online and accessible 24 hours a day, seven days a week.
RID	Domain	Allocates active and standby RID pools to replica domain controllers in the same domain. Must be online for newly promoted domain controllers to obtain a local RID pool that is required to advertise or when existing domain controllers have to update their current or standby RID pool allocation.
Infrastructure Master	Domain Application partition	Updates cross-domain references and phantoms from the global catalog. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 248047 Phantoms, tombstones and the infrastructure master A separate infrastructure master is created for each application partition including the default forest-wide and domain-wide application partitions created by Windows Server 2003 and later domain controllers. The Windows Server 2008 R2 ADPREP /RODCPREP command targets the infrastructure master role for default DNS application in the forest root domain. The DN path for this role holder is CN=Infrastructure,DC=DomainDnsZones,DC=<forest root domain>,DC=<top level domain> and CN=Infrastructure,DC=ForestDnsZones,DC=<forest root domain>,DC=<top level domain>.

Who owns what FSMO Roles & Where to place FSMO Roles

When the Active Directory Installation Wizard (Dcpromo.exe) creates the first domain in a new forest, the wizard adds five FSMO roles. A forest with one domain has five roles. The Active Directory Installation Wizard adds three domain-wide roles on the first domain controller in each additional domain in the forest. In addition, infrastructure master roles exist for each application partition. This includes the default domain and the forest-wide DNS application partitions that are created on Windows Server 2003 and on later domain controllers.

The Active Directory Installation Wizard performs the initial placement of roles on domain controllers. This placement is frequently correct for directories that have just a few domain controllers. In a directory that has many domain controllers, the default placement may not be the best match for your network.

Consider the following in your selection criteria:

• It is easier to keep track of FSMO roles if you host them on fewer computers.
• Place roles on domain controllers that are can be accessed by the computers that need access to a given role, especially on networks that are not fully routed. For example, to obtain a current or standby RID pool, or perform pass-through authentication, all DCs need network access to the RID and PDC role holders in their respective domains.
• If a role has to be moved to a different domain controller, and the current role holder is online and available, you should transfer (not seize) the role to the new domain controller. FSMO roles should only be sized if the current role holder is not available.
• FSMO roles that are assigned to domain controllers that are offline or in an error state only have to be transferred or seized if role-dependent operations are being performed. If the role holder can be made operational before the role is needed, you may delay seizing the role. If role availability is critical, transfer or seize the role as required. The PDC role in each domain should online 24×7.
• Select a direct intra-site replication partner for existing role holders to act as a standby role holder. If the primary owner goes offline or fails, transfer or seize the role to the designated standby FSMO domain controller as required.

General recommendations for FSMO placement

• Place the schema master on the PDC of the forest root domain.
• Place the domain naming master on the forest root PDC.
  The addition or removal of domains should be a tightly controlled operation. Place this role on the forest root PDC. Certain operations that use the domain naming master, such as creating or removing domains and application partitions, fail if the domain naming master is not available. On a domain controller that runs Microsoft Windows 2000, the domain naming master must also be hosted on a global catalog server. On domain controllers that run Windows Server 2003 or later versions, the domain naming master does not have to be a global catalog server.
• Place the PDC on your best hardware in a reliable hub site that contains replica domain controllers in the same Active Directory site and domain.
  
• In large or busy environments, the PDC frequently has the highest CPU utilization because it handles pass-thru authentication and password updates. If high CPU utilization becomes a problem, identify the source, and this includes applications or computers that may be performing too many operations (transitively) targeting the PDC.
• All domain controllers in a given domain, and computers that run applications and admin tools that target the PDC, must have network connectivity to the domain PDC.
• Place the RID master on the domain PDC in the same domain.
  RID master overhead is light, especially in mature domains that have already created the bulk of their users, computers, and groups. The domain PDC typically receives the most attention from administrators, therefore, co-locating this role on the PDC helps insure good availability. Make sure that existing domain controllers and newly promoted domain controllers, especially those promoted in remote or staging sites, have network connectivity to obtain active and standby RID pools from the RID master.
• Legacy guidance suggests placing the the infrastructure master on a non-global catalog server. There are two rules to consider:
  • Single domain forest:
    In a forest that contains a single Active Directory domain, there are no phantoms. Therefore, the infrastructure master has no work to do. The infrastructure master may be placed on any domain controller in the domain, regardless of whether that domain controller hosts the global catalog or not.
  • Multi-domain forest:
    If every domain controller in a domain that is part of a multi-domain forest also hosts the global catalog, there are no phantoms or work for the infrastructure master to do. The infrastructure master may be put on any domain controller in that domain. In practical terms, most administrators host the global catalog on every domain controller in the forest.
  • If every domain controller in a given domain that is located in a multi-domain forest does not host the global catalog, the infrastructure master must be placed on a domain controller that does not host the global catalog.

Techniques to reduce CPU include the following:

• adding more or faster CPUs
• Adding additional replicas
• Adding additional memory to cache Active Directory objects
• Removing the global catalog to avoid global catalog lookups
• Reducing the number of incoming and outgoing replication partners
• Increasing the replication schedule
• Reducing authentication visibility by using LDAPSRVWEIGHT and LDAPPRIORITY that is described in KB296716 and the Randomize1CList described in KB231305

In short human readable English language I would recommend follow the following FSMO roles structure.

Domain Controller 1: Place the two forest roles on this server.

• Schema Master
• Domain Master

Domain Controller 2 Place the three domain roles on this server.

• RID Master
• Infrastructure Master
• PDC Emulator

Global Catalog Rules:

Rule#1: The Infrastructure Master (IM) role should be held by a domain controller that is not a Global Catalog server(GC). If the Infrastructure Master runs on a Global Catalog server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a Global Catalog server holds a partial replica of every object in the forest. As a result, cross-domain object references in that domain will not be updated and a warning to that effect will be logged on that DC’s event log.

Rule#2: If all the domain controllers in a domain also host the global catalog, all the domain controllers have the current data, and it is not important which domain controller holds the infrastructure master role. In simple plain English yes you configure IM FSMO role holder a GC if all DCs are GC.

Group Policy Hierarchy Best Practice:

Group Policy(s) will flow down a hierarchy in the following order:
• Site
• Domain
• OU

The following are key element of Active Directory Users and Computer Policy:

• Password Policies, such as password length, password expiry interval and so forth
• Account Lockout Policies
• Kerberos policies
• Encrypted file system recovery policies
• IP security policies
• Public Key encryption policies
• Certificate authorities

Default Domain Policy determination

• Encrypted File System Recovery Policies
• IP Security Policies
• Public Key Infrastructure Policies
• Certificate Authorities
• Password Policy
• Account Lockout Policy
• Kerberos Policies

How long can a PDC and DC be offline? In theory, you can take PDC master offline for tombstone lifetime period and get away with warnings, but without breaking anything.
By default the DCs will look for PDCE as authoritative time source and you will have issues related to editing GPOs, but as long as you do not have legacy clients, you can take the PDCE down for up to 60 days pre-W2K3 SP1 environment (DCs) and for 180 days if all the DCs are W2K3 SP1.

Another issue would have to do with password chaining – if PDCE is down, you might get temporary authentication failures after changing user passwords. see the KB for details on how password chaining works.

However in practice you shouldn’t shutdown a DC for longer than necessary that may create lot of issues such as replication issue and authentication issues for site users. You can patch and update a domain controller using SCCM/WSUS and reboot the DC without any issues.

Transferring the Flexible Single Master Operation Role

The transfer of an FSMO role is the suggested form of moving a FSMO role between domain controllers and can be initiated by the administrator or by demoting a domain controller, but is not initiated automatically by the operating system. This includes a server in a shut-down state. FSMO roles are not automatically relocated during the shutdown process–this must be considered when shutting down a domain controller that has an FSMO role for maintenance, for example.

In a graceful transfer of an FSMO role between two domain controllers, a synchronization of the data that is maintained by the FSMO role owner to the server receiving the FSMO role is performed prior to transferring the role to ensure that any changes have been recorded before the role change.

Operational attributes are attributes that translate into an action on the server. This type of attribute is not defined in the schema, but is instead maintained by the server and intercepted when a client attempts to read or write to it. When the attribute is read, generally the result is a calculated result from the server. When the attribute is written, a pre-defined action occurs on the domain controller.

The following operational attributes are used to transfer FSMO roles and are located on the RootDSE (or Root DSA Specific Entry–the root of the Active Directory tree for a given domain controller where specific information about the domain controller is kept). In the operation of writing to the appropriate operational attribute on the domain controller to receive the FSMO role, the old domain controller is demoted and and the new domain controller is promoted automatically. No manual intervention is required. The operational attributes that represent the FSMO roles are:

becomeRidMaster
becomeSchemaMaster
becomeDomainMaster
becomePDC
becomeInfrastructureMaster

If the administrator specifies the server to receive the FSMO role using a tool such as Ntdsutil, the exchange of the FSMO role is defined between the current owner and the domain controller specified by the administrator.
When a domain controller is demoted, the operational attribute “GiveAwayAllFsmoRoles” is written, which triggers the domain controller to locate other domain controllers to offload any roles it currently owns. Windows 2000 determines which roles the domain controller being demoted currently owns and locates a suitable domain controller by following these rules:

1. Locate a server in the same site.
2. Locate a server to which there is RPC connectivity.
3. Use a server over an asynchronous transport (such as SMTP).

In all transfers, if the role is a domain-specific role, the role can be moved only to another domain controller in the same domain. Otherwise, any domain controller in the enterprise is a candidate.

Seizing the Flexible Single Master Operation Role

Administrators should use extreme caution in seizing FSMO roles. This operation, in most cases, should be performed only if the original FSMO role owner will not be brought back into the environment.
When the administrator seizes an FSMO role from an existing computer, the “fsmoRoleOwner” attribute is modified on the object that represents the root of the data directly bypassing synchronization of the data and graceful transfer of the role. The “fsmoRoleOwner” attribute of each of the following objects is written with the Distinguished Name (DN) of the NTDS Settings object (the data in the Active Directory that defines a computer as a domain controller) of the domain controller that is taking ownership of that role. As replication of this change starts to spread, other domain controllers learn of the FSMO role change.

Primary Domain Controller (PDC) FSMO:

LDAP://DC=MICROSOFT,DC=COM

RID Master FSMO:

LDAP://CN=Rid Manager$,CN=System,DC=MICROSOFT,DC=COM

Schema Master FSMO:

LDAP://CN=Schema,CN=Configuration,DC=Microsoft,DC=Com

Infrastructure Master FSMO:

LDAP://CN=Infrastructure,DC=Microsoft,DC=Com

Domain Naming Master FSMO:

LDAP://CN=Partitions,CN=Configuration,DC=Microsoft,DC=Com

For example, if Server1 is the PDC in the MicrosoftGuru.com.au domain and is retired and the administrator is unable to demote the computer properly, Server2 needs to be assigned the FSMO role of the PDC. After the seizure of the role takes place, the value

CN=NTDS Settings,CN=SERVER2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Microsoft,DC=Com

is present on the following object:  LDAP://DC=Domain,DC=COM,DC=AU

How to Fix ForestDnsZones and DomainDnsZones after failed demotion attempt

cscript fixfsmo.vbs DC=DomainDnsZones,DC=contoso,DC=com

cscript fixfsmo.vbs DC=ForestDnsZones,DC=contoso,DC=com

Can I change Active Directory Schema using ADSIEDIT? yes you can change Active Directory Schema using ADSIedit tools.  

Microsoft recommend that you transfer FSMO roles in the following scenarios:

• The current role holder is operational and can be accessed on the network by the new FSMO owner.
• You are gracefully demoting a domain controller that currently owns FSMO roles that you want to assign to a specific domain controller in your Active Directory forest.
• The domain controller that currently owns FSMO roles is being taken offline for scheduled maintenance and you need specific FSMO roles to be assigned to a “live” domain controller. This may be required to perform operations that connect to the FSMO owner. This would be especially true for the PDC Emulator role but less true for the RID master role, the Domain naming master role and the Schema master roles.

Microsoft recommend that you seize FSMO roles in the following scenarios:

• The current role holder is experiencing an operational error that prevents an FSMO-dependent operation from completing successfully and that role cannot be transferred.
• A domain controller that owns an FSMO role is force-demoted by using the dcpromo /forceremoval command.
• The operating system on the computer that originally owned a specific role no longer exists or has been reinstalled.

The partition for each FSMO role is in the following list: 

FSMO role	Partition
Schema	CN=Schema,CN=configuration,DC=microsoftguru,dc=com,dc=au
Domain Naming Master	CN=configuration,DC=microsoftguru,dc=com,dc=au
PDC	DC=microsoftguru,dc=com,dc=au
RID	DC=microsoftguru,dc=com,dc=au
Infrastructure	DC=microsoftguru,dc=com,dc=au

How to View/create/remove a new global catalog on the destination global catalog server

1. On the domain controller where you want the new global catalog, start the Active Directory Sites and Services snap-in. To start the snap-in, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services.
2. In the console tree, double-click Sites, and then double-click sitename.
3. Double-click Servers, click your domain controller, right-click NTDS Settings, and then click Properties.
4. On the General tab, click to select the Global catalog check box to assign the role of global catalog to this server. Deselect the Global Catalog check box to remove GC from the DC.
5. Restart the domain controller.

