Office 365 MailFlow Scenarios and Best Practices

Microsoft Office 365 gives you the flexibility to configure mail flow based on your requirements and uses scenario to delivered email to your organisation’s mailboxes. The simplest way to configure mail flow is to allow Microsoft EOP to handle spam filter and Maiflow of your organisation. However, you may have already invested your infrastructure handle mail flow. Microsoft also accepts this situation and allow you to use your own spam filter.

The below scenario and use cases will allow you to determine how you can configure MailFlow of your organisation.

Mailbox Location MailFlow Entry Point Scenario & Usecases Recommended MailFlow Configuration  and Example MX record
Office 365 Office 365 Use Microsoft EOP

Demote or migrate all mailboxes to office 365

Use Office 365 mailboxes

MX record Pointed to Office 365

MX: domain-com.mail.protection.outlook.com

SPF:  v=spf1 include:spf.protection.outlook.com -all

 

On-premises On-prem Prepare the on-prem to be cloud ready

Build and Sync AAD Connect

Built ADFS Farm

MX record Pointed to On-prem

MX1.domain.com

SPF: v=spf1 include: MX1.domain.com  include:spf.protection.outlook.com -all

Third-party cloud, for example, G-Suite Both third-party and office 365 Prepare to migrate to Office 365

Stage mailbox data

MailFlow co-existance

MX record pointed to third-party cloud

MX record Pointed to On-prem

in.hes.trendmicro.com

SPF: v=spf1 include:spf.protection.outlook.com include: in.hes.trendmicro.com include: ASPMX.L.GOOGLE.COM -all

Combination of On-premises and Office 365 On-premises Hybrid Environment

Stage mailbox migration

MailFlow co-existance

MX record Pointed to On-prem spam filter

MX record Pointed to On-prem

MX1.domain.com

SPF: v=spf1 include: MX1.domain.com  include:spf.protection.outlook.com -all

Combination of On-premises and Office 365 Third-party cloud spam filter Hybrid Environment

Stage mailbox migration

MailFlow co-existance

MX record Pointed to third-party cloud spam filter

MX record pointed to third-party cloud

MX record Pointed to On-prem

in.hes.trendmicro.com

SPF: v=spf1 include:spf.protection.outlook.com include: in.hes.trendmicro.com -all

MailFlow Configuration Prerequisites:

  1. Make sure that your email server (also called “on-premises mail server”) is set up and capable of sending and receiving mail to and from the Internet.
  2. Check that your on-premises email server has Transport Layer Security (TLS) enabled, with a valid public certification authority-signed (CA-signed) certificate.
  3. Make a note of the name or IP address of your external-facing email server. If you’re using Exchange, this will be the Fully Qualified Domain Name (FQDN) of your Edge Transport server or CAS that will receive an email from Office 365.
  4. Open port 25 on your firewall so that Office 365 can connect to your email servers.
  5. Make sure your firewall accepts connections from all Office 365 IP addresses. See Exchange Online Protection IP addresses for the published IP address range.
  6. Make a note of an email address for each domain in your organisation. You’ll need this later to test that your connector is working correctly.
  7. Make sure you add all datacenter IP addresses of Office 365 into your receive connector of on-premises Exchange server

Configure mail to flow from Office 365 to your email server and vice-versa. There are three steps for this:

  1. Configure your Office 365 environment.
  2. Set up a connector from Office 365 to your email server.
  3. Change your MX record to redirect your mail flow from the Internet to Office 365.

Note: For Exchange Hybrid Configuration wizard, connectors that deliver mail between Office 365 and Exchange Server will be set up already and listed here. You don’t need to set them up again, but you can edit them here if you need to.

  1. To create a connectorExchange in Office 365, click Admin, and then click to go to the Exchange admin center. Next, click mail flow click mail flow, and click connectors.
  2. To start the wizard, click the plus symbol +. On the first screen, choose the appropriate options when creating MailFlow from Office 365 to On-premises Server
  3. Click Next, and follow the instructions in the wizard.
  4. Repeat the step to create MailFlow between On-premises to Office 365.
  5. To redirect email flow to Office 365, change the MX (mail exchange) record for your domain to Microsoft EOP, i.e. domain-com.mail.protection.outlook.com

Relevant Articles:

Mailflow Co-existence between G-Suite and Office 365 during IMAP Migration

Office 365 Hybrid Deployment with Exchange 2016 Step by Step

Centralized MailFlow: NDR Remote Server returned ‘550 5.7.1 Unable to relay’

Office 365 Hybrid Deployment with Exchange 2016 Step by Step

Hybrid Configuration Business Case.

  • On-premises IRM- Information Rights Management (IRM) enables users to apply Active Directory Rights Management Services (AD RMS) templates to messages that they send.
  • Antispam and malware protection- Mailboxes moved to Office 365 are automatically provided with antivirus and anti-spam protection by Exchange Online Protection (EOP), a service provided by Office 365. However, for corporate compliance reason, mail must flow through via on-premises anti-spam and firewall devices.
  • Public Folder- You have on-premises public folder and you would like to retain on-premises public folder.
  • Legacy Application- You have legacy applications that only support localised email server instead internet based email server
  • On-prem UM- You have on-premises unified messaging infrastructure or telephony systems that only communicate with localised email servers
  • Use of current CAPEX- You want to utilise current on-premises investment until the equipment expires and you are not ready to move into cloud completely.

In a hybrid deployment when you connect your Office 365 Exchange Online organization to your existing on-premises Exchange organization using the Hybrid Configuration wizard. After configuring the hybrid deployment, the following features are enabled:

  • Secure mail routing between on-premises between the organizations.
  • Mail routing with a shared domain namespace. For example, both on-premises and Exchange Online organizations use the @domain.com SMTP domain.
  • A unified global address list (GAL), also called a “shared address book,” showing full details of recipients.
  • Free/busy calendar information sharing between the organizations.
  • Centralized control of inbound and outbound mail flow. You can configure all inbound and outbound Exchange Online messages to be routed through the on-premises Exchange organization.
  • A single Outlook on the web URL for both the organizations.
  • Automatic Exchange ActiveSync profile redirection when mailboxes are moved to Office 365 (dependent on device support).
  • The ability to move on-premises mailboxes to the Exchange Online organization and vice versa.
  • Centralized mailbox management using the on-premises Exchange Administration Center (EAC).
  • Message tracking, internal MailTips and Out of Office replies, and multi-mailbox search between the organizations.
  • Cloud-based message archiving for on-premises Exchange mailboxes. Exchange Online Archiving can be used with a hybrid deployment

A hybrid deployment involves several different services and components:

  • Exchange 2016 Servers-   The Exchange 2016 Mailbox server role is required in your on-premises Exchange organization. All on-premises Exchange 2016 servers need to have the latest release of Exchange 2016, or the release immediately prior to the current release, installed to support hybrid functionality with Office 365.
  • Office 365-   Hybrid deployments are supported with Office 365 Enterprise, Government and Academic plans.
  • Hybrid Configuration wizard-   Exchange 2016 includes the Hybrid Configuration wizard which provides you with a streamlined process to configure a hybrid deployment between on-premises Exchange and Exchange Online organizations.
  • Azure AD authentication system-   The Azure Active Directory (AD) authentication system is a free cloud-based service that acts as the trust broker between your on-premises Exchange 2016 organization and the Exchange Online organization. On-premises organizations configuring a hybrid deployment must have a federation trust with the Azure AD authentication system. The Hybrid Configuration wizard as part of configuring a hybrid deployment creates the federation trust. A federation trust with the Azure AD authentication system for your Office 365 tenant is automatically configured when you activate your Office 365 service account.
  • Azure Active Directory synchronization-   Azure AD synchronization uses Azure AD Connect to replicate on-premises Active Directory information for mail-enabled objects to the Office 365 organization to support the unified global address list (GAL) and user authentication. Organizations configuring a hybrid deployment need to deploy Azure AD Connect on a separate, on-premises server to synchronize your on-premises Active Directory with Office 365.
  • Active Directory Federation Services- AD FS provides simplified, secured identity federation and Web single sign-on (SSO) capabilities for end users who want to access applications within an AD FS-secured enterprise, in federation partner organizations, or in the cloud.
  • Web Application Proxy Server- The Web Application Proxy under the Remote Access role that allows administrators to securely publish applications for external access. This service acts as a reverse proxy and as an Active Directory Federation Services (AD FS) proxy.

Hybrid infrastructure

To be able to configure your current on-premises Exchange organization for a hybrid deployment, the following components are required.

Exchange Server 2016 with Mailbox Role EXCH2016
Exchange Server 2016 with Edge Transport Role EXCH2016EDGE
Windows Server 2016 with Azure Active Directory Connect (AAD Connect) Installed AADCONNECT
Active Directory Federation Server(s) ADFS2016
Web Application Proxy Server in perimeter EDGE2016
Domain Controller running on minimum Windows Server 2008 R2 DC01
Office 365 Subscriptions with default domain configured i.e. Service tenant FQDN Domain.onmicrosoft.com
Accepted Domain in Office 365 and On-premises Domain.com
On-premises domain type Authoritative
Office 365 Domain Type Internal Relay
User principal name domain and Microsoft Online ID domain @domain.com
External Azure AD Connect with AD FS FQDN sts.domain.com
On-premises Autodiscover FQDN Autodiscover.domain.com
Office 365 Autodiscover Autodiscover.outlook.com

Configuring Hybrid Exchange Server

Step1: Add and validate primary Email domain to Office 365

Perform the following steps to add the primary SMTP namespace to Office 365:

  1. Log on to: Office 365 admin center preview
  2. Click Settings > Domains > Add domain.
  3. Enter the primary SMTP namespace. For example, domain.com. Then, click Next.
  4. Copy the TXT record from the Wizard, go to domain management portal and add a text record ms=msxxxxxxx record and verify the domain. Setup TTL to 10 minutes. When complete, wait 10 minutes and then click Verify. If the wizard says it can’t verify your domain ownership, you might need to wait longer for your DNS records to update across the Internet; this might take several hours. Also verify that the record you created is correct.
  5. On the Required DNS settings page, click Continue setup. Don’t update your DNS records right now. Instead, you’ll update your DNS records later in your hybrid deployment.
  6. On the Set up your online services page, select I’ll manage my own DNS records and click Next.
  7. On the Update DNS settings page, select Skip this step – I have custom DNS records, so I’ll add the records I need later. I understand that some Office 365 services may be unavailable until I manually add the records with my registrar. Click Skip, and then click Finish.

Step2: Setup Primary SMTP Domain to Internal Relay

Definitions of Domain Type

Authoritative – Selecting this option means that email is delivered to email addresses that are listed for recipients in Office 365 for this domain. Emails for unknown recipients are rejected.

Internal relay – Selecting this option means that recipients for this domain can be in Office 365 or your on-premises mail servers. Email is delivered to known recipients in Office 365 or is relayed to your own email server if the recipients aren’t known to Office 365.

Use the Exchange Online EAC to change the domain type

  1. In the EAC, navigate to Mail flow > Accepted domains.
  2. Select the domain and click Edit .
  3. In the Accepted Domain window, in the This accepted domain is section, select the domain type. Edit the domain value to Internal relay.

Step3: Configure Active Directory synchronization

  1. Download Azure Active Directory Connect on the computer where you’ll install it, and then open it.
  2. On the Welcome page, click Next if you agree to the license terms and privacy notice.
  3. On the Express Settings page, click Customize.
  4. On the Install required components page, click Install.
  5. On the User sign-in page, select Federation with AD FS and then click Next.
  6. On the Connect to Azure AD page, enter the username and password for a user account that is a Global Administrator in your Office 365 organization , and then click Next.
  7. On the Connect your directories page, select the Active Directory forest that contains the Exchange organization you want to configure for hybrid deployment, and then enter the username and password for a user account that’s a member of the Enterprise Administrators group in that forest. Click Next.
  8. On the Domain and OU filtering page, select Sync all domains and OUs if you want to synchronize all of your on-premises Active Directory users to Office 365. If you want to select a specific organizational unit (OU), select Sync selected domains and OUs, and then select the Active Directory domains and OUs you want to synchronize. Click Next.
  9. On the Uniquely identifying your users page, make sure that Users are represented only once across all directories is selected, and then click Next.
  10. On the Filter users and devices page, make sure that Synchronize all users and devices is selected, and then click Next.
  11. On the Optional Features page, select Exchange hybrid deployment, and then click Next.
  12. On the AD FS farm page, select Configure a new Windows server 2016 AD FS farm.
  13. In the Certificate File field, browse to the third-party certificate that includes a subject alternative name (SAN) that matches the external FQDN of the AD FS server. This certificate needs to include a private key. In the Subject Name field, select the SAN you want to use, for example sts.domain.com. Click Next.
  14. On the AD FS Servers page, click Browse, select the name of the server where you’re installing Azure AD Connect with AD FS, and then click Add.
  15. On the Web application proxy servers page, click Browse, select the name of the server that will act as a web proxy for external connections, and then click Add.
  16. On the Proxy trust credentials page, enter the username and password of a user account that can access the certificate store on the AD FS server that contains the certificate you specified earlier in these steps, and then click Next.
  17. On the AD FS service account page, select Create a group Managed Service Account, enter the username and password for a user that’s a member of the Enterprise Admins group, and then click Next.
  18. On the Azure AD Domain page, select the domain that matches the custom domain that you added to your Office 365 organization and matches the User Principal Name users with which users will log in. For example, if you added the custom domain domain.com, and usernames are @domain.com, select domain.com from the list. Click Next.
  19. On the Ready to configure page, select Start the synchronization process as soon as the configuration completes, and then click Next.
  20. On the Configuration complete page, click Exit.
  21. Make sure that your firewall is configured to allow connections on TCP port 443 from external sources to your AD FS web proxy server.
  22. At this point, Azure AD Connect will synchronize your on-premises user accounts and their information to your Office 365 organization. Depending on how many accounts need to be synchronized, this might take a while.

Step4: Create Federation with Azure Active Directory

Remote into the Primary ADFS Server, Run the below cmdlets

Connect-MsolService
Set-MsolAdfsContext -Computer “adfsserver.domain.com”
Convert-MsolDomainToFederated -Domain “domain.com” -SupportMultipleDomain

If you have multiple userprincipalname, you have run the below cmdlets to federate with Azure AD.
Convert-MsolDomainToFederated -Domain “domain1.com” -SupportMultipleDomain
Convert-MsolDomainToFederated -Domain “domain2.com” -SupportMultipleDomain
Update-MsolFederatedDomain -Domain “domain1.com” -SupportMultipleDomain
Update-MsolFederatedDomain -Domain “domain2.com” -SupportMultipleDomain

Further reading ADFS Configuration Guide

Step5: Verify tenant configuration

To create a mailbox in the Exchange Online organization, do the following:

  1. Open Active Directory Users and Computers on an Active Directory domain controller in your on-premises organization.
  2. Expand the container or organizational unit (OU) where you want to create a new Active Directory user.
  3. Click Action in the menu bar, and then click New > User.
  4. Enter the required user information. Because this user will be associated with a test mailbox, we recommend that you clearly identify the user as such. For example, name the user “Test User”.
  5. In the User logon name field, provide the user name that the user should specify when logging into their user account. This user name, combined with the user principal name (UPN) in the drop-down box next to the User logon name field, makes up the Microsoft Online Identity of the user. The Microsoft Online Identity typically matches the user’s email address, and the domain suffix chosen should match the federated domain configured in Active Directory Federation Services. For example, testuser@domain.com. Click Next.
  6. Enter a password for the new user, specify any options you want to set, and then click Next.
  7. Click Finish.
  8. Run delta synchronization to synchronize the new user to the Office 365 organization  using this PowerShell Cmdlet. Start-ADSyncSyncCycle -PolicyType Delta
  9. Log on to: Office 365 service administration portal
  10. Assign a E1 or E3 license to the new user.

Step6: Install Edge Transport server

The Edge Transport server role is typically deployed on a computer located in an Exchange organization’s perimeter network and is designed to minimize the attack surface of the organization. The Edge Transport server role handles all Internet-facing mail flow, which provides SMTP relay and smart host services for the on-premises Exchange organization. Use Edge Transport servers if you don’t want to expose internal Exchange 2016 Mailbox servers directly to the Internet.

If you already have an Edge Transport server deployed in your on-premises organization, you can skip this checklist step unless you’d like to install additional Edge Transport servers.

Step7: Configure Edge servers

After installing the Exchange 2016 Edge Transport server, or if you already have an Edge Transport server in your on-premises Exchange organization, you must configure the following services and parameters to enable the Edge Transport server to handle secure communications between the on-premises Exchange servers, clients, and Office 365. If you already have an Edge Transport Server, skip this step.