 How to view and transfer FSMO roles in Windows Active Directory

1. Click Start, and then click Run.
2. Type regsvr32 schmmgmt.dll in the Open box, and then click OK.
3. Click OK when you receive the message that the operation succeeded.

Transfer the Schema Master Role

1. Click Start, click Run, type mmc in the Open box, and then click OK.
2. On the File, menu click Add/Remove Snap-in.
3. Click Add.
4. Click Active Directory Schema, click Add, click Close, and then click OK.
5. In the console tree, right-click Active Directory Schema, and then click Change Domain Controller.
6. Click Specify Name, type the name of the domain controller that will be the new role holder, and then click OK.
7. In the console tree, right-click Active Directory Schema, and then click Operations Master.
8. Click Change.
9. Click OK to confirm that you want to transfer the role, and then click Close.

Transfer the Domain Naming Master Role

1. Click Start, point to Administrative Tools, and then click Active Directory Domains and Trusts.
2. Right-click Active Directory Domains and Trusts, and then click Connect to Domain Controller.
   NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.
3. Do one of the following:
   • In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.
     -or-
   • In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
4. In the console tree, right-click Active Directory Domains and Trusts, and then click Operations Master.
5. Click Change.
6. Click OK to confirm that you want to transfer the role, and then click Close.

Transfer the RID Master, PDC Emulator, and Infrastructure Master Roles

1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Right-click Active Directory Users and Computers, and then click Connect to Domain Controller.
   NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.
3. Do one of the following:
   • In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.
     -or-
   • In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
4. In the console tree, right-click Active Directory Users and Computers, point to All Tasks, and then click Operations Master.
5. Click the appropriate tab for the role that you want to transfer (RID, PDC, or Infrastructure), and then click Change.
6. Click OK to confirm that you want to transfer the role, and then click Close.

Transfer FSMO roles using ntdsutil

• Click Start, click Run, type ntdsutil in the Open box, and then click OK.
• Type roles, and then press ENTER
• Type connections, and then press ENTER
• Type Connect to Server ServerName and Press Enter
• At the server connections prompt, type q, and then press ENTER
• Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type ? at the fsmo maintenance prompt, and then press ENTER,
• At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility

To seize the FSMO roles by using the Ntdsutil utility, follow these steps:

• Click Start, click Run, type ntdsutil in the Open box, and then click OK.
• Type roles, and then press ENTER.
• Type connections, and then press ENTER.
• Type connect to server servername, and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
• At the server connections prompt, type q, and then press ENTER.
• Type seize role, where role is the role that you want to seize. For a list of roles that you can seize, type ? at the fsmo maintenance prompt, and then press ENTER,
• At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
  Notes

Important KBs and Readings

 

Repadmin Examples and Dcdiag Examples

Best Practices Analyzer for Active Directory Domain Services

Microsoft Premier Field Engineering Platform Reporting Tool (MPS_REPORTS)

Microsoft Product Support Reports Viewer 2.0

Best Practice Active Directory Design for Managing Windows Networks

Windows 2000 Active Directory FSMO roles

FSMO placement and optimization on Active Directory domain controllers

Flexible Single Master Operation Transfer and Seizure Process

Phantoms, tombstones and the infrastructure master

How to view and transfer FSMO roles in Windows Server 2003

Managing Operations Master Roles

How to remove data in active directory after an unsuccessful domain controller demotion

FSMO placement and optimization on Windows 2000 domain controllers

Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

Windows Server 2008 R2 Active Directory Certificate Services Deep Dive

How to use the Certreq.exe utility to create and submit a certificate request that includes a SAN

Create a text file using notepad. copy the following content and paste inside the text file and save as request.inf.

;copy from here

[Version]

Signature=”$Windows NT$

[NewRequest]
Subject = “CN=myserver.microsoftguru.com.au” ; must be the FQDN of domain controller
EncipherOnly = FALSE ; only for Win2k3 & WinXP
Exportable = TRUE  ; TRUE = Private key is exportable
KeyLength = 2048    ; Common key sizes: 2048, 4096, 8192, 16384
KeySpec = 1             ; Key Exchange
KeyUsage = 0xA0     ; Digital Signature, Key Encipherment
MachineKeySet = True
ProviderName = “Microsoft RSA SChannel Cryptographic Provider”
ProviderType = 12
RequestType = CMC ; or PKCS10

; Omit entire section if CA is an enterprise CA
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication

OID=1.3.6.1.5.5.7.3.2 ; Client Authentication

[Extensions]

; If your client operating system is Win2k8,Win Vista, Win7

; SANs can be included in the Extensions section by using the following text format.

;Note 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = “{text}”

_continue_ = “dns=Exchange1.microsoftguru.com.au&”

_continue_ = “dn=CN=Exchange1,OU=My Servers,DC=microsoftguru,DC=com,DC=au&”

_continue_ = “url=http://myserver.microsoftguru.com.au&”

_continue_ = “ipaddress=172.31.10.134&”

_continue_ = “email=test@microsoftguru.com.au& “

_continue_ = “upn=test@microsoftguru.com.au&”

_continue_ = “guid=f7c3ac41-b8ce-4fb4-aa58-3d1dc0e36b39&”    

;Alternatively you create a SAN attribute using a script provided in KB

; use text format or encrypted format of SAN. 2.5.29.17=MCaCEnd3dzAxLmZhYnJpa2FtLmNvbYIQd3d3LmZhYnJpa2FtLmNvbQ==

[RequestAttributes]

; Multiple alternative names must be separated by an ampersand (&).

;In the example I have shown two different types of SAN. Use only one type of SAN.

;Asterisk *.yourdomainname.com.au is used for Wildcard certificates.

SAN=”dns=exchange1.microsoftguru.com.au&dns=www.microsoftguru.com.au&ipaddress=172.31.10.130″

SAN=”dns=webmail.microsoftguru.com.au&dns=*.microsoftguru.com.au&dns=autodiscover.microsoftguru.com.au”

CertificateTemplate = WebServer

; change template name depending on your environment.

; remove “;” from request.inf file. file ends here.

Important Note: Some third-party certification authorities (For examples ISPs who sell SSL certificate) may require additional information in the Subject parameter. Such information includes an e-mail address (E), organizational unit (OU), organization (O), locality or city (L), state or province (S), and country or region (C). You can append this information to the Subject name (CN) in the Request.inf file. For example: Subject=”E=test@microsoftguru.com.au, CN=<FQDN of server>, OU= My Servers, O=Microsoftguru, L=Perth, S=WA, C=AU.” Amend Request.inf as per your need. For a standard certificate request you can omit SAN, [Extensions] and[EnhancedKeyUsageExtension] section.

Open a command prompt. At the command prompt, type the following command, and then press ENTER:

certreq -new c:request.inf c:certnew.req

At the command prompt, type the following command, and then press ENTER:

certreq -submit c:certnew.req c:certnew.cer

If there is more than one CA in the environment, the -config switch can be used in the command line to direct the request to a specific CA. If you do not use the -config switch, you will be prompted to select the CA to which the request should be submitted.

certreq -submit -config “DC.microsoftguru.com.auMYCA” c:certnew.req c:certnew.cer

Use the Request ID number to retrieve the certificate. To do this, type the following command, and then press ENTER:

certreq -retrieve RequestID c:certnew.cer

You can also use the -config switch here to retrieve the certificate request from a specific CA.

At the command prompt, type the following command, and then press ENTER:

certreq -accept c:certnew.cer

This command imports the certificate into the appropriate store and then links the certificate to the private key that is created in previous step.

How to configure a CA to accept a SAN attribute from a certificate request

certutil -setreg policyEditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

To repair a certificate

1. If you are using a network HSM, complete steps 8 through 10 to repair the association between the imported CA certificate and the private key that is stored in the HSM.

2. In the console tree, double-click Personal Certificates, and click the imported CA certificate.

3. On the Action menu, click Open. Click the Details tab, copy the serial number to the Clipboard, and then click OK.

4. Open a Command Prompt window, type certutil –repairstore My “{Serialnumber}” and then press ENTER.

How to enable secure certificate enrolment in certificate authority

Step1: Create request.inf file using WebServer template

Step2: Generate a web server certificate request.req file using certreq.exe tools

certreq -new c:request.inf c:request.req

Step3: Submit the request.req file using certreq.exe or CA Management Console. Save certificate.cer

Open CA MMC>Select CA server>Right click on CA Server>Click All Task>Submit a new request

Point the location c:request.req and submit. you will be prompted to save certificate.

Step4: Import the certificate into certificate authority

Start Microsoft Management Console (MMC). Add the Certificates snap-in that manages certificates on the local computer.

Expand Certificates (Local Computer), expand Personal, and then expand Certificates. Right Click Import certificate you saved in previous steps.

Step5: Open IIS Management Console>Select Default Web Site>Click Bindings from Action Pan>Click Add>Select HTTPS>Select the certificate you just imported in previous step. Click OK.

Step6: Run iisreset /restart from command prompt

Step7: Test https://MYCA/certsrv

How to use secure Web enrollment pages to submit a certificate request to an enterprise CA

To submit a certificate request that contains a SAN to an enterprise CA, follow these steps:

1. Open Internet Explorer. In Internet Explorer, connect to https://MYCA/certsrv.
   
2. Click Request a Certificate.>Click Advanced certificate request.

1. Click request a certificate
2. In the Certificate Template list, click Web Server. Note The CA must be configured to issue Web Server certificates.
3. Provide identifying information as required.
4. In the Name box, type the fully qualified domain name FQDN of the server.
5. Under Key Options, set the following options:
   • Create a new key set
   • CSP: Microsoft RSA SChannel Cryptographic Provider
   • Key Usage: Exchange
   • Key Size: 1024 – 16384
   • Automatic key container name
   • Store certificate in the local computer certificate store

Under Advanced Options, set the request format to CMC. In the Attributes box, type the desired SAN attributes. SAN attributes take the following form:

san:dns=dns.name[&dns=dns.name]

Multiple DNS names are separated by an ampersand (&). For example, if the name of the server is myserver.microsoftguru.com.au and the alias are autodiscover.microsoftguru.com.au and webamil.microsoftguru.com.au, these names must be included in the SAN attributes. The resulting attribute string appears as follows:

san:dns=myserver.microsoftguru.com.au&dns=myweb.microsoftguru.com.au&dns=mysite.microsoftguru.com.au

 

Click Submit. If you see the Certificate Issued Web page, click Install this Certificate.

My preferred way to request a certificate is to create a .req file shown in previous steps. open .req file in a notepad and copy the contents. click submit a certificate request by using base 64-encode

Paste the contents into base 64-encode. Select web server template. click submit.

Now obtain certificate click yes.

to download certificate with root CA CRL  click Download certificate chain in p7b format

to download only certificate click download certificate and save.

How to configure Private Key in Certificate Authority and Export Private Key

1. Open CA MMC from Administrative Tools>Right Click on Certificate Template>Click Manage

2. Select WebServer Template>Right Click on WebServer Template>Click Duplicate Template>Select Win2k3 or Win2k8 OS Version>Type Template Name as WebServer With Private Key in General Tab

3. Click Request Handling Tab>Check Allow private key to be exported

 

4. Click Security Tab> Allow appropriate security for the person who will enroll and export the certificates

5. Click Ok. Close CA MMC.

6. Create a WebServer Request.inf. Create Request.req file

7. Submit WebServer request to https://myca/certsrv . Download and install certificate.

To export a certificate with the private key

1.Open Certificate Manager by clicking the Start button>Search Box>Type certmgr.msc, and then pressing ENTER.‌

2. Go to Certificates-Current UserPersonalCertificates>Select Certificate you would like to export.

3. On the Action menu, point to All Tasks, and then click Export. In the Certificate Export Wizard, click Yes, export the private key.

Note that this option will appear only if the private key is marked as exportable in request.inf file and you have access to the private key.

4. Under Export File Format, do one or all of the following, and then click Next.

• To include all certificates in the certification path, select the Include all certificates in the certification path if possible check box.
• To delete the private key if the export is successful, select the Delete the private key if the export is successful check box.

5. In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next.

6. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key, click Next, and then click Finish.

How to import Private Key

1. Click Start Menu>Search Box>Click mmc.msc>Click Certificates>Add Computer Account>Click OK.

2. Click a folder, click the Action menu, point to All Tasks, and then click Import.

3. Browse to the location where you exported certificates>Select Certificate>Provide password to import the certificate.

4. Click Next, and then follow the instructions.

Playing with AD CS Administration Cmdlets in Windows PowerShell

The following Windows PowerShell® cmdlets that are for use in administering the Active Directory Certificate Services (AD CS) certification authority (CA) role service in Windows Server® “8” Beta.

• Import-Module ServerManager – Imports the Server Manager module that provides the Add-WindowsFeature cmdlet.
• Add-WindowsFeature Adcs-Cert-Authority – Adds the Certification Authority role service binaries.
• Add-WindowsFeature Adcs-Enroll-Web-Pol – Adds the Certificate Enrllment Policy Web Service binaries.
• Add-WindowsFeature Adcs-Enroll-Web-Svc – Adds the Certificate Enrollment Web Service binaries.
• Add-WindowsFeature Adcs-Web-Enrollment – Adds the Certification Authority Web Enrollment role service binaries.
• Add-WindowsFeature Adcs-Device-Enrollment – Adds the Network Device Enrollment Service binaries.
• Add-WindowsFeature Adcs-Online-Cert – Adds the Online Responder role service binaries.
• Get-Command -Module AdcsDeployment – Displays all the cmdlets that are associated with AD CS Deployment.