Follow additional guidelines to Edge Transport Server.

Further References on Edge Transport Server.

Step8: Configure DNS

Hybrid requirement DNS record Record type Value
Required for all hybrid deployments autodiscover.domain.com CNAME or A If using CNAME DNS:  mail.domain.com

If using Host A DNS:  External IP address of an Exchange 2016 Mailbox server or firewall

Recommended as a best practice for all hybrid deployments SPF TXT v=spf1 include:spf.protection.outlook.com ~all
ADFS Public record sts.domain.com A Public IP address of the AD FS web proxy server or firewall
Internal record by editing Hosts File located %SystemRoot%\system32\drivers\etc\HOSTS of WAP server sts.domain.com A Internal IP address of the AD FS Servers

Step9: Firewall Configuration

If your organization uses Office 365 and restricts computers on your network from connecting to the Internet, below you’ll find the endpoints (FQDNs, Ports, URLs, IPv4, and IPv6 address ranges) that you should include in your outbound allow lists to ensure your computers can successfully use Office 365.

Hybrid deployment configuration changes may require you to modify security settings for your on-premises network and protection solutions. Exchange 2016 Mailbox servers must be accessible on TCP port 443, and Edge Transport and Mailbox servers must be accessible on TCP port 25. Other Office 365 services, such as SharePoint Online and Lync Online, may require additional network security configuration changes. If you’re using Microsoft Threat Management Gateway (TMG) in your on-premises organization, additional configuration steps will also be needed to allow full Office 365 integration in the hybrid deployment.

Step10: Configure Exchange Web Services

The external fully qualified domain name (FQDN) of your Internet-facing Exchange 2016 Mailbox server needs to be configured on several virtual directories for a hybrid deployment. By completing this checklist step, the external URL on the Exchange Web Services (EWS), Outlook Address Book (OAB), Outlook Web App (OWA), Exchange Control Panel (ECP), and the Exchange ActiveSync (Microsoft-Server-ActiveSync) virtual directories will be reset to the external FQDN of your Internet-facing Exchange 2016 Mailbox server.

Follow additional guidelines to configure web services.

Further References on Web Services.

Step11: Configure MRS Proxy

The Exchange 2016 Mailbox servers are the internet-facing servers for the organization, with a load balancer distributing traffic across them. Since those servers will be internet-facing for the Hybrid configuration, they need to be MRS Proxy enabled. Currently they are not MRS Proxy enabled, as seen here in the output of Get-WebServicesVirtualDirectory.

GetWebServicesVirtualDirectory ADPropertiesOnly | Where {$_.MRSProxyEnabled ne $true} | SetWebServicesVirtualDirectory MRSProxyEnabled $true

Step12: Configure Exchange certificates

Digital certificates are an important requirement for secure communications between on-premises Exchange 2016 servers, clients, and Office 365. You need to obtain a certificate that will be installed on Mailbox and Edge Transport servers from a third-party trusted certificate authority (CA).

Before you can configure certificates on Exchange servers, you need to get a certificate from a trusted CA. Complete the following task on an Exchange 2016 Mailbox server if you need to generate a request for a new certificate for use with the hybrid deployment.

Follow additional guidelines to install certificates.

Further References on Exchange Certificates.

Step13: Run Hybrid Configuration wizard

The Hybrid Configuration wizard helps you establish your hybrid deployment by creating the HybridConfiguration object in your on-premises Active Directory and gathering existing Exchange and Active Directory topology configuration data. The Hybrid Configuration wizard also enables you to define and configure several organization parameters for your hybrid deployment, including secure mail transport options.

You can use the Hybrid Configuration wizard in the EAC on an Exchange 2016 server in your on-premises organization to create and configure the hybrid deployment.

  1. In the EAC on an Exchange 2016 server in your on-premises organization, navigate to the Hybrid, In the Hybrid node, click Configure to enter your Office 365 credentials.
    At the prompt to log in to Office 365, select sign in to Office 365 and enter the account credentials. The account you log into needs to be a Global Administrator in Office 365.
  2. Click Configure again to start the Hybrid Configuration wizard.
  3. On the Microsoft Office 365 Hybrid Configuration Wizard Download page, click Click here to download wizard. When you’re prompted, click Install on the Application Install, Click Next, and then, in the On-premises Exchange Server Organization section, select Detect a server running Exchange 2013 CAS or Exchange 2016. The wizard will attempt to detect an on-premises Exchange 2016 server. If the wizard doesn’t detect an Exchange 2016 server, or if you want to use a different server, select Specify a server running Exchange 2013 CAS or Exchange 2016 and then specify the internal FQDN of an Exchange 2016 Mailbox server.
  4. In the Office 365 Exchange Online section, select Microsoft Office 365 and then click Next.
  5. On the Credentials page, in the Enter your on-premises account credentials section,  specify a different set of credentials, specify the username and password an Active Directory account you want to use. Whichever selection you choose, the account used needs to be a member of the Enterprise Admins security group.
  6. In the Enter your Office 365 credentials section, specify the username and password of an Office 365 account that has Global Administrator permissions. Click Next.
  7. On the Validating Connections and Credentials page, the wizard will connect to both your on-premises organization and your Office 365 organization to validate credentials and examine the current configuration of both organizations. Click Next when it’s done.
  8. On the Hybrid Features page, select Full Hybrid Configuration and then click Next.
  9. On the Hybrid Domains, select the domain or multiple accepted domains you want to include in your hybrid deployment. In most deployments you can leave the Auto Discover column set to False for each domain. Only select True next to a domain if you need to force the wizard to use the Autodiscover information from a specific domain.
  10. Click Next.
  11. On the Federation Trust page, click Enable and click then Next.
  12. On the Domain Ownership page, click Click copy to clipboard to copy the domain proof token information for the domains you’ve selected to include in the hybrid deployment. Open a text editor such as Notepad and paste the token information for these domains. Before continuing in the Hybrid Configuration wizard, you must use this info to create a TXT record for each domain in your public DNS.
  13. Click Next after the TXT records have been created and the DNS records have replicated.
  14. On the Hybrid Configuration page, select the Configure my Edge Transport servers for secure mail transport option to configure your on-premises Edge Transport servers for secure mail transport with Office 365. Click Next.
  15. If you want Office 365 to send all outbound messages to external recipients to your on-premises transport servers, select the Enable centralized mail transport check box in the More options section.The on-premises transport servers will be responsible for delivering the messages to external recipients. This approach is helpful in compliance scenarios where all mail to and from the Internet must be processed by on-premises servers. If this check box is not selected, Office 365 will bypass the on-premises organization and deliver messages to external recipients directly using the recipient’s external DNS settings.You select this option if you want to use your own Spam Filter.
  16. On the Edge Transport Servers page, select the Edge Transport server you want to configure for secure mail transport. click Next. In this section, you have to provide the public IP addresses of edge servers or public FQDN of edge servers.
  17. On the Transport Certificate page, in the Select a reference server field, select Exchange 2016 Mailbox server that has the certificate you configured earlier in the checklist.
  18. In the Select a certificate field, select the certificate to use for secure mail transport. This list displays the digital certificates issued by a third-party certificate authority (CA) installed on the Mailbox server selected in the previous step. Click Next.
  19. On the Organization FQDN page, enter the externally accessible FQDN for your Internet-facing Exchange 2016 Mailbox server. Office 365 uses this FQDN to configure the service connectors for secure mail transport between your Exchange organizations. For example, enter “mail.domain.com”. Click Next.
  20. The hybrid deployment configuration selections have been updated, and you’re ready to start the Exchange services changes and the hybrid deployment configuration. Click Update to start the configuration process. While the hybrid configuration process is running, the wizard displays the feature and service areas that are being configured for the hybrid deployment as they are updated.
  21. When the wizard has completed all of the tasks it can perform automatically, it’ll list any tasks that you need to address manually before your hybrid deployment configuration is complete.
  22. The wizard displays a completion message and the Close button is displayed. Click Close to complete the hybrid deployment configuration process and to close the wizard.
  23. You’ll probably need to configure the Receive connector on your Edge Transport server by doing the following.
    Open the Exchange Management Shell on your Exchange 2016 Edge Transport server.
    Run the following command to list the Receive connectors on your Edge Transport server. Make note of the Receive connector that’s listening on TCP port 25.Get-ReceiveConnectorRun the following command to configure the Receive connector. Replace the name of the Receive connector in the following command with the name of the connector you identified in the previous step.Set-ReceiveConnector “Edge\Default internal receive connector Edge” -TlsDomainCapabilities mail.protection.outlook.com:AcceptOorgProtocol -Fqdn “mail.domain.com”24. Additional Steps for Centralised Mailflow or Route all inbound-outbound emails through on-premises servers. You need to enable remote mailbox using enable-remotemailbox and set target address using set-remotemailbox for this each mailbox as user1@domain.mail.onmicrosoft.com where domain is your domain name in Office 365. You must run full sync after this on the AAD Connect Server. You must run start-edgesynchronization –Server EXCH2016MailboxServer on the Edge Transport 2016 Server

Step14: Send Connector and Receive Connector Configuration on the on-premises server

Use the EAC to create an Internet Send connector

  1. In the EAC, navigate to Mail flow > Send connectors, and then click Add . This starts the New Send connector
  2. On the first page, enter the following information: Name: To Office 365 and Type: Internet When you are finished, click Next.
  3. On the next page, verify that MX record associated with recipient domain is selected. When you are finished, click Next.
  4. On the next page, In the Address space section, click Add . In the Add domain dialog box that appears, in Fully Qualified Domain Name (FQDN), enter an asterisk (*), and then click Save. This value indicates that the Send connector applies to messages addressed to all external domains. When you are finished, click Next.
  5. On the next page, in the Source server section, click Add . In the Select a Server dialog box that appears, select one or more Edge Transport Servers if you route email through Edge Server if not enter mailbox servers that you want to use to send mail to the Internet. If you have multiple Mailbox servers in your environment, select the ones that can route mail to the Internet. If you have only one Mailbox server, select that one. After you’ve selected at least one Mailbox server, click Add, click OK, and then click Finish.

Use the EAC to Create a Receive Connector to Receive Secure Messages from a Partner

  1. In the EAC, navigate to Mail flow > Receive connectors. Click Add to create a new Receive connector.
  2. On the New receive connector page, specify a name for the Receive connector and then select Frontend Transport for the Role. Since you are receiving mail from a partner in this case, we recommend that you initially route mail to your front end server to simplify and consolidate your mail flow.
  3. Choose Partner for the type. The Receive connector will receive mail from a trusted third party.
  4. For the Network adapter bindings, observe that All available IPV4 is listed in the IP addresses list and the Port is 25. (Simple Mail Transfer Protocol uses port 25.) This indicates that the connector listens for connections on all IP addresses assigned to network adapters on the local server. Click Next.
  5. If the Remote network settings page lists 0.0.0.0-255.255.255.255, which means that the Receive connector receives connections from all IP addresses, click Remove 0.0.0-255.255.255.255 to remove it. Click Add EOP IP Addresses, and Datacentre IP Addresses add the IP address for your partner’s server, and click Save.
  6. Click Finish to create the connector.
  7. Run the below Cmdlets in Mailbox Server

Get-ReceiveConnector “Inbound from Office 365“ | Add-ADPermission -User “NT AUTHORITY\ANONYMOUS LOGON” -ExtendedRights “ms-Exch-SMTP-Accept-Any-Recipient”

  1. Verify Receive Connector using below Cmdlets

Get-ADPermission -Identity “ Inbound from Office 365” -User “NT AUTHORITY\ ANONYMOUS LOGON” | where {($_.Deny -eq $false) -and ($_.IsInherited -eq $false)} | Format-Table User,ExtendedRights

  1. Add Datacentre IP Addresses using this Link
  2. Troubleshoot using this link

Step14: Create a test mailbox

You can use the Office 365 Mailbox wizard in the EAC on an Exchange server to create a test mailbox in Office 365. If you want to create more than one test mailbox, you’ll have to use this wizard for each test mailbox. You can’t use the wizard to create multiple test mailboxes.

  1. Log into the EAC on an on-premises Exchange 2016 server.
  2. In the EAC, navigate to Enterprise > Recipients > Mailboxes.
  3. Expand the menu at the Add  control and select Office 365 mailbox.
  4. On the New Office 365 mailbox page, specify the following settings:
    • First Name   Type the first name of the new user.
    • Initials   Type the initials of the new user.
    • Last Name   Type the last name of the new user.
    • User logon name   Type the user logon name of the new user and select the primary SMTP domain used for your other on-premises users. For example, @domain.com.
    • Mailbox type   Choose the type of mailbox to create. For example, User mailbox.
    • Password   Type the password.
    • Confirm password   Retype the password.
    • Make sure the Create an archive mailbox check box is not selected.
  5. Click Save to continue.
  1. Start-ADSyncSyncCycle -PolicyType Delta

Step15: Move or create mailboxes

You can use the remote move migration wizard in the Office 365 tab in the Exchange admin center (EAC) on an Exchange server to move existing user mailboxes in the on-premises organization to Office 365:

  1. Open the EAC and navigate to Office 365 > Recipients > migration.
  2. Click Add  and select Migrate to Exchange Online.
  3. On the Select a migration type page, select Remote move migration and then click Next.
  4. On the Select the users page, click Add , select the on-premises users to move to Office 365 and click Add, and then click OK. Click Next.
  5. On the Enter the Windows user account credential page, enter the on-premises administrator account name in the On-premises administrator name text field and enter the associated password for this account in the On-premises administrator password text field. For example, “Domain\administrator” and a password. Click Next.
  6. On the Confirm the migration endpoint page, verify that the FDQN of your on-premises Mailbox server is listed when the wizard confirms the migration endpoint. For example, “mail.domain.com”. Click Next.
  7. On the Move configuration page, enter a name for the migration batch in the New migration batch name text field. Use the down arrow  to select the target delivery domain for the mailboxes that are migrating to Office 365. In most hybrid deployments, this will be the primary SMTP domain used for both on-premises and Office 365 mailboxes. For example, user@domain.com. Verify that the Move primary mailbox along with archive mailbox option is selected, and then click Next.
  8. On the Start the batch page, select at least one recipient to receive the batch complete report. Verify that the Automatically start the batch and Automatically complete the migration batch options are selected. Click New.
  9. While the mailboxes are being moved, you will see a status of Synching in the migration status for each mailbox moved to Office 365. After the mailbox move request reaches a status of Completed, the mailbox migration process is complete.

Step16: Test hybrid deployment connectivity

Testing the external connectivity for critical Exchange 2016 and Office 365 features is an important step in ensuring that your hybrid deployment features are functioning correctly. The Microsoft Remote Connectivity Analyzer is a free online web service that you can use to analyze, and run tests for, several Exchange 2016 and Office 365 services, including Exchange Web Services, Outlook, Exchange ActiveSync, and Internet email connectivity.

How to Configure Office 365 SMTP Relay

There are three ways you can setup SMTP Relay for Applications and multi-function devices using Office 365. All three options are elaborated here. Option 1 and Option 2 are configured within the application and devices. Option 3 are setup within the application/devices and within Office 365 Admin Centre.

Option1 – Client submission: Authenticate device or application directly with an Office 365 mailbox.

Smart Host: smtp.office365.com

Port: 587 TLS Enabled or Port 25

Feature:

  • Send email to inside or outside of the organisation.
  • Send email from any devices or IP addresses.
  • Send email from any location

Limitation:

30 messages sent per minute, and a limit of 10,000 recipients per day.

Username: Azure AD username printer@domain.com or printer@tenant.onmicrosoft.com and Azure AD Password

Option 2- Direct Send: Send mail directly from a printer or an application to Office 365

Smart Host: FQDN of the MX record of your domain.

SPF Record: v=spf1 ip4:<public IP address of registered domain> include:spf.protection.outlook.com ~all

Port: 25

Feature:

  • Uses Office 365 to send emails, but does not require a dedicated Office 365 mailbox.
  • Doesn’t require your device or application to have a static IP address. However, this is recommended if possible.
  • Doesn’t work with a connector; never configure a device to use a connector with direct send, this can cause problems.
  • Doesn’t require your device to support TLS.

Limitation:

  • Direct send cannot be used to deliver email to external recipients, for example, recipients with Yahoo or Gmail addresses.
  • Your messages will be subject to antispam checks.
  • Sent mail might be disrupted if your IP addresses are blocked by a spam list.
  • Office 365 uses throttling policies to protect the performance of the service.

Username: Any email address for one of your Office 365 accepted domains user1@domain.com and Azure AD Password

Option 3 – Special Send Connector: Configure a connector to send mail using Office 365 SMTP relay

Smart Host: FQDN of the MX record of your domain.