Disaster recovery or Migrate procedure of Active Directory Certificate Authority:

Moving a CA from one computer to a second computer involves the following procedures:

• Backing up the CA on the first computer
• Restoring the CA on the second computer

You must be a member of domain admins security group to perform the following operation. To move a CA from a server that is running Windows Server 2003 to a server that is running Windows Server 2008, you can either complete the Windows upgrade first and then move the CA or move the CA first and then upgrade Windows.

• To upgrade Windows first: Upgrade the first server from Windows Server 2003 to Windows Server 2008, back up the CA on this server, and then restore the CA on a second server running Windows Server 2008.
• To move the CA first: Back up the CA on a computer running Windows Server 2003, restore the CA on a second computer running Windows Server 2003, and then upgrade the second server to Windows Server 2008.

To back up a CA

1. Open the Certification Authority snap-in.

2. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard.

3. Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes. Specify the backup location, and then click Next.

4. Type a password for the CA private key backup file, and type it a second time to confirm the password. then click Finish

5. Click Start, click Run, type regedit, and then click OK. Locate and right-click the following registry subkey: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCertSvcConfiguration

 

6. Click Export. Save the registry file in the CA backup folder that you used for the Certification Authority Backup Wizard.

7. Backup the CA logs from the D:WinntSystem32Certlog folder, you must restore the backup to the D:WinntSystem32Certlog folder. After you restore the backup, you can move the CA database files to a different location.

8. In addition of above steps back up CAPolicy.inf . If your source CA is using a custom CAPolicy.inf file, you should copy the file to the same location as the source CA backup files. The CAPolicy.inf file is located in the %SystemRoot% directory, which is usually C:Windows.

To back up a CA database and private key by using Certutil.exe

1. Log on with local administrative credentials to the CA computer.

2. Open a Command Prompt window.

3. Type Certutil.exe –backupdb <BackupDirectory> and press ENTER.

4. Type Certutil.exe –backupkey <BackupDirectory> and press ENTER.

5. Type a password at the prompt, and press ENTER. You must retain a copy of the password to access the key during CA installation on the destination server.

6. Type net stop certsvc and press ENTER to stop the Active Directory Certificate Services service. The service must be stopped to prevent issuance of additional certificates.

7. After the backup completes, verify the following files in the location you specified:

   • CAName.p12 containing the CA certificate and private key
   • Database folder containing files certbkxp.dat, edb#####.log, and CAName.edb

8. Copy all backup files to a location that is accessible from the destination server; for example, a network share or removable media.

How to remove the CA role service from the source server

It is important to remove the CA role service from the source server after completing backup procedures and before installing the CA role service on the destination server. Enterprise CAs and standalone CAs that are domain members store in Active Directory Domain Services (AD DS) configuration data that is associated with the common name of the CA. Removing the CA role service also removes the CA’s configuration data from AD DS. Because the source CA and destination CA share the same common name, removing the CA role service from the source server after installing the CA role service on the destination server removes configuration data that is required by destination CA and interferes with its operation.

The CA database, private key, and certificate are not removed from the source server by removing the CA role service. Therefore, reinstalling the CA role service on the source server restores the source CA if migration fails and performing a rollback is required.

Highly Recommended Tasks. Staging a certificate restore is most import part before you decommission existing certificate server. Create a isolated environment similar to your Active Directory Domain Services. Add new Certificate Authority and restore the database and private key. test certificates, templates, registry and private key whether it is similar to your Production infrastructure. Once you happy and restoration tasks complete successfully you can decommission certificate authority. if source certificate authority is virtual than I would recommend you to take a snapshot before you remove the CA role.

• To remove the CA on a computer running Windows Server 2003, use the Add/Remove Windows Components wizard.
• To remove the CA on a computer running Windows Server 2008, use the Remove Roles Wizard in Server Manager.

To restore a CA on a new server from a backup copy

1. Open Server Manager, and click Active Directory Certificate Services. Click Next two times.

2. On the Select Role Services page, select the Certification Authority check box, and then click Next.

3. On the Specify Setup Type page, click either Standalone or Enterprise, and then click Next.

   Note You must have a network connection to a domain controller in order to install an enterprise CA.

4. On the Specify CA Type page, click the appropriate CA type, and then click Next.

5. On the Set Up Private Key page, click Use existing private key, click Select a certificate and use its associated private key, and then click Next.

6. On the Select Existing Certificate page, click Import, type the path of the .P12 file in the backup folder, type the password that you chose in the previous procedure to protect the backup file, and then click OK.

7. In the Public and Private Key Pair dialog box, verify that Use existing keys is selected.

8. Click Next two times.

9. On the Configure Certificate Database page, specify the same location for the certificate database and certificate database log as on the previous CA computer. Click Next.  On the Confirm Installation Options page, review all of the configuration settings> click Install and wait until the setup process has finished.

10. Locate the registry file that you saved in the backup procedure, and then double-click it to import the registry settings. If the path that is shown in the registry export from the old CA differs from the new path, you must adjust your registry export accordingly. Verify the registry in the following location. HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCertSvc

11. Open the Services snap-in to stop the Active Directory Certificate Services (AD CS) service.

12. Open the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA to open the Certification Authority Restore Wizard.

13 Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes. Type the backup folder location, and then click Next. Verify the backup settings. The Issued Log and Pending Requests settings should be displayed. Click Finish, and then click Yes to restart AD CS when the CA database is restored.

To restore the CA database by using Certutil.exe

1. Log on to the destination server by using an account that is a CA administrator.

2. Open a Command Prompt window.

3. Type certutil.exe -f -restoredb <CA Database Backup Directory> and press ENTER.

To Restoring the certificate templates list

Log on with administrative credentials to the destination CA.

1. Open a command prompt window.

2. Type certutil -setcatemplates +<templatelist> and press ENTER.

Important ! Some registry parameters should be migrated without changes from the source CA computer, and some should not be migrated. If they are migrated, they should be updated in the target system after migration because some values are associated with the CA itself, whereas others are associated with the domain environment, the physical host, the Windows version, or other factors that may be different in the target system.

Verify registry location and Configuration parameters are: 

HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicescertsvcConfiguration

• DBDirectory
• DBLogDirectory
• DBSystemDirectory
• DBTempDirectory
• DBSessionCount

HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicescertsvcConfigurationCAname

• CACertPublicationURLs
• CRLPublicationURLs

 

Granting permissions on AIA and CDP containers

If the name of the destination server is different from the source server, the destination server must be granted permissions on the source server’s CDP and AIA containers in AD DS to publish CRLs and CA certificates. Complete the following procedure in the case of a server name change.

To grant permissions on the AIA and CDP containers

1. Open Active Directory Sites and Services> In the console tree, click the top node.

2. On the View menu, click Show services node. In the console tree, expand Services, expand Public Key Services, and then click AIA.

3. In the details pane, right-click the name of the source CA, and then click Properties.

4. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK.

5. Type the name of the destination server, and click OK. In the Allow column, click Full Control, and click Apply.

6. If the source server object is displayed in Group or user names, click the name of the source server, then click Remove, and then click OK.

7. In the console tree, expand CDP, and then click the name of the source server.

8. In the details pane, right-click the cRLDistributionPoint item at the top of the list, and then click Properties.

4. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK.

5. Type the name of the destination server, and click OK. In the Allow column, click Full Control, and click Apply. If the source server object is displayed in Group or user names, click the name of the source server, then click Remove, and then click OK.

6. Repeat steps 13 through 18 for each cRLDistributionPoint item.

Additional procedures for failover clustering

• CA Role must be installed on both nodes

• Stop Active Directory Certificate Services from Services.msc

• Ensure shared storage is online.

• certificate store and logs must be placed in shared storage.

To verify shared storage is online

1. Log on to the destination server. Start Server Manager.

2. In the console tree, double-click Storage, and click Disk Management.

3. Ensure that the shared storage is online and assigned to the node you are logged on to.

To configure AD CS as a cluster resource

Follow Configure Microsoft Fail over Cluster URL to create and configure a cluster.

1. Open Failover Cluster Manager from Administrative Tools> Right Click on newly created cluster node>click Configure a service or Application. If the Before you begin page appears, click Next.

2. In the list of services and applications, select Generic Service, and click Next.

3. In the list of services, select Active Directory Certificate Services, and click Next.

4. Specify a service name, and click Next. Select the disk storage that is still mounted to the node, and click Next.

5. To configure a shared registry hive, click Add, type SYSTEMCurrentControlSetServicesCertSvc, and then click OK. Click Next twice.

6. Click Finish to complete the failover configuration for AD CS.

7. In the console tree, double-click Services and Applications, and select the newly created clustered service.

8. In the details pane, click Generic Service. On the Action menu, click Properties.

9. Change Resource Name to Certification Authority, and click OK.

If you use a hardware security module (HSM) for your CA, complete the following procedure.

To create a dependency between a CA and the network HSM service

1. Open the Failover Cluster Management snap-in. In the console tree, click Services and Applications.

2. In the details pane, select the previously created name of the clustered service.

3. On the Action menu, click Add a resource, and then click Generic Service.

4. In the list of available services displayed by the New Resource wizard, click the name of the service that was installed to connect to your network HSM. Click Next twice, and then click Finish.

5. Under Services and Applications in the console tree, click the name of the clustered services.

6. In the details pane, select the newly created Generic Service. On the Action menu, click Properties.

7. On the General tab, change the service name if desired, and click OK. Verify that the service is online.

8. In the details pane, select the service previously named Certification Authority. On the Action menu, click Properties.

9. On the Dependencies tab, click Insert, select the network HSM service from the list, and click OK.

To grant permissions on public key containers: If you are migrating to a failover cluster, complete the following procedures to grant all cluster nodes permissions to on the following AD DS containers:

• The AIA container
• The Enrollment container
• The KRA container

To grant permissions on public key containers in AD DS

1. Open Active Directory Sites and Services. In the console tree, click the top node.

2. On the View menu, click Show services node. In the console tree, expand Services, then Public Key Services, and then click AIA.

3. In the details pane, right-click the name of the source CA, and then click Properties.

4. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK.

5. Type the computer account names of all cluster nodes, and click OK. In the Allow column, select the Full Control check box next to each cluster node, and click OK.

6. In the console tree, click Enrollment Services.  In the details pane, right-click the name of the source CA, and then click Properties.

7. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK. Type the computer account names of all cluster nodes, and click OK.

8. In the Allow column, select the Full Control check box next to each cluster node, and click OK.

9. In the console tree, click KRA.

10. In the details pane, right-click the name of the source CA, then click Properties. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK.

11. Type the names of all cluster nodes, and click OK. In the Allow column, select the Full Control check box next to each cluster node, and click OK.

To check the DNS name for a clustered CA in AD DS

1. Log on to the active cluster node as a member of the Enterprise Admins group.

2. Open ADSI Edit. On the Action menu, click Connect to. click Configuration, and click OK.

3. In the console tree, expand ConfigurationServicesPublic Key ServicesEnrollment Services.

4. Double click on CN and check check dNSHostName mentioned same as Failover Cluster Management in the Failover Cluster Manager snap-in, and click OK. if not add proper FQDN DNS of cluster as shown on the screenshot. Click OK to save changes.

5. Open dnsmgmt.msc from the start menu>run. Verify a Host (A) DNS record has been added with the same name and IP address of the Cluster. 

Configuring CRL distribution points for failover clusters

When a CA is running on a failover cluster, the server’s short name must be replaced with the cluster’s short name in the CRL distribution point and authority information access locations. To publish the CRL in AD DS, the CRL distribution point container must be added manually.

The following procedures must be performed on the active cluster node.

To change the configured CRL distribution points

1. Open registry edit and Locate the registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCertSvcConfiguration.

2. Click the name of the CA. In the right pane, double-click CRLPublicationURLs.

3. In the second line, replace %2 with the service name specified in step 6 of the procedure “To configure AD CS as a cluster resource.”  The service name also appears in the Failover Cluster Management snap-in under Services and Applications. Restart the CA service.

4. Open a command prompt, type certutil -CRL, and press ENTER.

5. To create the CRL distribution point container in AD DS At a command prompt, type cd %windir%System32CertSrvCertEnroll, and press ENTER. The CRL file created by the certutil –CRL command should be located in this directory.

6. To publish the CRL in AD DS, type certutil -f -dspublish “CRLFile.crl” and press ENTER.

To setup Audit on CA. Open CA MMC>Select the Certificate Server>Right Click>Click Property

Check desired Events to audit>Click Ok. restart CA Services.

To deploy Enterprise root CRL using GPO. Create a new group policy or use and existing GPO. Click Edit. Expand to Computer ConfigurationWindows SettingsSecurity SettingsPublic Key Policies. Right Click on trusted Root Certificates>Click Import>Locate root certificate and import the certificate. Click Close.

To request Automatic Certificate request. Create a new group policy or use and existing GPO. Click Edit. Expand to Computer ConfigurationWindows SettingsSecurity SettingsPublic Key Policies. Right Click Automatic Certificate Request >Click New >Click Automatic certificate Request>Configure Certificate template and request. Follow the screenshot. Note that Auto Enroll must be allowed in the security tab of certificate template in CA.