SPF Record: v=spf1 ip4:<Public IP Address of registered domain> include:spf.protection.outlook.com ~all

Port: 25

Username: Any email address for one of your Office 365 accepted domains user1@domain.com and Azure AD Password

Feature:

  • Office 365 SMTP relay does not require the use of a licensed Office 365 mailbox to send emails.
  • Office 365 SMTP relay has higher sending limits than SMTP client submission; senders are not bound by the 30 messages per minute or 10,000 recipients per day limits.

Limitation

  • Sent mail can be disrupted if your IP addresses are blocked by a spam list.
  • Reasonable limits are imposed for sending.
  • Requires static un-shared IP addresses (unless a certificate is used).

Setting Up Option 3:

Step1:

  1. Sign in to Office 365.
  2. Select Domains. Select the Domain e.g. domain.com. Click Manage DNS and find the MX record. The MX record will have a POINTS TO ADDRESS value that looks similar to domain-com.mail.protection.outlook.com.
  3. Make a note of the MX record POINTS TO ADDRESS
  4. Go to a MX recording finding web site and find the IP address of MX record using below steps.

Open Command Prompt from internet connected computer, Type

Nslookup

>Set q=mx

>domain.com where domain.com is your domain name.

Step2:

  1. In Office 365, click Admin, and then click Exchange to go to the Exchange admin center.
  2. In the Exchange admin center, click mail flow, and click connectors. click the plus symbol +. On the first screen, choose the options From Your Organisation to Office 365, Click Next, and give the connector a name.
  3. On the next screen, choose the option By verifying that the IP address of the sending server matches one of these IP addresses that belong to your organization, and add the IP address of MX Record from step 1.
  1. Leave all the other fields with their default values, and select Save.
  2. Test the configuration, send a test email from your device or application, and confirm that it was received by the recipient.

Exchange 2007/2010 to Exchange 2013 Migration Step by Step Guide

Before you begin, create a work sheet in spreadsheet recording required information to migrate Exchange 2007/2010 to Exchange 2013. For this article, I am going to use following work sheet. This work sheet and migration guide are tested in production exchange migration which I did for few of my clients. Note that this article is not situation specific hence I can’t provide you a silver bullet for your situation.

Deployment Work Sheet

Version Readiness Check

Present Server Proposed Server
Exchange 2007 SP3 OR 2010 SP3 Exchange 2013 CU3

Exchange Role Assignment

Exchange 2013 has two server roles; the Mailbox and Client Access server roles. You need at least one Client Access server and one Mailbox server in the Active Directory forest. If you’re separating your server roles, Microsoft recommend installing the Mailbox server role first.

Mailbox Role: The Mailbox server includes the Client Access protocols, the Transport service, the Mailbox databases, and Unified Messaging (the Client Access server redirects SIP traffic generated from incoming calls to the Mailbox server). The Mailbox server handles all activity for the active mailboxes on that server.

Client Access: The Client Access server provides authentication, limited redirection, and proxy services for all of the usual client access protocols: HTTP, POP and IMAP, and SMTP. The Client Access server, a thin and stateless server, doesn’t do any data rendering. With the exception of diagnostic logs, nothing is queued or stored on the Client Access server.

Server Name Exchange Roles
AUPEREXMBX01,AUPEREXMBX02 Mailbox
AUPEREXCAS01,AUPEREXCAS02 CAS

Active Directory Schema and Forest

When you install Exchange 2013 for the first time, your Active Directory schema will be updated. This schema update is required to add objects and attributes to Active Directory to support Exchange 2013. Additionally, replicating the changes made to your schema may take several hours or days and is dependent on your Active Directory replication schedule. A forced replication can be performed after schema preparation.

Description AD Forest Domain Controller
Primary SMTP namespace Superplaneteers.com AUPERDC01,AUPERDC02
User principal name domain Superplaneteers.com AUPERDC01,AUPERDC02

Legacy Edge Transport

N/A

Network Configuration

Server Name TCP/IP DNS Replication network
AUPEREXMBX01 10.10.10.11

 

10.10.10.2

10.10.10.3

192.168.100.11/24
AUPEREXMBX02 10.10.10.12 10.10.10.2

10.10.10.3

192.168.100.12/24
AUPEREXCAS01 10.10.10.13 10.10.10.2

10.10.10.3

N/A
AUPEREXCAS02 10.10.10.14 10.10.10.2

10.10.10.3

N/A

The network adapter name used within the operating system of mailbox server must be changed to closely match the associated network name. For example: Domain Network and Replication Network. The following binding order must be maintained within Windows operating systems:

  1. First in Order- Domain adapter connected to the Active Directory network
  2. Second in Order- Replication adapter connected to the heartbeat network.

Here is a guide how to change adapter binding order http://technet.microsoft.com/en-us/library/cc732472(v=ws.10).aspx Microsoft does not support multiple default gateways on a single server, no default gateway is required on the replication network card.

Disk layout

Server Name C: E: F: G:
AUPEREXMBX01 50 GB 50 GB 500GB 300GB
AUPEREXMBX02 50 GB 50 GB 500GB 300GB
AUPEREXCAS01 50 GB 50 GB N/A N/A
AUPEREXCAS02 50 GB 50 GB N/A N/A

Resilient Exchange Configuration

Purpose Name TCP/IP Subnet Type
DAG AUPEREXDAG01 10.10.10.15 255.255.255.0 N/A
CAS NLB or Load Balancer Mail.superplaneteers.com 10.10.10.16 255.255.255.0 Multicast

Exchange Administrator

User name Privileges
ExMigrationAdmin Domain Admins

Domain user

Schema Admin

Enterprise Admin

Organisation Management

Local Administrator

Certificates

A public Secure Sockets Layer (SSL) certificate is a prerequisite in Exchange 2013. SSL helps to protect communication between your Exchange servers and clients and other mail servers by encrypting data and, optionally, identifying each side of the connection.

You can buy a third-party certificate from public CA such as Verisign. Certificates published by public CAs are trusted by most operating systems and browsers.

Common Name Subject Alternative Type Assigned to
mail.superplaneteers.com autodiscover.superplaneteers.com SSL IIS,SMTP,POP,IMAP

Supported Client

Exchange 2013 supports the following minimum versions of Microsoft Outlook and Microsoft Entourage for Mac:

  • Outlook 2013 (15.0.4420.1017)
  • Outlook 2010 Service Pack 1 with the Outlook 2010 November 2012 update (14.0.6126.5000).
  • Outlook 2007 Service Pack 3 with the Outlook 2007 November 2012 update (12.0.6665.5000).
  • Entourage 2008 for Mac, Web Services Edition
  • Outlook for Mac 2011

Exchange 2013 does not support Outlook 2003.

Public DNS records

DNS record Record Type IP/Alias/FQDN Priority
Mail.superplaneteers.com A 203.17.x.x N/A
superplaneteers.com MX Mail.superplaneteers.com 10
Autodiscover.superplaneteers.com CNAME Mail.superplaneteers.com N/A

If you have hosted email security then your MX record must look like this. An example is given here for TrendMicro hosted email security.

DNS record Record Type IP/Alias/FQDN Priority
Mail.superplaneteers.com A 203.17.x.x N/A
superplaneteers.com MX in.sjc.mx.trendmicro.com 10
Autodiscover.superplaneteers.com CNAME Mail.superplaneteers.com N/A

Internal DNS records

DNS record Record Type Hardware Load Balancer

VIP or CAS NLB IP

Mail.superplaneteers.com A 10.10.10.16
Autodiscover.superplaneteers.com A 10.10.10.16

If you don’t have CAS NLB or hardware load balancer then create Host(A) record of mail.superplaneteers.com and point to Exchange 2013 CAS Server.

Send Connector

Here I am giving an example of TrednMicro smart host. Do not add smart host without proper authorization from smart host provider otherwise you will not be able to send email from internal organisation to external destination.

Intended use Address Space Network Settings Authentication Smart Host
Internet “*” default Basic, Exchange, TLS relay.sjc.mx.trendmicro.com

Receive Connector

Name Intended use Network Settings IP Range Server(s)
Client Frontend Client default All Available IPv4 AUPEREXMBX01

AUPEREXMBX02

Default Frontend Inbound SMTP default All Available IPv4 AUPEREXMBX01

AUPEREXMBX02

Anonymous Relay

Relay Authentication Permission Remote IP SMTP
Anonymous Relay TLS, Externally Secured Anonymous, Exchange Servers IP Address of Printers, Scanner, Devices, App Server 10.10.10.11

10.10.10.12

Port Forwarding in Cisco Router

Rule Source Address Destination Address NATed Destination Port
OWA Any 203.17.x.x 10.10.10.16 443
SMTP Any 203.17.x.x 10.10.10.16 25

Again if you don’t have CAS NLB or load balancer your NATed destination is Exchange 2013 CAS server.

Mailbox Storage

Storage Group Type Database location
Mailbox storage F:Exchange Data
Mailbox storage logs G:Exchange Log

Email address Policy

Email Address Policy %g.%s@superplaneteers.com

Virtual Directory for internal and external network

Virtual directory Internal and External URL value
Autodiscover https://autodiscover.superplaneteers.com/autodiscover/autodiscover.xml
ECP https://mail.superplaneteers.com/ecp
EWS https://mail.superplaneteers.com/EWS/Exchange.asmx
Microsoft-Server-ActiveSync https://mail.superplaneteers.com/Microsoft-Server-ActiveSync
OAB https://mail.superplaneteers.com/OAB
OWA https://mail.superplaneteers.com/owa
PowerShell http://mail.superplaneteers.com/PowerShell

Since you have finished your work sheet, now you are ready to virtualize Exchange servers on Hyper-v.

1. Virtualize Windows Server 2012 R2

2. Configure TCP/IP properties

3. Disable Windows Firewall

4. Join Windows server 2012 R2 to domain.

Download following software as prerequisites.

1. Microsoft Exchange Server 2010 Service Pack 3 (SP3) OR Exchange Server 2007 Service Pack 3

2. Cumulative Update 3 for Exchange Server 2013 (KB2892464)

3. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit

4. Microsoft Office 2010 Filter Pack 64 bit

5. Microsoft Office 2010 Filter Pack SP1 64 bit

Additional Prerequisites if you would like to install Exchange 2013 on Windows Server 2008 R2 SP1.

  1. Microsoft .NET Framework 4.5
  2. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit
  3. Microsoft Office 2010 Filter Pack 64 bit
  4. Microsoft Office 2010 Filter Pack SP1 64 bit
  5. Microsoft Knowledge Base article KB974405 (Windows Identity Foundation)
  6. Knowledge Base article KB2619234 (Enable the Association Cookie/GUID that is used by RPC over HTTP to also be used at the RPC layer in Windows 7 and in Windows Server 2008 R2)
  7. Knowledge Base article KB2533623 (Insecure library loading could allow remote code execution)

Windows Firewall

Open Control Panel > Windows Firewall. Turn off Firewall components (Domain, private and Public) completely.

Preparing Base Windows Server 2012 for Exchange 2013

Mailbox Server Role in Windows Server 2012 R2

To install prerequisites in Windows Server 2012, open Windows PowerShell as an administrator. Execute the following cmdlet one by one.

Import-Module ServerManager

Install-WindowsFeature RSAT-ADDS

Install-WindowsFeature AS-HTTP-Activation, Desktop-Experience, NET-Framework-45-Features, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation

Reboot Windows Server 2012

Client Access Server Role in Windows Server 2012 R2

To install prerequisites in Windows Server 2012, open Windows PowerShell as an administrator, Execute the following cmdlet one by one.

Import-Module ServerManager

Install-WindowsFeature RSAT-ADDS

Install-WindowsFeature AS-HTTP-Activation, Desktop-Experience, NET-Framework-45-Features, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation

Reboot Windows Server 2012

If you are installing Exchange 2013 on Windows Server 2008 R2 SP1.

Prepare mailbox role Windows Server 2008 R2 SP1

Open Windows PowerShell as an administrator, Execute the following cmdlets one by one.

Import-Module ServerManager

Add-WindowsFeature Desktop-Experience, NET-Framework, NET-HTTP-Activation, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Web-Server, WAS-Process-Model, Web-Asp-Net, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI

Reboot Windows Server 2008 R2

Prepare Client Access in Windows Server 2008 R2

Open Windows PowerShell, Execute the following cmdlet one by one.

Import-Module ServerManager

Add-WindowsFeature Desktop-Experience, NET-Framework, NET-HTTP-Activation, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Web-Server, WAS-Process-Model, Web-Asp-Net, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI

Reboot Windows Server 2008 R2

Install Service pack 3 on exchange 2010

Upgrading to SP3 requires a schema update, review the Active Directory Schema changes beforehand. Upgrade your Exchange servers to SP3. This should be performed in the following order:

1. CAS servers

2. Hub and/or Edge servers

3. Mailbox servers

4. Unified Messaging servers

Upgrade Exchange 2010 to Exchange 2010 SP3 level

1. Once the files are extracted, locate and run setup.exe as an administrator

2. Select Install Microsoft Exchange Upgrade.

3. Select Next at the welcome screen. Read and accept the license terms, then select Next.

4. If you’ve got all the requirements you’ll see all the green checks, Select Upgrade to begin the upgrade

5. Select Next to start the upgrade.

6. When the upgrade is complete, select Finish.

7. Reboot the server to allow changes to take affect.

Prepare Active Directory Schema

Before you prepare Active Directory, make sure your Active Directory is healthy. Follow the procedure for AD health check.

1. Prepare Active Directory in an Active Directory site where you want to install Exchange 2013.

2. Domain Controller must be Server 2008 Standard/Enterprise (x86/x64) OR Server 2008 R2 Standard / Enterprise OR Windows Server 2012 OR Windows Server 2012 R2.

3. Each domain needs at least one writeable global catalog server

4. Ensure AD replication is working properly in each site / domain

5. Ensure Active Directory is healthy. Visit active directory health check

6. Run the following command in a domain controller, Open command prompt as an administrator

repadmin /showrepl

repadmin /replsummary

repadmin /syncall

netdom query fsmo

Dcdiag /e

Netdiag

7. Open Active Directory Sites and Services MMC, make sure all domain controllers are global catalog.

8. Start Menu, Run, Type eventvwr to open event view, Review event logs to see everything is working as per normal

9. Start Menu, Run> Services.msc to open services, Check DNS server, DNS Client, File replication services are started and set to automatic

10. Open SYSVOL in all domain controllers and check everything is same in all domain controllers.

Now you are ready to prepare Active Directory Domain and Forest.

1. Extract the Exchange2013-x64-cu3.EXE package you have downloaded from Microsoft web site to a common location. In my example I will use E:EXCHANGE2013

2. Open a command prompt as an Administrator, and navigate to the directory in which you extracted the files to. In the case of this example it will be E:Exchange2013. You should see a Setup.exe file located there.

3. Run the following cmd:

  • Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms

OR

  • Setup.exe /PS /IacceptExchangeServerLicenseTerms

4. Run the following cmd:

  • Setup.exe /PrepareAD /OrganizationName:<NAMEHERE> /IAcceptExchangeServerLicenseTerms

OR

  • Setup.exe /PAD /OrganizationName:<NAMEHERE> /IAcceptExchangeServerLicenseTerms

Now replicate Active Directory manually or wait for replication to complete. Verify event logs in Domain controllers to see any unexpected error or logs pops up or not. If everything looks fine then go ahead and install Exchange 2013.

Installing Exchange 2013 CU3

  1. After you have downloaded Exchange 2013 CU2, log on to the computer on which you want to install Exchange 2013.
  2. Navigate to the network location of the Exchange 2013 installation files.
  3. Start Exchange 2013 Setup by right clicking Setup.exe select Run as administrator
  4. On the Check for Updates page, choose whether you want Setup to connect to the Internet and download product and security updates for Exchange 2013. Select Don’t check for updates right now, you can download and install updates manually later. Click Next to continue.
  5. The Introduction page begins the process of installing Exchange into your organization. Click Next to continue.
  6. On the License Agreement page, review the software license terms. If you agree to the terms, select I accept the terms in the license agreement, and then click Next.
  7. On the Recommended settings page, select whether you want to use the recommended settings. If you select Use recommended settings, Exchange will automatically send error reports and information about your computer hardware and how you use Exchange to Microsoft. click Next.
  8. On the Server Role Selection page, select both Mailbox role and Client Access role or separate role based on your design. The management tools are installed automatically if you install any other server role.
    Select Automatically install Windows Server roles and features that are required to install Exchange Server to have the Setup wizard install required Windows prerequisites. You may need to reboot the computer to complete the installation of some Windows features. If you don’t select this option, you must install the Windows features manually. Click Next to continue.
  9. On the Installation Space and Location page, click Browse to choose a new location. I strongly recommend you installing Exchange 2013 on a separate partition other then C: drive. Click Next to continue.
  10. On the Malware Protection Settings page, choose whether you want to enable or disable malware scanning. If you disable malware scanning, it can be enabled in the future. Unless you have a specific reason to disable malware scanning, we recommend that you keep it enabled. Click Next to continue.
  11. On the Readiness Checks page, view the status to determine if the organization and server role prerequisite checks completed successfully. click Next to run the prerequisite check again. Be sure to also review any warnings that are reported. If all readiness checks have completed successfully, click Install to install Exchange 2013.
  12. On the Completion page, click Finish.
  13. Restart the computer after Exchange 2013 has completed.
  14. Once rebooted log on to Exchange server and review Event Logs in Exchange Server.
  15. Repeat the steps for all Exchange Server 2013 in your organisation.