Additional references

How to extend root certificate authority and subordinate CA

Configure Microsoft Fail over Cluster

Active Directory Certificate Services Overview

Error message when you try to install Exchange Server 2010 SP2: “AuthorizationManager check failed”

Error: Message :

Cause:

1. Exchange Servers placed in a OU which has GPO applied to them.

2. PowerShell Execution Policy set to unrestricted or remote signed.

Solution:

Step1: Create a separate Organizational Unit in Active Directory and place Exchange Servers in that  Organizational Unit . Do not apply any GPO on newly created Organizational Unit.

Step2: Log on to Exchange Server. Start Menu>Run>gpedit.msc

Right click on Local Computer Policy>Property>Disable computer Configuration settings and User Configuration Settings

Step3: Open PowerShell> issue the following command

Set-ExecutionPolicy –Scope LocalMachine –ExecutionPolicy Undefined –Confirm –Force

Step4: Reboot Server. Once rebooted log back on to the Exchange Server. check execution policy by issuing the command

Get-ExecutionPolicy –List

Step5:  Start Menu>Run>services.msc . Stop any backup software and Antispam software services on the server.

Step6: Upgrade HT/CAS Server: Download Exchange 2010 SP2 and install Exchange SP2 by the issuing the following command in PowerShell

Setup.com /M:Upgrade /InstallWindowsComponents

Apply Service Pack 2 to HT and MBX server first. If you have multiple servers in HT/CAS Array than you can apply service to one exchange array member. your exchange infrastructure still be functional and service mail systems.

 

Step7: download Update Rollup1 for Exchange 2010 SP2 and apply rollup1.

 

Step7: Upgrade Mailbox Server: Log on to MBX server. Open Exchange Management Console>Click Server Configuration>Select Mailbox>Select Server>Click Switchover Server>Browse and Select a server>click ok. Wait few minutes to finish the operation. Check the mailbox node again. It should show Is Active: False.

Now follow the previous steps to upgrade to SP2 and Rollup1.

Caution: Take a snapshot if Exchange is a virtual server. If exchange 2010 SP2 installation fails for another reason revert the snapshot back to original. Exchange will still be functional even active directory schema is upgraded by exchange SP2 installer.

If server is physical than the following URL might be handy for you.

Recovery Databases

Understanding Backup, Restore and Disaster Recovery

Recover an Exchange Server

Reference Microsoft KB2668686

How to Extend Root CA and Sub CA Validation Period in Windows Server 2008 R2 Environment—Step by Step Guide

How Certificate Authority Check Validity:

As a pre-caution backup CA, IIS and registry of certificate servers.

To Backup Certificate Authority

1. Log on to the system as a Backup Operator or a Certification Authority Administrator.
2. Open Certification Authority>click the name of the certification authority (CA).
   Certification Authority (Computer)/CA name
3. On the Action menu, point to All Tasks, and click Backup CA.
4. Click Next>Select Private and Certificate Database>Point Backup location>Click Next>Click Finish.

To restore certificate authority

1. Log on to the system as a Backup Operator or a Certification Authority Administrator.
2. Open Certification Authority>click the name of the certification authority (CA).
   Certification Authority (Computer)/CA name
3. On the Action menu, point to All Tasks, and click Restore CA>Click Yes
4. Click Next> Select Private and Certificate Database>Point Backed up CA DB location>Click Next>Click Finish.

How to Backup Windows Registry Key.. Follow these KB256986 and KB322756 article.

You can use the following command line to backup and restore IIS metabase. Backup should be used to back up the IIS Web content pages and the CA. Open Command Prompt as an administrator>Change Directory to %windir%system32inetsrv

To backup configuration, run the follow command:

appcmd.exe add backup “CABackupddmmyyyy”

To restore that backup, run this command:

appcmd.exe restore backup “CABackupddmmyyyy”

To extend validity period in Enterprise Root CA perform step1 to step4 on Enterprise Root CA Server

Step1: Open Command Prompt as an Administrator> type Following

certutil -getreg caValidityPeriod

certutil -getreg caValidityPeriodUnits

certutil –setreg caValidityPeriod Years

certutil -setreg caValidityPeriodUnits 10

Step2: Create a file using notepad.txt and rename the file as CAPolicy.inf .Copy the following into the file CAPolicy.inf and paste CAPolicy.inf file into C:Windows Folder

[Version]
Signature= “$Windows NT$”
[PolicyStatementExtension]
Policies = AllIssuancePolicy
Critical = FALSE
[AllIssuancePolicy]
OID = 2.5.29.32.0
[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=10

Step3: If you don’t want to renew Certificate Key then type the following command into command prompt

net stop certsvc
net start certsvc

If you want to renew key then skip step3 and follow step4

Step4:

1. To open Certification Authority, click Start, click Control Panel, double-click Administrative Tools, and then double-click Certification Authority.

2. In the console tree, click the name of the certification authority (CA)> Select Certification Authority (Computer)/CA name

3. On the Action menu, point to All Tasks, and click Renew CA Certificate.

4. Do one of the following:

· If you want to generate a new public and private key pair for the certification authority’s certificate, click Yes.

· If you want to reuse the current public and private key pair for the certification authority’s certificate, click No.

5. Right Click Certification Authority (Computer)/CA name, Click Property> Click General Tab>Select Certificate #1>View Certificate>Check Expiry date as above mentioned CAPolicy.inf

To extend validity period in Enterprise subordinate CA Server perform step5 to step8 in SUB CA

Step5: Open Command Prompt in SUB CA and type the following and press enter

certutil -getreg caValidityPeriod

certutil -getreg caValidityPeriodUnits

certutil –setreg caValidityPeriod Years

certutil -setreg caValidityPeriodUnits 5

Step6: Create a file using notepad.txt and rename the file as CAPolicy.inf . Copy the following into the file CAPolicy.inf and paste CAPolicy.inf file into C:Windows Folder

[Version]
Signature= “$Windows NT$”
[PolicyStatementExtension]
Policies = AllIssuancePolicy
Critical = FALSE
[AllIssuancePolicy]
OID = 2.5.29.32.0
[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=5

Step7:

If you don’t want to renew Certificate Key then type the following command into command prompt

net stop certsvc
net start certsvc

If you want to renew key then skip step7 and follow step8

Step8:

1. To open Certification Authority, click Start, click Control Panel, double-click Administrative Tools, and then double-click Certification Authority.

2. In the console tree, click the name of the certification authority (CA)> Select Certification Authority (Computer)/CA name

3. On the Action menu, point to All Tasks, and click Renew CA Certificate.

4. Do one of the following:

· If you want to generate a new public and private key pair for the certification authority’s certificate, click Yes.

· If you want to reuse the current public and private key pair for the certification authority’s certificate, click No.

5. If a parent CA is available online

· Click Send the request directly to a CA already on the network.

· In Computer Name, type the name of the computer on which the parent CA is installed.

· In Parent CA, click the name of the parent CA.

6. If a Root CA is Offline or not a member of domain

· Click Save the request to a file.

· In Request file, type the path and file name of the file that will store the request.

· Obtain this subordinate CA’s certificate from the root CA.

7. Open Certification Authority>click the name of the CA. Certification Authority (Computer)/CA name

8. On the Action menu, point to All Tasks, and then click Install CA Certificate.

9. Locate the certificate file received from the parent certification authority, click this file, and then click Open.

10. Right Click Certification Authority (Computer)/CA name, Click Property> Click General Tab>Select Certificate #1>View Certificate>Check Expiry date as above mentioned CAPolicy.inf

Post renewal checks:

Check all the event logs in Root CA and Sub CA for any potential error related to the changes you made

If you have any gotcha and you have to restore a CA, the IIS metabase must also be restored if it has been damaged or lost. If a damaged or missing IIS metabase is not restored, IIS will fail to start, and that will result in Certificate Services Web pages (http://caservername/certsrv) failing to load. An alternative method is to recreate the IIS metabase and then use the certutil.exe -vroot command at a command line to reconfigure the IIS server to support the CA Web pages.

All Websites and Computer certificates issued by sub CA and Root CA are valid as long CA’s are valid and issued certificates aren’t expired.

Issue new certificate CRL using GPO to all computers and servers as you have changed root CA. Export Root CA CRL using http://caservername/certsrv . Click Download a CA Certificate, Click Download CA Certificate and Save in a location. Create new GPO or edit an existing GPO

1. Open the Group Policy object (GPO) that you want to edit.
2. Go to Policy Object Name/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities
3. In the console tree, click Trusted Root Certification Authorities.
4. On the Action menu, point to All Tasks, and then click Import and point to the location where you saved CA certificate.
5. Apply this GPO to designated computer and server OU.

 

 

 

Relevant Article:

An Overview of Active Directory Certificate Service

Active Directory Best Practice

Exchange 2010 SP2 is available for download

Microsoft Exchange Server 2010 SP2 is available to download from Microsoft download center. Download link and benefits of SP2 is here. Read systems requirement and release notes before you proceed installation. You may need to backup/snapshot(if virtualized) exchange servers before final installation.

Advanced Group Policy Object Management 4.0

Why do you need Advanced Group Policy Management (AGPM)? If you are a midsize or large organization with several group policy administrator in multiple sites, everybody is playing their part in group policy administration but does not have a proper control in terms of who does what than you are in real mess in production environment. In this scenario, AGPM helps role based GPO management such as who can review, edit, approve and deploy Group Policy objects. AGPM also plays an integral part of change control practice in your organization. AGPM can improve GPO deployment and provide better management in IT department. You can use AGPM to track each version of each GPO and history, just as application developers use version control to track source code. AGPM can be found in Microsoft Desktop Optimization Pack (MDOP). A generic GPO deployment process using AGPM are as follows.

  

AGPM is combined with server component (the AGPM Service) and a client component (the AGPM snap-in). you have to install Microsoft Advanced Group Policy Management – Server on a system that has access to the policies that you want to manage. you can install the Microsoft Advanced Group Policy Management in a domain controller. An AGPM Client is installed  on any system from which Group Policy administrators will review, edit, and deploy GPOs. AGPM provides advanced change control features that can help you manage the lifecycle of GPOs.  The following is a Change Control view of AGPM.

The following steps are necessary to change and deploy a GPO:

Check out the GPO from the archive.

Edit the GPO as necessary.

Check in the GPO to the archive.

Deploy the GPO to production.

A controlled GPO can not be changed by any GPO Administrator anytime without prior approval. AGPM keeps a history of changes for each GPO, as shown in screenshot.

You can deploy any version of a GPO to production, so you can quickly roll back a GPO to an earlier version if necessary. AGPM can also compare different versions of a GPO, showing added, changed, or deleted settings. Therefore, you can easily review changes before approving and deploying them to the production environment. In addition, a complete history of each GPO enables you to audit not only changes but also all activities related to that GPO.

Role-Based Delegation: Group Policy already provides a rich delegation model that allows you to delegate administration to regional and task-oriented administrators. AGPM provides a role-based delegation model that adds a review and approval step to the workflow, as shown below delegation model.

Role	View	Compare	Edit	Create	Approve	Deploy
Reviewer	√	√	×	×	×	×
Editor	√	√	√	√	×	×
Approver	√	√	√	√	√	√

Cross-Forest Management: AGPM 4.0 also introduces cross-forest management. You can use the following process to copy a controlled GPO from a domain in one forest to a domain in a second forest:

Export the GPO from domain A in the first forest to a CAB file, by using AGPM. Import the GPO into the archive in domain B in the second forest, by using AGPM.

When you import the GPO into the second forest, you can import it as a new controlled GPO. You can also import it to replace the settings of an existing GPO that is checked out of the archive.

Install AGPM Server: Computers on which you want to install AGPM must meet the following requirements and you must be domain admin to create AGPM roles. If you have AGPM 3.0 installed, you do not have to upgrade the operating system before you upgrade to AGPM 4.0.  AGPM Server Requirements are as follows.

• GPMC Features for Windows Server 2008 R2 or Windows Server 2008
• Remote Server Administration Tools for Windows 7
• WCF Activation; Non-HTTP Activation
• Windows Process Activation Service
• Process Model
• .NET 3.5 SP1 Environment
• Configuration APIs

you can install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service’s credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. Log on with an account that is a member of the Domain Admins group. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select Advanced Group Policy Management – Server.

In the Welcome dialog box>click Next>accept the terms and then click Next.

In the Application Path dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click Next.

This account must be a member of the either the Domain Admins group or, for a least-privilege configuration, the following groups in each domain managed by the AGPM Server: Group Policy Creator Owners and Backup Operators

In the AGPM Service Account dialog box, select a service account under which the AGPM Service will run and then click Next.

In the Port Configuration dialog box, type a port on which the AGPM Service should listen. Do not clear the Add port exception to firewall check box unless you manually configure port exceptions or use rules to configure port exceptions. Click Next.

Click Install, and then click Finish to exit the Setup Wizard.

Important! Do not change settings for the AGPM Service through Administrative Tools and Services in the operating system. Doing this can prevent the AGPM Service from starting.

Install AGPM Client: AGPM Client 4.0 requires Windows Server 2008 R2, Windows Server 2008, Windows 7 and the GPMC from RSAT. Both 32-bit and 64-bit versions are supported. AGPM Client can be installed on a computer that is running AGPM Server. AGPM clients requirements are as follows.