Create a Test mailbox

1. Open the EAC by browsing to the URL of your Client Access server. For example, https://AUPEREXCAS01/ecp?ExchClientVer=15.

2. Enter the user name and password of the account you used to install Exchange 2013 in Domainuser name and Password, and then click Sign in.

3. Go to Recipients > Mailboxes. On the Mailboxes page, click Add and then select User mailbox.

4. Provide the information required for the new user and then click Save.

5. Go to Permissions > Admin Roles. On the Admin Roles page, select Organization Management and click Edit .

6. Under Members, click Add .

7. Select the Exchange 2013 mailbox you just created, click Add, then click OK. Then click Save.

Install Exchange 2013 certificates

Depending on your requirements, you can configure wild card certificate or a SAN certificate. I will go for SAN certificate to avoid further configuration such as certificate principal name configuration. In this example, I will create a SAN certificate which is as follows.

  1. Open the EAC by browsing to the URL of your Client Access server. For example, https://AUPEREXCAS01/ecp?ExchClientVer=15.
  2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
  3. Go to Servers > Certificates. On the Certificates page, make sure your Client Access server is selected in the Select server field, and then click New .
  4. In the New Exchange certificate wizard, select Create a request for a certificate from a certification authority and then click Next.
  5. Specify a name for this certificate and then click Next.
  6. If you want to request a wildcard certificate, select Request a wild-card certificate and then specify the root domain of all subdomains in the Root domain field. If you don’t want to request a wildcard certificate and instead want to specify each domain you want to add to the certificate, leave this page blank. Click Next.
  7. Click Browse and specify an Exchange server to store the certificate on. The server you select should be the Internet-facing Client Access server. Click Next.
  8. For each service in the list shown, verify that the external or internal server names that users will use to connect to the Exchange server are correct. For example: CN=mail.superplaneteers.com and SAN=autodiscover.superplaneteers.com
  9. These domains will be used to create the SSL certificate request. Click Next.
  10. Add any additional domains you want included on the SSL certificate.
  11. Select the domain that you want to be the common name for the certificate and click Set as common name. For example, mail.superplaneteers.com. Click Next.
  12. Provide information about your organization. This information will be included with the SSL certificate. Click Next.
  13. Specify the network location where you want this certificate request to be saved. Click Finish.

After you’ve saved the certificate request, submit the request to your certificate authority (CA) which is public CA. Clients that connect to the Client Access server must trust the CA that you use. After you receive the certificate from the CA, complete the following steps:

  1. On the Server > Certificates page in the EAC, select the certificate request you created in the previous steps.
  2. In the certificate request details pane, click Complete under Status.
  3. On the Complete pending request page, specify the path to the SSL certificate file and then click OK.
  4. Select the new certificate you just added, and then click Edit .
  5. On the certificate page, click Services.
  6. Select the services you want to assign to this certificate. At minimum, you should select IIS but you can also select IMAP, POP, SMTP and UM call router if you use these services. Click Save.
  7. If you receive the warning Overwrite the existing default SMTP certificate?, click Yes.

To re-use existing certificate follow the steps below

  1. Log on directly to your Exchange 2010 Client Access server with an administrator user account.
  2. Open an empty Microsoft Management Console (MMC).
  3. Click File, then Add/Remove Snap-in.
  4. In the Add or Remove Snap-ins window, select Certificates and then click Add >.
  5. In the Certificates snap-in window that appears, select Computer account and click Next.
  6. Select Local computer and click Finish. Then click OK.
  7. Under Console Root, expand Certificates (Local Computer), Personal, and then Certificates.
  8. Select the 3rd-party certificate that’s used by Exchange 2010 that matches the host names you’ve configured on the Exchange 2013 server. This must be a 3rd-party certificate and not a self-signed certificate.
  9. Right-click on the certificate and select All Tasks and then Export….
  10. In the Certificate Export Wizard, click Next.
  11. Select Yes, export the private key and click Next.
  12. Make sure Personal Information Exchange – PKCS #12 (.PFX) and Include all certificates in the certification path if possible are selected. Make sure no other options are selected. Click Next.
  13. Select Password and enter a password to help secure your certificate. Click Next.
  14. Specify a file name for the new certificate. Use the file extension .pfx. Click Next and then click Finish.
  15. You’ll receive a confirmation prompt if the certificate export was successful. Click OK to close it.
  16. Copy the .pfx file you created to your Exchange 2013 Client Access server.

After you’ve exported the certificate from your Exchange 2010 server, you need to import the certificate on your Exchange 2013 server using the following steps.

  1. Log on directly to your Exchange 2013 Client Access server with an administrator user account.
  2. Open an empty Microsoft Management Console (MMC).
  3. Click File, then Add/Remove Snap-in.
  4. In the Add or Remove Snap-ins window, select Certificates and then click Add >.
  5. In the Certificates snap-in window that appears, select Computer account and click Next.
  6. Select Local computer and click Finish. Then click OK.
  7. Under Console Root, expand Certificates (Local Computer), and then Personal.
  8. Right-click Personal and select All Tasks and then Import….
  9. In the Certificate Import Wizard, click Next.
  10. Click Browse and select the .pfx file you copied to your Exchange 2013 Client Access server. Click Open and then click Next.
  11. In the Password field, enter the password you used to help secure the certificate when you exported it on the Exchange 2010 Client Access server.
  12. Verify that Include all extended properties is selected and click Next.
  13. Verify that Place all certificates in the following store is selected and Personal is shown in Certificate store. Click Next. Click Finish.
  14. You’ll receive a confirmation prompt if the certificate import was successful. Click OK to close it.

Now that the new certificate has been imported on your Exchange 2013 Client Access server, you need to assign it to your Exchange services using the following steps.

  1. Open the EAC by browsing to the URL of your Client Access server. For example, https://Ex2013CAS/ECP.
  2. Open the EAC by browsing to the URL of your Client Access server. For example, https://Ex2013/ECP.
  3. Enter your user name and password in Domainuser name and Password, and then click Sign in.
  4. On the Server > Certificates page in the EAC, select the new certificate you just added, and then click Edit .
  5. On the certificate page, click Services.
  6. Select the services you want to assign to this certificate. At minimum, you should select IIS but you can also select IMAP, POP, SMTP and UM call router if you use these services. Click Save.
  7. If you receive the warning Overwrite the existing default SMTP certificate?, click Yes.

Configure Exchange 2013 external and internal URLs

  1. Open the EAC by browsing to the URL of your Client Access server. For example, https://AUPEREXCAS01/ecp?ExchClientVer=15.
  2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
  3. Go to Servers > Servers, select the name of the Internet-facing Exchange 2013 Client Access server and then click Edit .
  4. Click Outlook Anywhere.
  5. In the Specify the external hostname field, specify the externally accessible FQDN of the Client Access server. For example, mail.superplaneteers.com.
  6. While you’re here, let’s also set the internally accessible FQDN of the Client Access server. In the Specify the internal hostname field, insert the FQDN you used in the previous step. For example, mail. superplaneteers.com.
  7. Click Save.
  8. Go to Servers > Virtual directories and then click Configure external access domain .
  9. Under Select the Client Access servers to use with the external URL, click Add .
  10. Select the Client Access servers you want to configure, and then click Add. After you’ve added all the Client Access servers you want to configure, click OK.
  11. In Enter the domain name you will use with your external Client Access servers, type the external domain you want to apply. For example, mail.superplaneteers.com. Click Save.

Configure External and Internal URL to be same

  1. Open the Exchange Management Shell on your Exchange 2013 Client Access server.
  2. Store the host name of your Client Access server in a variable that will be used in the next step. For example, In my case, mail.superplaneteers.com

$HostName = “mail.superplaneteers.com “

3. Run each of the following commands in the Shell to configure each internal URL to match the virtual directory’s external URL.