• GPMC for Windows Server 2008 or Windows 7
• Remote Server Administration Tools for Windows 7
• .NET Framework 3.0 or later version Features

Before you begin this scenario, create four user accounts for AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign Link GPOs permission to the accounts that have the AGPM Administrator, Approver and Editor roles.

Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select Advanced Group Policy Management – Client.

In the Welcome dialog box, click Next>accept the terms and then click Next>select a location in which to install AGPM Client. Click Next.

In the AGPM Server dialog box, type the DNS name or IP address for the AGPM Server and the port to which you want to connect. The default port for the AGPM Service is 4600. Do not clear the Allow Microsoft Management Console through the firewall check box unless you manually configure port exceptions or use rules to configure port exceptions. Click Next.

In the Languages dialog box, select one or more display languages to install for AGPM Client.

Click Install>click Finish to exit the Setup Wizard.

To configure an AGPM Server connection for all GPO administrators

On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. Click Start>point to Administrative Tools>click Group Policy Management to open the GPMC.

In the details pane, double-click AGPM: Specify default AGPM Server (all domains). In the Properties window, select Enabled and type the DNS name or IP address and port (example, MicrosoftGURU.com.au:4600) for the server hosting the archive. Click OK>Click close the Group Policy Management Editor window.

Configure e-mail notification: As an AGPM Administrator (Full Control), you can designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message that contains a request is sent when an Editor tries to create, deploy, or delete a GPO. In the details pane, click the Domain Delegation tab> Type following From e-mail address field>type the e-mail address for the user account to which you intend to assign the Approver role>type a valid SMTP mail server. In the User name and Password fields, type the credentials of a user who has access to the SMTP service. Click Apply.

 To delegate access to all GPOs throughout a domain: On the Domain Delegation tab>click the Add button>select the user account from Domain>Select GPO Role as Editor>click OK. Repeat the process for Reviewer and Approver Role.

Create a GPO: In an environment that has multiple Group Policy administrators, those with the Editor role can request that new GPOs be created. However, that request must be approved by someone with the Approver role.

On a computer on which you have installed AGPM Client, log on with a user account that is assigned the Editor role in AGPM. In the Group Policy Management Console tree>click Change Control>Click managed GPOs. Right-click the Change Control node>click New Controlled GPO.

Click Submit. The new GPO is displayed on the Pending tab.

To approve the pending request to create a GPO

On a computer on which you have installed AGPM Client, log on with a user account that has the role of Approver in AGPM. Open the e-mail inbox for the account, and notice that you have received an e-mail message from the AGPM alias with the Editor’s request to create a GPO.

In the Group Policy Management Console tree>click Change Control>Click manage GPOs. On the Contents tab>click the Pending tab to display the pending GPOs. Right-click on Pending GPO>click Approve. Click Yes to confirm approval and move the GPO to the Controlled tab.

Edit a GPO: You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account that has the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters long.

On a computer on which you have installed AGPM Client, log on with a user account that has the role of Editor in AGPM. In the Group Policy Management Console>click Change Control>manage GPOs. On the Contents tab in the details pane>click the Controlled tab to display the controlled GPOs. Right-click Managed GPOs>click Check Out>Type a comment > click OK. click Close.

To request the deployment of the GPO to the production environment, On the Controlled tab, the state of the GPO is identified as Checked In>right-click managed GPO>click Deploy.

Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the Cc field. Type a comment to be displayed in the history of the GPO, and then click Submit.

When the AGPM Progress window indicates that overall progress is complete, click Close. MyGPO is displayed on the list of GPOs on the Pending tab.

Review and deploy a GPO: In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After you evaluate the GPO, you deploy it to the production environment and link the GPO to a domain or an organizational unit (OU). The GPO takes effect when Group Policy is refreshed for computers in that domain or OU.

On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver in AGPM. Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.

Open the e-mail inbox for the account and notice that you have received an e-mail message from the AGPM alias with an Editor’s request to deploy a GPO. In the Group Policy Management Console tree, click Change Control in the forest and domain in which you want to manage GPOs.

On the Contents tab in the details pane>click the Pending tab>Double-click a single managed GPO to display its history. Review the settings in the most recent version of GPO.

To deploy the GPO to the production environment

On the Pending tab, right-click a single managed GPO and then click Approve.

Type a comment to include in the history of the GPO>Click Yes. When the AGPM Progress window indicates that overall progress is complete, click Close.

To link the GPO to a domain or organizational unit

In the GPMC, right-click either the domain or an organizational unit (OU) to which you want to apply the GPO that you configured, and then click Link an Existing GPO. In the Select GPO dialog box>click selected GPO>click OK.

Use a template to create a GPO: In this step, you use an account that has the Editor role to create and use a template. That template is a static version of a GPO for use as a starting point for creating new GPOs. Although you cannot edit a template, you can create a new GPO based on a template. Templates are useful for quickly creating multiple GPOs that include many of the same policy settings.

On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Editor in AGPM. In the Group Policy Management Console tree>click Change Control>Click manage GPOs.

On the Contents tab in the details pane>click the Controlled tab>Right-click on a single GPO>click Save as Template to create a template incorporating all settings currently in GPO.

Type a name of Template and a comment, then click OK>click Close. To request that a new GPO be created and managed through AGPM. Click the Controlled tab>Right-click the Change Control node>click New Controlled GPO.

In the New Controlled GPO dialog box, type your e-mail address in the Cc field. Type a name of GPO as the name for the new GPO. Type a comment for the new GPO.

Click Create live so that the new GPO will be deployed to the production environment immediately upon approval.

For From GPO template>select Template>Click Submit>click Close. The new GPO is displayed on the Pending tab.

To check the GPO out from the archive for editing

On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Editor in AGPM. Right-click GPO>click Check Out>Type a comment to be displayed in the history of the GPO while it is checked out>click OK>click Close. On the Controlled tab, the state of the GPO is identified as Checked Out.

To edit the GPO offline and configure the account lockout duration

On the Controlled tab>right-click GPO>click Edit to open the Group Policy Management Editor window and change an offline copy of the GPO. For this scenario, configure the minimum password length:

Under Computer Configuration>double-click Policies>Click Windows Settings>Click Security Settings>Click Account Policies>Click Account Lockout Policy.

In the details pane, double-click Account lockout duration. In the properties window, check Define this policy setting, set the duration to 30 minutes, and then click OK.

Close the Group Policy Management Editor window.

To compare a GPO to another GPO and to a template

To compare Test GPO1 and Test GPO2, On the Controlled tab, click Test GPO1>Press CTRL and click Test GPO2. Right-click Test GPO2, point to Differences, and then click HTML Report.

To delete a GPO

On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver. In the Group Policy Management Console tree, click Change Control in the forest and domain in which you want to manage GPOs.

On the Contents tab>click the Controlled tab to display the controlled GPOs>Right-click GPO, and then click Delete. Click Delete GPO from archive and production to delete both the version in the archive and the deployed version of the GPO in the production environment. Type a comment to be displayed in the audit trail for the GPO>click OK>click Close.

To restore a deleted GPO

On the Contents tab>click the Recycle Bin tab to display deleted GPOs>Right-click GPO>click Restore.

Type a comment to be displayed in the history of the GPO>click OK> click Close.

Important! Restoring a GPO to the archive does not automatically redeploy it to the production environment.

To roll back to an earlier version of a GPO

On the Contents tab>click the Controlled tab>Double-click MyGPO to display its history>Right-click the version to be deployed>click Deploy>click Yes>click Close.

Last but not least PowerShell commands are very handy to work with GPO on the fly. Before you can use PowerShell command you have to install Active Directory Web Services in any Domain Controller in your AD infrastructure. Download PowerShell v2 and install on a utility server or windows 7 admin PC. Open PowerShell Window as an Administrator and type following commands. 

get-command –module grouppolicy

get-command –module grouppolicy | get-help

List of PowerShell Command for GPO and their functionality: 

Backup-GPO                  Backs GPO 

Copy-GPO                      Copies a GPO.

Get-GPInheritance       Retrieves GPO inheritance 

Get-GPO                        Gets one GPO or all GPOs 

Get-GPOReport           Generates a report in either XML or HTML

Get-GPPermissions     Gets the permission level for security principals

Get-GPPrefRegistryValue               Retrieves one or more registry preference

Get-GPRegistryValue                      Retrieves one or more registry-based policy settings

Get-GPResultantSetOfPolicy         Outputs the Resultant Set of Policy (RSoP) information

Get-GPStarterGPO                         Gets one Starter GPO or all Starter GPOs in a domain.

Import-GPO              Imports the Group Policy settings from a backed-up GPO

New-GPLink              Links a GPO to a site, domain, or OU.

New-GPO                   Creates a new GPO.

New-GPStarterGPO Creates a new Starter GPO.

Remove-GPLink        Removes a GPO link from a site, domain, or OU.

Remove-GPO             Deletes a GPO.

Remove-GPPrefRegistryValue Removes one or more registry preference items

Remove-GPRegistryValue Removes one or more registry-based policy settings

Rename-GPO             Assigns a new display name to a GPO.

Restore-GPO             Restores one GPO or all GPOs in a domain from

Set-GPInheritance    Blocks or unblocks inheritance for a specified domain or OU.

Set-GPLink                Sets the properties of the specified GPO link.

Set-GPPermissions    Grants a level of permissions to a security principal

Set-GPPrefRegistryValue Configures a registry preference item

Set-GPRegistryValue  Configures one or more registry-based policy settings

Relevant References:

Active Directory Best Practice

Download Advanced Group Policy from TechNet

Finally! Copy and merge GPOs! PowerShell saves the day!

Microsoft® Desktop Optimization Pack (MDOP)

 

 

Choosing Which Version of AGPM to Install

Active Directory Web Services

 

 

 

 

 

Microsoft Active Directory—Best Practice

In this article, I am writing an overview of Microsoft Active Directory. You might be thinking; well you know everything on Active Directory. I would recommend you to go through this article and revisit your own Active Directory infrastructure. You will improve Active Directory performance, enhance Active Directory infrastructure and rectify so many misconfiguration you have made over the years. 

Lets start with basic question, What is Microsoft Active Directory? Active Directory is Microsoft’s adoption of IEEE X.500. you can use Active Directory Domain Services (AD DS) as the central repository or database for user, group, and computer accounts as well as for application, shared folders and printers. With the adoption of Active Directory on Windows server 2000, Microsoft enhanced Active Directory on Windows Server 2003 and Windows Server 2008. Having the ability to manage these resources from any domain controller within your domain allows you to greatly reduce your administrative overhead.

Active Directory creates a secure boundary for an organization providing log on authentication. Active Directory creates a hierarchical containment structure includes the Active Directory forest, domains in the forest, DNS and organizational units (OUs) in each domain. Feature of Active Directory includes:

• A set of rules that is the schema, that defines the classes of objects and attributes
• A global catalog that contains information about every object in the directory.
• A query and index mechanism, so that objects and their properties can be published and found by network users or applications.
• A replication service that distributes directory data across a network and all domain controllers (writable and RODC) 
• Operations master roles (flexible single master operations or FSMO roles).

What’s new in Windows Server 2008 R2 Active Directory? I reckon, since the adoption of Microsoft Active Directory in Windows Server 2000, the Active Directory has become the fundamental pillar of windows network infrastructure. AD has grown and become a mature technology on windows server 2008 R2 release. There are new features in Windows Server 20008 R2. They are as follows

• Active Directory Application Mode (ADAM).
  Active Directory Federation Services (AD FS)
• Active Directory Rights Management Services (AD RMS)
• Active Directory Certificate Services (AD CS)
• Read -only domain controllers (RODCs)
• Active Directory on Windows Server Core installation

Active Directory has been partitioned in four important parts. Domain controllers in Active Directory typically contain the following directory partition replicas or naming context replicas:

• Configuration: The configuration partition or naming context (NC) contains objects that relate to the logical structure of the forest, structure of the domain, and replication topology. Each domain controller in the forest contains a read/write copy of the configuration partition. Any objects stored in the configuration partition are replicated to each domain controller in each domain, and in a forest.
• Domain: The domain partition or naming context (NC) contains all objects that are stored in a domain. Each domain controller in a domain has a read/write copy of the domain partition. Objects in the domain partition are replicated to only the domain controllers within a domain.
• Schema: The schema partition or naming context (NC) contains objects that can be created in the Active Directory directory, and the attributes which these objects can contain. Domain controllers in a forest have a read-only copy of the schema partition. Objects stored in the schema partition are replicated to each domain controller in domains/forests.
• Application: The application partition is a new feature introduced in Windows Server 2003. This partition contains application specific objects. The objects or data that applications and services store here can comprise of any object type excluding security principles. Security principles are Users, Groups, and Computers. The application partition typically contains DNS zone objects, and dynamic data from other network services such as Remote Access Service (RAS), and Dynamic Host Configuration Protocol (DHCP).

Flexible Single Master Operations (FSMO): The Active Directory extends the single-master model found in earlier versions of Windows to include multiple roles, and the ability to transfer roles to any domain controller (DC) in the enterprise. Because an Active Directory role is not bound to a single DC, it is referred to as a Flexible Single Master Operation (FSMO) role. Currently in Active Directory there are five FSMO roles:

• Schema master
• PDC emulator
• Domain naming master
• RID master
• Infrastructure master

Active Directory ISTG: For inter-site replication, one domain controller per site has the responsibility of evaluating the inter-site replication topology and creating Active Directory Replication Connection objects for appropriate bridgehead servers within its site. The domain controller in each site that owns this role is referred to as the Inter-Site Topology Generator (ISTG). Inter-site connection objects are created by the Inter Site Topology Generator (ISTG) and not the KCC. The first domain controller in a site has the role of Inter Site Topology Generator. There is only one ISTG within a particular site. It is the ISTG that is responsible for ensuring that the site has a replica of the configuration, domain and schema partitions.

KCC Replication: The Knowledge Consistency Checker (KCC) is an Active Directory component that is responsible for the generation of the replication topology between domain controllers. This article describes the role of one server per site, known as the Inter-Site Topology Generator, which is responsible for managing the inbound replication connection objects for all bridgehead servers in the site in which it is located.

The current ISTG notifies every other domain controller in the site that it is still present by writing the “inter-Site Topology Generator” attribute on “CN=NTDS Site Settings,CN=SiteName,CN=Sites,CN=Configuration,DC=Mydomain,DC=com” under its domain controller object in the Configuration naming context in Active Directory at a specified interval. You can modify this interval using the following registry value (which is not present by default, it must be added):

Key: HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParameters
Value Name: KCC site generator renewal interval (minutes)
Value Data: 30 (in minutes)

As this attribute gets propagated to other domain controllers by Active Directory replication, the KCC on each of these computers monitors this attribute to verify that it has been written within a specified amount of time. If the amount of time elapses without a modification, a new ISTG takes over. You can modify this time interval using the following registry value:

Key: HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParameters
Value Name: KCC site generator fail-over (minutes)
Value Data: 60 (in minutes)

Active Directory Replication Topology Options: Active Directory Sites and Services are the logical presentation of physical WAN connectivity and switching of your LAN and WAN. The Active Directory replication topologies typically are:

• Ring Topology: With intra-site replication, the KCC creates a ring topology that defines the replication paths within a site. In a ring topology, each domain controller in a site has two inbound and outbound replication partners. The KCC creates the ring so that there is no greater than three hops between domain controllers in a site.
• Full Mesh Topology: This topology is typically utilized in an organizations where redundancy is extremely important for all sites. You can configure full mesh if you have IPWAN or MPLS connections in all sites. A mix of MPLS and ADSL or other method of connectivity do not constitute full mesh. A full mesh topology is quite expensive to manage and is not scalable.
• Hub And Spoke Topology: This topology is typically implemented in large organizations where scalability is important consideration. In this topology, one or multiple hub sites exist that have WAN connections to multiple spoke sites. The hub sites are usually connected to each other through high speed WAN connections.
• Hybrid Topology: The hybrid topology is combination of any of the above topologies. This is not a recommended topology even if you have high speed duct fibre or other WAN connectivity. 

You can download Microsoft Active Directory Topology Diagrammer and find out your topology you have configured in Active Directory. I would recommend you not to configure configure full mesh topology in Active Directory. Mesh topology often lead you to a mess in active directory. It better to be simple as Hub and Spoke topology.

FRS and DFS replication: Windows Active Directory domain controllers use FRS to replicate system policy and login scripts for Windows servers and clients. However, because system policy and login script replication is performed by Active Directory replication, it is not affected by the following information. However, you can use DFS to replicate across domain controllers.

Domain and Forest Functional Level: Domain and forest functionality, which is available in Windows Server 2008 R2 AD DS, provides a way to enable domain-wide features or forest-wide Active Directory features in your network environment. Different levels of domain functionality and forest functionality are available, depending on your network environment. To check your domain functional, open dsa.msc>Right click on Domain Name>Click Raise Domain Functional Level>Select preferred functional level and click ok.

If all the domain controllers in your domain or forest are running Windows Server 2008 R2 and the domain and forest functional level is set to Windows Server 2008 R2, all domain-wide features and forest-wide features are available. When your domain or forest contains Windows 2000, Windows Server 2003 or Windows Server 2008 domain controllers, Active Directory features are limited. For more information about how to enable domain-wide features or forest-wide features, Understanding Active Directory Domain Services (AD DS) Functional Levels and Raise the Domain Functional Level

Domain Naming System (DNS): The Domain Name System (DNS) is a hierarchical, distributed database that contains mappings of DNS domain names to various types of data, such as Internet Protocol (IP) addresses. DNS allows you to use friendly names, such as http://www.microsoft.com, to easily locate computers and other resources on a TCP/IP-based network. When planning a secure DNS server deployment, first collect information about your environment. This information should include the structure and hierarchy of your internal and external domains, identification of DNS servers that will be authoritative for these domain names, and the DNS client requirements for host resolution on your network. After you collect this information, review the guidance in this topic to determine which tasks to perform so that you can deploy a secure DNS infrastructure.

To check DNS functional level, open DNS Manger>Expand Forward lookup zone>right click on domain name>Click property>Click Change on Replication: All DNS servers in this forest>Select to all DNS servers running in the domain controllers in this forest. Click OK.

Select appropriate scavenging time to scavenge DNS records.

If you have more than one domain controllers, all domain controllers must be registered as authoritative Name Server (NS)

Consider the following when planning a secure DNS deployment: The following design choices can affect security of your DNS deployment

• Communication with the Internet. If your network hosts are not required to resolve names on the Internet, eliminate all communication between internal DNS servers and the Internet. In this DNS design, you can use a private DNS namespace that is hosted entirely in your network where internal DNS servers host zones for the root domain and top-level domains. In this configuration, your DNS servers will not use Internet root name servers. For more information about root hints, see Configure Internal Root Hints.
  If your network hosts are required to resolve names on the Internet, configure a group of DNS servers in the forest root domain (FRD) to forward queries for external names to an external DNS server. Configure DNS servers in a child domain to only forward queries to DNS servers in the FRD. Protect communications between internal and external DNS servers by configuring a packet-filtering firewall to only allow UDP and TCP port 53 communications. For more information about using forwarders, see Configure a DNS server to use forwarders
• DNS namespace. If your organization’s DNS namespace is split into internal and external domains, host your internal DNS namespace on DNS servers located on the internal network and the external DNS namespace on DNS servers located on a perimeter network. Protect internal DNS servers by placing them behind a firewall. If internal client computers are required to resolve hosts in the external namespace, your internal DNS namespace can be a subdomain of your external DNS namespace. For example, if the Internet DNS namespace for your organization is MicrosoftGURU.com.au, then the internal DNS namespace for your network might be corp.MicrosoftGURU.com.au. If internal network hosts do not need to resolve hosts in the external domain, then your internal DNS namespace can be distributed the same as the Internet DNS namespace. However, you should use a differing set of domain names for internal and external hosts so that the two domains do not overlap. For example, if your organization’s parent domain name is MicrosoftGURU.com.au, you can use an internal DNS domain such as corp.MicrosoftGURU.com.au. By keeping your internal and external namespaces separate and distinct in this way, you enable simplified maintenance of configurations such as domain name filter or exclusion lists.
• Restricting zone transfers. For increased security, disable all zone transfers unless they are required. If required, configure this setting to allow zone transfers only to specified IP addresses. Allowing zone transfers to any server may expose your DNS data to an attacker attempting to footprint your network. By default, zone transfers are disabled for zones that are AD integrated. For non-AD integrated zones, default settings allow zone transfers only to servers that are listed in the name server (NS) resource records of the zone. For more information, see Restrict Zone Transfers.
• Configuring AD integrated zones. Security enhancements that are available when using directory-integrated zones include access control lists and secure dynamic updates. You cannot use directory-integrated zones unless the DNS server is also a domain controller. For more information, see Configure AD Integrated Zones.

• Configuring the Discretionary Access Control List (DACL). You can use the DACL to secure a dnsZone object container in the directory tree. This feature provides granulated access to either the zone or a specified resource record in the zone. For example, the DACL for a zone resource record can be restricted so that dynamic updates are only allowed for a specified client computer or a secure group such as a domain administrators group. This security feature is not available with standard primary zones. For more information, see Configure the Discretionary Access Control List (DACL).
• Allowing only secure dynamic updates. Dynamic updates can be secure or non-secure. To help protect DNS servers from DNS spoofing attacks, you should only use secure dynamic updates. DNS update security is available only for zones that are Active Directory integrated. For more information, see Allow Only Secure Dynamic Updates.

• Configuring the Global Query Block List. The global query block list is a new security feature introduced with the Windows Server® 2008 operating system. Use the global query block list to prevent malicious users from registering a host name that might have special significance for certain applications and allow them to divert network traffic. For more information, see Configure the Global Query Block List.
• Configuring the socket pool. The socket pool enables a DNS server to use source port randomization when issuing DNS queries. This provides enhanced security against cache poisoning attacks. You can also customize socket pool settings. For information, see Configure the Socket Pool.
• Configuring cache locking. When you enable cache locking, the DNS server will not allow cached records to be overwritten for the duration of the time to live (TTL). Cache locking also provides for enhanced security against cache poisoning attacks. Cache locking is available if your DNS server is running Windows Server 2008 R2. You can also customize the settings used for cache locking. For more information, see Configure Cache Locking.
• Restricting DNS responses to selected interfaces. By default, a DNS server that has multiple network interfaces, or is configured with multiple IP addresses on a single interface, will respond to DNS queries sent to all its IP addresses. To improve security of the DNS server, restrict the DNS service to listen only on IP addresses that are used by the server’s DNS clients as their preferred DNS server. For more information, see Restrict DNS servers to listen only on selected interfaces.
• Configuring internal Root Hints. When the DNS Server service is running on a domain controller, root hints are read from Active Directory first. If the DNS Server service is not running on a domain controller or no root hints exist in Active Directory, root hints are implemented using a file, Cache.dns, stored in the %windir%System32Dns folder on the server computer. Root hints normally contain the name server (NS) and address (A, AAAA) resource records for the Internet root servers. If, however, you are using the DNS Server service on a private network, you can edit or replace Root hints with similar records that point to your own internal root DNS servers. This prevents your internal DNS servers from sending private information over the Internet when they resolve names. For more information, see Configure Internal Root Hints.
• Disabling recursion. To protect DNS servers, disable recursion on all servers that are not required to perform recursive queries. Recursion is a name-resolution technique in which a DNS server queries other DNS servers on behalf of the requesting client to fully resolve the name and then sends an answer back to the client. If enabled, an attacker can use the recursion process to cause domain names to resolve to the wrong IP address. By default, the DNS server performs recursive queries on behalf of its DNS clients and DNS servers that have forwarded DNS client queries to it. For more information, see Disable Recursion on the DNS Server.
• Securing the DNS Cache. By default, the DNS Server service is secured from cache pollution, which occurs when DNS query responses contain non-authoritative or malicious data. The Secure cache against pollution option prevents an attacker from successfully polluting the cache of a DNS server with resource records that were not requested by the DNS server. Changing this default setting will reduce the integrity of the responses that are provided by DNS Server service. You can restore the default setting if it was previously changed. For more information, see Secure the DNS Cache.

Active Directory Sites and Subnets: In Active Directory Sites and Subnets, you have to create various sites as per your real organization structure, add domain controller for authentication in that site and declare real network subnets assigned for sites. you have to create replication topology in active directory inter site links. 

Sites: A site can be defined as a grouping or set of Internet Protocol (IP) subnets that are connected by a highly reliable, fast and inexpensive link. This is usually a local area network (LAN) or metropolitan area network (MAN). Domains can have domain controllers in multiple sites. A site can have domain controllers from multiple domains. In Active Directory, sites have the following main roles or purposes:

• A site determines the closest domain controller at workstation logon.
• A site operates as a replication boundary. As a replication boundary, a site optimizes replication between sites because it can be used to improve on and more efficiently manage Active Directory replication.
• A site also functions as a resource locator boundary. Clients are only able to access resources that are accessible in a particular site.

Site Links: Site links are logical connections that are established between sites is Active Directory that define a path between these sites. A site link defines the direction of Active Directory replication between sites. You can use either RPC over IP or SMTP as the transport protocol for moving replication data over a site link. Site links are assigned the following:

• Cost: With replication, the concept of cost indicates the cost of the physical link between two Active Directory sites and is utilized to detail optimal connection paths between one site and another site. When a site link is assigned a cost, the type of connection is taken into consideration. For replication, the lower costing links are used over higher costing links. A general method of calculating cost is Cost=1024/WAN Bandwidth. By default cost is 100.
• Interval: Replication over a site link takes place at predetermined time intervals. When assigning the replication interval, it is important not to set the value to too high or too low. An exceptionally high value means that changes take a longer time to be replicated, while an exceptionally lower value means that replication occurs too regularly.
• Schedule: A replication schedule and interval are basically used together. An interval is associated with a schedule. A schedule deals with when the replication of data is going to occur. I do not recommend to schedule and replication. Keep it as default.

Site link bridge: In Active Directory, you can use a site link bridge to link sites that share common Active Directory data but who do not have a site link. The data typically shared by these sites is the Application directory partition.

Connection objects: In Active Directory, domain controllers replicate with specific replication partners. The partners that domain controllers replicate with are defined by connection objects. Connection object enable data to be replicated in Active Directory because they define inbound replication paths. Domain controllers and their associated connections are defined in a topology map. The Directory Replication Agent (DRA) handles replication between domain controllers. The Directory Replication Agent uses the connection objects in the topology map to find out those partners that are relevant when replicating changes to directory partitions. The DRA sends a replication request to the partners of a domain controller when the domain controller needs to update its copy of Active Directory. Administrators can manually create connection objects, or they can leave these objects to be created by the Knowledge Consistency Checker (KCC). When the KCC creates connection objects, it is an automatic process. The KCC runs on all domain controllers in Active Directory. As an Administrator, you can create a manual connection object between any two domain controllers in a forest. If you want data to flow in two directions, you should create two connection objects. You can create manual connection objects between domain controllers in the same site or in different sites. The Knowledge Consistency Checker by default creates automatic connection objects. It references the site topology and then uses the information on sites and site links to automatically create connection objects. The KCC checks the site topology at regular intervals to determine whether the connection objects are still valid, and then changes connection objects based on its reviews. It is the KCC that is accountable for making certain that data in the directory partitions are replicated in sites. You can disable the automatic creation of connection objects on a per site and forest wide basis.

Planning AD SYSVOL:  SYSVOL is a collection of folders that contain a copy of the domain’s public files, including system policies, logon scripts, and important elements of Group Policy objects (GPOs). The SYSVOL directory must be present and the appropriate subdirectories must be shared on a server before the server can advertise itself on the network as a domain controller. Shared subdirectories in the SYSVOL tree are replicated to every domain controller in the domain. Sometimes systems administrator tent to utilize FRS functionality of Active Directory SYSVOL to keep software packages, application and files in SYSVOL. later on deploy these packages from SYSVOL. This is completely a wrong approach that lead to replication issues among domain controllers. the bigger the sysvol the greater possibility of replication failure. Remember that FRS has to replicate entire data of SYSVOL across domain controllers in a forest. If you have less bandwidth, your replication might goes into queue. Deploy packages from a different DFS share and keep un-related files and folder out of SYSVOL.   

SYSVOL data and the File Replication Service (FRS): The system volume contains scripts and group policies. SYSVOL data is hosted on every domain controller. Changes to SYSVOL are replicated to domain controllers within the same domain via File Replication System (FRS) replication. With FRS replication, the full file is replicated and not just the actual changes that were made to the file. This differs to Active Directory replication. With Active Directory only the changes that were made to Active Directory objects are replicated.

When you relocate folders, you use the first three levels of subdirectories to properly update the path locations that DFS Replication uses. These levels are affected by junction points and parameter settings. These folders include the following:

• %windir%SYSVOL
• %windir%SYSVOLdomain
• %windir%SYSVOLdomainDfsrPrivate
• %windir%SYSVOLdomainPolicies
• %windir%SYSVOLdomainscripts
• %windir%SYSVOLstaging
• %windir%SYSVOLstagingdomain
• %windir%SYSVOLstaging areas
• %windir%SYSVOLstaging areas<FQDN>, where FQDN is the fully qualified domain name of the domain that this domain controller hosts, for example, Microsoftguru.com.au.
• %windir%SYSVOLsysvol
• %windir%SYSVOLsysvol<FQDN>, where FQDN is the fully qualified domain name of the domain that this domain controller hosts, for example, Microsoftguru.com.au.

Dynamic Host Configuration Protocol and Active Directory:  Windows Server 2008 provides integrated security support for networks that use Active Directory Domain Services (AD DS). This support adds and uses a class of objects that is part of the base directory schema, providing the following enhancements:

• A list of IP addresses available for the computers that you authorize to operate as DHCP servers on your network.
• Detection of unauthorized DHCP servers and prevention of their starting or running on your network.

The authorization process for DHCP server computers depends on the installed role of the server on your network. A DHCP server can be installed on a domain controller, a member server or standalone. If you deploy AD DS, all computers operating as DHCP servers must be either domain controllers or domain member servers before they can be authorized and provide DHCP service to clients.

Although it is not recommended, you can use a stand-alone server as a DHCP server as long as it is not on a subnet with any authorized DHCP servers. When a stand-alone DHCP server detects an authorized server on the same subnet, it automatically stops leasing IP addresses to DHCP clients.

Do you need an WINS server anymore?  Today, numerous Microsoft customers deploy WINS technology in their environment. WINS is an alternative name resolution protocol to DNS. It is an older service that uses NetBIOS over TCP/IP (NetBT). WINS and NetBT do not support IPv6 protocols and both are entering legacy mode.  To help customers migrate to DNS for all name resolution the DNS Server role in Windows Server 2008 supports a special GlobalNames Zone (GNZ) feature. Some customers in particular require the ability to have the static, global records with single-label names that WINS currently provides. These single-label names typically refer to records for important, well-known and widely-used servers for the company, servers that are already assigned static IP addresses and are currently managed by IT-administrators using WINS. GNZ is designed to enable the resolution of these single-label, static, global names for servers using DNS.

GNZ is intended to aide retirement of WINS. It is not a replacement for WINS. GNZ is not intended to support the single-label name resolution of records that are dynamically registered in WINS, records which typically are not managed by IT administrators. Support for these dynamically registered records is not scalable, especially for larger customers with multiple domains and/or forests. This deployment guide is designed to help customers understand how to deploy the GlobalNames Zone in a variety of scenarios.

To Enable the GlobalNames Zone functionality, Open a command prompt, Click Start>right click Command Prompt>click Run as Administrator. Type the following, and then press Enter:

Dnscmd ServerName /config /Enableglobalnamessupport 1

To Create the GlobalNames Zone using the Windows Interface, Open the DNS console. In the console tree, right-click a DNS server, and then click New Zone to open the New Zone Wizard> Create a new zone and give it the name GlobalNames. Choose Active Directory storage method and AD replication scope for the zone

Note: Microsoft recommend that you store the zone in AD DS and replicate it to all domain controllers that are DNS servers in the Forest. This will create a new AD DS‑integrated zone called GlobalNames which is stored in the forest-wide DNS application partition.

For a customer with many domains, managing a suffix search list for all clients can be cumbersome, and client query performance is also somewhat lowered when querying a single-label name with the list of domains. For environments that require both many domains and single-label name resolution of corporate server resources, GNZ provides a more scalable solution.

Setting Organizational Unit: OUs organize resources like computers, users, servers and printers. The more you organize OU the better you can manage Active Directory. OU also help you to segregate control and permission through delegation. This requirement could be the result of management wishes for delegation, or to give control over OUs to specific administrators based on corporate policies or because of the acquisition of other companies.

 Active Directory Group Policy Object:  Group Policy enables administrators to manage configurations for groups of computers and users, including options for registry-based policy settings, security settings, software deployment, scripts, folder redirection, Remote Installation Services, and Internet Explorer maintenance. By using Group Policy, you can deploy software packages and secure computers and users . Because of factors such as the large number of policy settings available, the interaction between multiple policies, and inheritance options, Group Policy design can be complex. By carefully planning, designing, testing, staging and implementing a solution based on your organization’s business requirements, you can provide the standardized functionality, security, and management control that your organization needs. Do not use Windows XP GPMC to deploy software and any security. Use Windows 7 or Windows Server 2008 GPMC to deploy group policy. Why is that? When you use Windows XP GPMC to create group policy it copies ADM folder to newly created GPO folder which resides in SYSVOL. ADM folder is just a template not real GPO. If you continuously create GPO using XP GPMC you will be copying 4MB extra files in SYSVOL which is un-necessary. However, using windows7 GPMC does not copy ADM template into new GPO folder. Its saves disk space and create less mess in GPO SYSVOL. If you are heavily dependent on GPO, you can utilize advanced group policy management to fulfill your requirements.

Read Only Domain Controller (RODC): RODC is highly  advantageous for branch deployment where physical security isn’t guaranteed and no system administrator is present to maintain domain controller whereas you want an reliable authentication provider. Microsoft has introduced the read-only domain controller (RODC) with the release of windows server 2008. The RODC contains a read-only copy of the Active Directory database that cannot be directly configured. This increases security, especially in areas where the physical security of the domain controller cannot be guaranteed.This functionality is gained by the RODC introducing technologies such as the following:

• Read-only AD DS database
• Unidirectional replication
• Credential caching
• Administrator role separation
• Read-only DNS

 windows server 2008 domain controller installation wizard, simply select RODC to install RODC.

Tombstone Life Cycle: Depending on your system environment and business practices, you can increase or decrease the deleted object lifetime and the tombstone lifetime. If you want your deleted objects to be recoverable for longer than the default 180 days, you can increase the deleted object lifetime. If you want your recycled objects to be recoverable (through authoritative restore) for longer than the default 180 days, you can also increase the tombstone lifetime. I would not recommend to setup tombstone life is 3 days or a week though for weird reason I found systems administrator does this mistake. To modify Tombstone life using ADSIEDIT.msc follow the screenshot

To modify the deleted object lifetime by using the ADSIEDIT.msc

 Active Directory Core Installation : In keeping with Microsoft’s ongoing battle against all things security (whether implied or true), the company has introduced a new type of server for 2008. Windows 2008 Server Core is a Windows server that does not contain a GUI. All administration of Server Core is performed via the command line or via scripting. You may also administer some functions by connecting to Server Core from another server’s Microsoft Management Console (MMC) utility. Server Core was introduced for many reasons:

• Reduced attack surface
• Reduced management
• Less disk space
• Reduced maintenance

What you should do before implementing Active Directory:  When working with any design, make sure you have a good framework from which to work. You need to plan, design, develop and deploy. Risk assessment vital for any project you do. For Microsoft Active Directory risk assessment is crucial stage. When you design Active Directory, you must keep in mind fault tolerance, highly available proportionate systems that meet your business needs. 

Active Directory Post Consideration: Once you have deployed Active Directory, revisit your plan and follow what you have done practically. You must stick with your plan to minimize risk might have. The following would be a good best practice for post deployment consideration.

• Setup appropriate security in Active Directory and DNS
• Tighten up security for computers and users using GPO
• Delegate controls for OU
• Configure Sites and Subnets
• Setup correct replication policy
• Setup Audit policy in Active Directory
• Setup patching schedule

Patching Domain Controller using WSUS: Microsoft releases hotfixes, patch and service pack for Microsoft Windows operating system. Its necessary to keep yourself up to date with Microsoft products. Subscribe Microsoft security bulletins to get an updates from Microsoft Corp. Microsoft release updates in the third quarter of each month. A common patching involve asses, identify, evaluate and plan and than deploy. To follow a best practice, you must create a staging area separated from your production Active Directory infrastructure where you can stage an domain controller patching using WSUS.  Staging will eliminate any unnecessary risk and avoid catastrophe. visit this URL to learn more about WSUS. 

AD DS Port: AD DS port management is vital for AD administrator. By default ldap is configured with port 389. Its not a best practice to change port number to new port number. However if you do change port number for security reason, make sure you unblock that port in FF TMG and firewall and keep a record of the change. Occasionally, I found that  systems administrator change ldap port in Active Directory DNS and security administrator block new ldap port in firewall. I would recommend you to get more information on AD DS port requirement from TechNet and deploy AD port as appropriate.

Microsoft Active Directory— DO and DONT:

KISS (Keep it simple & sweet) Policy: The first bit of advice is to keep things as simple as you can. Active Directory is designed to be flexible, and if offers numerous types of objects and components. But just because you can use something doesn’t mean you should. Keeping your Active Directory as simple as possible will help improve overall efficiency, and it will make the troubleshooting process easier whenever problems arise.

Avoid mixing up server roles  and app with domain controller: Avoid mixing up other server roles with Active Directory Domain Controller. For example, installing FF TMG , SQL server, exchange or IIS FTP on domain controller server is an worse idea. This will create a complete chaos among all these infrastructures. Domain controller will not perform at its best. Adding additional roles to a domain controller can affect the server’s performance, reduce security, and complicate the process of backing up or restoring the server.  

Use the appropriate site topology: Although there is definitely something to be said for simplicity, you shouldn’t shy away from creating more complex structures when it is appropriate. Larger networks will almost always require multiple Active Directory sites. The site topology should mirror your network topology. Portions of the network that are highly connected should fall within a single site. Site links should mirror WAN connections, with each physical facility that is separated by a WAN link encompassing a separate Active Directory site. Keep adding all the new subnets in the appropriate sites.

Branch domain controllers:  Having a read only domain controller in a branch is always good idea. However, if you want to setup a writable domain controller in branch than make sure you have tightened security and delegation in place. 

DNS & GC Server: Microsoft recommend that you make all domain controller global catalog server. I found systems administrator install domain controller without integrating DNS with AD. you must integrate Active Directory with DNS. If you have a single DNS server and that DNS server fails, Active Directory will cease to function. Its better to have a more than one Active Directory, GC and DNS to obtain redundancy.

Virtualized Domain Controllers: : One of the main reasons organizations use multiple domain controllers is to provide a degree of fault tolerance in case one of the domain controllers fails. However, this redundancy is often circumvented by server virtualization. I often see organizations place all their virtualized domain controllers onto a single virtualization host server. So if that host server fails, all the domain controllers will go down with it. There is nothing wrong with virtualizing your domain controllers, but you should scatter the domain controllers across multiple host servers.

Maintain FSMO roles (backups): Although Windows 2000 and every subsequent version of Windows Server have supported the multi-master domain controller model, some domain controllers are more important than others. Domain controllers that are hosting Flexible Single Master Operations (FSMO) roles are critical to Active Directory health. Active Directory is designed so that if a domain controller that is hosting FSMO roles fails, AD can continue to function — for a while. Eventually though, a FSMO domain controller failure can be very disruptive.

I have seen sys admin say that you don’t have to back up every domain controller on the network because of the way Active Directory information is replicated between domain controllers. While there is some degree of truth in that statement, backing up FSMO role holders is critical. I once had to assist with the recovery effort for an organization in which a domain controller had failed. Unfortunately, this domain controller held all of the FSMO roles and acted as the organization’s only global catalog server and as the only DNS server. To make matters worse, there was no backup of the domain controller. We ended up having to rebuild Active Directory from scratch. This is an extreme example, but it shows how important domain controller backups can be. You can deploy Symantec live state backup for physical server or VCB backup for  virtual DC.

Plan your domain structure and stick to it: Most organizations start out with a carefully orchestrated Active Directory architecture. As time goes on, however, Active Directory can evolve in a rather haphazard manner. To avoid this, I recommend planning in advance for eventual Active Directory growth. You may not be able to predict exactly how Active Directory will grow, but you can at least put some governance in place to dictate the structure that will be used when it does.

Have a management plan in place before you start setting up servers: Just as you need to plan your Active Directory structure up front, you also need to have a good management plan in place. Who will administrator Active Directory? Will one person or team take care of the entire thing or will management responsibilities be divided according to domain or organizational unit? These types of management decisions must be made before you actually begin setting up domain controllers.

Try to avoid making major logistical changes: Active Directory is designed to be extremely flexible, and it is possible to perform a major restructuring of it without downtime or data loss. Even so, I would recommend that you avoid restructuring your Active Directory if possible. I have seen more than one situation in which the restructuring process resulted in some Active Directory objects being corrupted, especially when moving objects between domain controllers running differing versions of Windows Server.

Domain controller & NTP: It’s not bad to make domain controller a NTP. Its better to have a separate NTP server if you can. But you will be experience event  log in domain controller. It would not be a good idea to make a virtualized domain controller having an NTP role. 

Relevant Study:

Active Directory Domain Services Guide

Microsoft Active Directory Topology Diagrammer

Risk and Health Assessment Program for Active Directory (ADRAP) – Scoping Tool v1.6

Active Directory Domain Services in the Perimeter Network (Windows Server 2008)

Read-Only Domain Controller (RODC) Branch Office Guide

Windows Server 2008 Remote Server Administration Tools for Win 7

Installing or Removing the Remote Server Administration Tools Pack

Planning and Deploying Read-Only Domain Controllers

Infrastructure Planning and Design

 

Fix Powershell Warning and Enhance Active Directory by installing Active Directory Web Service

Microsoft AD Management Gateway Service provides a Web service interface to Active Directory domains and instances of Active Directory LDS or Active Directory Application Mode that are running on a Domain controller as the Active Directory Management Gateway Service. You can install the Active Directory Management Gateway Service on domain controllers running on Windows Server 2003 R2 SP2, Windows Server 2003 SP2, Windows Server 2008 and Windows Server 2008 SP2.

You also need AD web service to remedy following Powershell error.  

 

  

Installing System pre-requisites:

• Active Directory Domain Services installed
• .NET Framework 3.5 SP1
• Hotfix KB969166 for NetFx3.5SP1 System.DirectoryServices QFE Roll-Up for AD Web
• Service from
• Hotfix KB969429 for windows server 2003
• Hotfix for KB967574 for windows server 2008
• Download Active Directory Web Services

Installing Active Directory Web Services:

• Based on your DC’s operating system version, simply double click on Windows5.2-KB968934-x64.exe or Windows5.2-KB968934-x86.exe or Windows6.0-KB968934-x64.msu or Windows6.0-KB968934-x86.msu, accept EUAL and install AD Web services.
• Reboot domain controller

Bug fix for the following error:

C:WINDOWSAssemblyGAC_MSILSystem.DirectoryServices.AccountManagement

3.5.0.0__b77a5c561934e089System.DirectoryServices.AccountManagement.dll is Less Than 3.5.30729.4126

0.188: Second Condition in Prereq.CheckSDSAMQFEInstalled.Section Failed

0.188: Condition Check for Line 4 of PreRequisite returned FALSE

0.188: ReadStringFromInf: UpdSpGetLineText failed: 0xe0000102

0.188: KB968934 Setup encountered an error:  Setup cannot continue because one or more prerequisites required to install KB968934 failed. For More details check the Log File c:windowsKB968934.log

0.204: ReadStringFromInf: UpdSpGetLineText failed: 0xe0000102

Fix: Download and install NetFx3.5SP1 System.DirectoryServices QFE Roll-Up for AD Web Service from KB969166

Bug Fix if the following error occurred

When attempting to start the service they got “Error 1067: The process terminated unexpectedly.”  When rebooting, they saw ADWS Event ID 1002 in the ADWS Logs that said: “Active Directory Web Services could not initialize its endpoints. A networking error could have occurred.”

To fix this we need to modify the Microsoft.ActiveDirectory.WebServices.exe.config file found in the %Windir%ADWS directory. You’ll need to add the following lines into the <AppSettings> section. Be sure that its between the <appSettings> and </appSettings> section boundaries…

<add key=”DebugLevel” value=”Info” />

<add key=”DebugLogFile” value=”c:windowsdebugadws.log” />

Valid values for the DebugLevel value are:

0 – No logging

1 – Error (this logs critical errors only)

2 – Warn (this logs warning events as well as error events) – Recommended value to use unless you need full tracing

3 – Info (verbose)

Use strings rather than numbers, so just to be clear, type “Info” between the quotes instead of “3” for example. Once this is done, you’ll see some new events trigger in the ADWS Event log, and then you’ll see the ADWS.log start to populate with diagnostics info.

Finalize installation:

• Check %Windir% KB969429.log for any error
• Check Event log for any warning, error or info. After successful installation, you will find the following event in AD web services event log.
•  Re-run PowerShell AD comdlet to test that warning has gone.

An Overview of Active Directory Certificate Services (AD CS)

Certificate services provide public key infrastructure (PKI) for organization. There are lot of benefits to have a PKI infrastructure in Active Directory infrastructure. One of the biggest advantage of deploying certificate is to identify requestor requesting information a server. This can be a web server, exchange web mail or an windows client requesting authentication from an active directory. The server holding the role of approving certificate and delivering certificate called certificate authority in short CA. Microsoft CA provides heaps of options for diverse customer to deploy certificate from security point of view, organizational structure and  also geographical location. That is certificate can be deployed in hierarchical manner. Top of Certificate hierarchy is called Enterprise root CA. There can be more than one subordinate CA depending your need. Certificate Authority can be standalone or Enterprise CA. Standalone offline Root CA can be used to provide PKI infrastructure for internal users. Standalone root CA is put offline to provide an extra layer of security to authentication. A subordinate CA placed under standalone root can work as usual. In this case, your root CA aren’t compromised. when you request a certificate from subordinate CA, you have to approve this request manually. Again this type of deployment provide extra layer of security  as you can see who’s requesting for a certificate. 

Installation of Root CA:

To install an Enterprise Root CA, build a windows server 2008 and join domain. Log on as domain admin. Add and install Web server (IIS) role in that server as pre-requisite. Once finish, add active directory certificate services role. Select Enterprise root CA while installing CA. More detailed installation guides are in these screen shots.

To install a standalone root CA, follow the similar steps with just one exception that standalone CA isn’t part of Active Directory domain. You have manually import certificate request to standalone CA server which I will explain later part of this article.

Segregating CA Management Role:

To secure CA management and delegating management authority, you can segregate roles in certificate authority. There five roles available to manage CA. They are CA Administrator, CA Manager, CA Auditor, Backup operator and enrollees. To assign these roles, you need to log on CA as an administrator and open CA Management Console. Right mouse click on CA server name>Click on property. Go to security Tab and add specific groups to this windows and assign desired roles. The following screen shots are illustrate these options.

https or secure Certificate Enrollment using :

before you can enroll certificate, install an SSL certificate for CA itself and provide an FQDN for users and computer to request certificates.

Open IIS management console in CA authority Server. Click on CA server>Click on Create a Domain certificate on right hand side Action pan. 

Click Finish to complete request.

Click on Sites>click Bindings

Click Add>Select SSL>Select IP & Port 443

Select Certificate you just created.

Now Create a CNAME in DNS server such as CA.microsoftguru.com.au

Open IE browser to test SSL certificate request.

Managing Templates:

There are default certificate templates in CA. The templates are stored in Active Directory for use by every CA in the forest. When deploying certificates duplicate a template (by right click on certificate template>Manage) similar to your purpose, name the template, setup certificate period, publish in Active Directory, setup security on the security tab. Now right click on certificate template>Click New>Click on Certificate Template to Issue. You must select appropriate group in the security tab of certificate property to safeguard this certificate from different group of users. 

Installation of Subordinate CA:

Prepare a Windows Server 2008. Depending on your deployment topology, Open Server Manager, click Add Roles, click Next,and click Active Directory Certificate Services. Click Next two times. Now select following in the next steps.

Setup Type: Standalone or Enterprise

CA Type: Subordinate

Private key: Create a New Private Key

On the Request a certificate step, you have have two options. If your Enterprise root CA is part of domain, you can request a subordinate CA automatically or manually. However if your enterprise root CA is standalone or subordinate CA is standalone then you have generate a request for certificate and submit this request to root CA. In this article, I am requesting certificate manually because you can perform automated request.

Click Next and Finish installation.

Open Requested Certificate and copy entire content in the notepad. Open IE browser and browse Root CA cert enroll page such as https://ca.microsoftguru.com.au/certsrv

Click on Request a certificate, Click on Advanced certificate request.

Click on submit a certificate request..

Paste the certificate request on Base 64 encoded box and select subordinate CA. Click submit.

Now download requested certificate and save it on subordinate CA.

Log on to subordinate CA and open CA management console>Click All Tasks>Click Start CA. You will be prompted to import subordinate certificate from root CA. Browse the location of certificate you exported/saved in previous steps and select certificate. Your subordinate CA will start now.

Start Menu>run>Services.msc>Check Active Directory Certificate Services set to automatic. Now Manage and secure CA as mentioned in this article.

If your root CA is standalone than you can take your root CA offline now. Open Event Viewer by simply, typing eventvwr.exe on Start menu>run. Check AD CS is functioning properly.

To setup auditing in AD CS, right click on AD CS server>property>Auditing Tab>Select preferred Auditing for CA Server.

To restrict an enrollment agent in CA, Open CA Console>Right Click on subordinate CA Server>Property>Click on Enrollment Agent Tab Click on restrict Enrollment Agent. here you can add groups or users that are allowed to request certificate on behalf of another client and remove everyone. similarly you can disallow everybody to request an agent enrollment. Note that Enrollment agent can only request certificate but can not approve or revoke certificate.

To setup pending request in CA, log on to CA and open CA console. Right mouse click on CA server>Click property>Click Policy Module>Click Properties>Click Set certificate request status to pending.

Restart AD CS services.

Requesting Certificate from standalone CA:

Create a text file and rename this file such as newrequest.inf and copy and paste inside the file following contents

;…………………………………………

[Version]
Signature=”$Windows NT$
[NewRequest]
Subject = “CN=<DC fqdn>” ; replace with the FQDN of the DC
KeySpec = 1
KeyLength = 1024
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = “Microsoft RSA SChannel Cryptographic Provider”
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication

;……………………………..

OR

;……………………………..

[NewRequest]

Subject=”CN=<FQDN of computer you are creating the certificate, for example, the gateway server or management server.>”

Exportable=TRUE

KeyLength=2048

KeySpec=1

KeyUsage=0xf0

MachineKeySet=TRUE

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1

OID=1.3.6.1.5.5.7.3.2

;……………………………………….

Here, CN= FQDN of server where requested certificate will be installed.

Now type following command, and then press ENTER:

CertReq –New –f  NewRequest.inf NewCert.req

To submit new request type the following command, and then press ENTER:

certreq -submit -config “FQDN of the YourCAYour CA Name” certnew.req certnew.cer

Now approve the certificate from CA management console and retrieve certificate using following command

certreq -retrieve RequestID certnew.cer

type the following command to accept certificate, and then press ENTER:

certreq -accept newcert.cer

Removing Certificate Authority: Log on to the system as the user who installed the certification authority. Server Manager>Roles>Remove Roles>Select AD CS and Remove CA. Restart Decommissioned CA Server. To Remove remaining information about this CA from Active Directory, type following from elevated command prompt

certutil.exe -dsdel CAName and press ENTER

Dealing with Event ID 100, 7024, 48 :

Issue new certificate revocation list by issuing certutil.exe –crl command from elivated command prompt.

Type certutil.exe -setreg CALogLevel 2  and press enter to change log level registry.

Disable revocation list checkup type following from command prompt and press enter.

certutil –setreg caCRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE

How to configure Forefront TMG 2010 as WPAD server (Auto Proxy Discovery)—Step by Step

WPAD stands for Web Proxy Auto-Discovery Protocol. WPAD contains the information proxy settings for clients. Windows client uses WPAD protocol to obtain proxy information from DHCP and DNS server. Clients query for WPAD entry and returns with address of WPAD … Continue reading →