Set-EcpVirtualDirectory “$HostNameECP (Default Web Site)” -InternalUrl ((Get-EcpVirtualDirectory “$HostNameECP (Default Web Site)”).ExternalUrl)

Set-WebServicesVirtualDirectory “$HostNameEWS (Default Web Site)” -InternalUrl ((get-WebServicesVirtualDirectory “$HostNameEWS (Default Web Site)”).ExternalUrl)

Set-ActiveSyncVirtualDirectory “$HostNameMicrosoft-Server-ActiveSync (Default Web Site)” -InternalUrl ((Get-ActiveSyncVirtualDirectory “$HostNameMicrosoft-Server-ActiveSync (Default Web Site)”).ExternalUrl)

Set-OabVirtualDirectory “$HostNameOAB (Default Web Site)” -InternalUrl ((Get-OabVirtualDirectory “$HostNameOAB (Default Web Site)”).ExternalUrl)

Set-OwaVirtualDirectory “$HostNameOWA (Default Web Site)” -InternalUrl ((Get-OwaVirtualDirectory “$HostNameOWA (Default Web Site)”).ExternalUrl)

Set-PowerShellVirtualDirectory “$HostNamePowerShell (Default Web Site)” -InternalUrl ((Get-PowerShellVirtualDirectory “$HostNamePowerShell (Default Web Site)”).ExternalUrl)

To verify that you have successfully configured the internal URL on the Client Access server virtual directories, do the following:

  1. In the EAC, go to Servers > Virtual directories.
  2. In the Select server field, select the Internet-facing Client Access server.
  3. Select a virtual directory and then click Edit .
  4. Verify that the Internal URL field is populated with the correct FQDN.

Move Arbitration Mailboxes

Follow the below steps to move all arbitration and discovery search mailboxes to 2013 database.

Open Exchange Management Shell with run as administrator and run the following cmds

Get‐Mailbox –Arbitration | New-MoveRequest –TargetDatabase TargetDBName

Get-Mailbox “*Discovery*” | New-MoveRequest –TargetDatabase TargetDBName

OR

Type the following comdlets in EMS to find arbitration mailboxes and migrate using migration wizard.

Get-Mailbox –Arbitration >C:Arbitration.txt

Get-Mailbox “*Discovery*” >C:Discovery.txt

  1. In the EAC, go to Recipients > Migration.
  2. Click New , and then click Move to a different database.
  3. On the New local mailbox move page, click Select the users that you want to move, and then click Add .
  4. On the Select Mailbox page, add the mailbox that has the following properties:
    • The display name is Microsoft Exchange.
    • The alias of the mailbox’s email address is SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}.
  5. Click OK, and then click Next.
  6. On the Move configuration page, type the name of the migration batch, and then click Browse next to the Target database box.
  7. On the Select Mailbox Database page, add the mailbox database to move the system mailbox to. Verify that the version of the mailbox database that you select is Version 15. x, which indicates that the database is located on an Exchange 2013 server.
  8. Click OK, and then click Next.
  9. On the Start the batch page, select the options to automatically start and complete the migration request, and then click New.

Enable and configure Outlook Anywhere

To allow your Exchange 2013 Client Access server to redirect connections to your Exchange 2010 servers, you must enable and configure Outlook Anywhere on all of the Exchange 2010 servers in your organization. If some Exchange 2010 servers in your organization are already configured to use Outlook Anywhere, their configuration must also be updated to support Exchange 2013. When you use the steps below to configure Outlook Anywhere, the following configuration is set on each Exchange 2010 server:

  1. Open the Exchange Management Shell on your Exchange 2010 Client Access server.
  2. Store the external host name of your Exchange 2013 Client Access server in a variable that will be used in the next steps. For example, mail.superplaneteers.com.

$Exchange2013HostName = “mail.superplaneteers.com”

Run the following command to configure Exchange 2010 servers that already have Outlook Anywhere enabled to accept connections from Exchange 2013 servers.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Get-ClientAccessServer | Where {$_.OutlookAnywhereEnabled -Eq $True} | ForEach {Set-OutlookAnywhere “$_RPC (Default Web Site)” -ClientAuthenticationMethod Basic -SSLOffloading $False -ExternalHostName $Exchange2013HostName -IISAuthenticationMethods NTLM, Basic}

If you didn’t enable Outlook Anywhere in Exchange 2010 already, Run the following command to enable Outlook Anywhere and configure Exchange 2010 to accept connections from Exchange 2013 servers.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Get-ClientAccessServer | Where {$_.OutlookAnywhereEnabled -Eq $False} | Enable-OutlookAnywhere -ClientAuthenticationMethod Basic -SSLOffloading $False -ExternalHostName $Exchange2013HostName -IISAuthenticationMethods NTLM, Basic

Configure service connection point (SCP)

Autodiscover uses an Active Directory object called the service connection point (SCP) to retrieve a list of AutoDiscover URLs for the forest in which Exchange is installed. When you install Exchange 2013, you need to update the SCP object to point to the Exchange 2013 server. This is necessary because Exchange 2013 servers provide additional AutoDiscover information to clients to improve the discovery process.

You must update the SCP object configuration on every Exchange server in the organization. You need to use the version of the Exchange Management Shell that corresponds to the version of the Exchange servers you’re updating.

Perform the following steps to configure the SCP object on your Exchange 2010 servers.

  1. Open the Exchange Management Shell on your Exchange 2010 Client Access server.
  2. Store the AutoDiscover host name of your Exchange 2013 Client Access server in a variable that will be used in the next step. For example, autodiscover.superplaneteers.com.

$AutodiscoverHostName = “autodiscover.superplaneteers.com”

Run the following command to set the SCP object on every Exchange 2010 server to the AutoDiscover URL of the new Exchange 2013 server.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 14*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Set-ClientAccessServer -AutoDiscoverServiceInternalUri https://$AutodiscoverHostName/Autodiscover/Autodiscover.xml

Perform the following steps to configure the SCP object on your Exchange 2013 servers.

  1. Open the Exchange Management Shell on your Exchange 2013 Client Access server.
  2. Store the AutoDiscover host name of your Exchange 2013 Client Access server in a variable that will be used in the next step. For example, autodiscover.superplaneteers.com.

$AutodiscoverHostName = “autodiscover.superplaneteers.com”

Run the following command to set the SCP object on every Exchange 2013 server to the AutoDiscover URL of the new Exchange 2013 server.

Get-ExchangeServer | Where {($_.AdminDisplayVersion -Like “Version 15*”) -And ($_.ServerRole -Like “*ClientAccess*”)} | Set-ClientAccessServer -AutoDiscoverServiceInternalUri https://$AutodiscoverHostName/Autodiscover/Autodiscover.xml

Configure Exchange 2013 Mail flow

Receive connectors

There are four receive connectors in Exchange 2013. They are:

· Default <server name>   Accepts connections from Mailbox servers running the Transport service and from Edge servers.

· Client Proxy <server name>   Accepts connections from front-end servers. Typically, messages are sent to a front-end server over SMTP.

· Default FrontEnd <server name>   Accepts connections from SMTP senders over port 25. This is the common messaging entry point into your organization.

· Outbound Proxy Frontend <server name>   Accepts messages from a Send Connector on a back-end server, with front-end proxy enabled.

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server. Click Mail flow, Click Receive Connector

2. Select Default Frontend AUPERMBX01, Click on Edit or Pencil icon, On the Security Parameter, Select Anonymous, Click Save.

3. Repeat the steps for Default Frontend AUPERMBX02.

Send connector:

All you have to do is to add Exchange 2013 mailbox servers to the existing send connector as shown below:

Open Exchange management Shell as an administrator, execute the following command.

Set-SendConnector –Identity Outbound –SourceTransportServers AUPEREXMBX01, AUPEREXMBX02

OR

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server. Click Mail flow, Click Send Connector, Click Edit or Pencil icon

2. Click on scoping and + icon on Source Server parameter to add the server

3. Select the Exchange 2013 Mailbox servers (AUPEREXMBX01 and AUPEREXMBX02) and add them and Click save.

4. Send connector configuration completed.

Configure a smart host if necessary

1. In the EAC https://AUPEREXCAS01/ecp?ExchClientVer=15, navigate to Mail flow > Send connectors, and then click Add .

2. In the New send connector wizard, specify a name for the send connector and then select Custom for the Type. You typically choose this selection when you want to route messages to computers not running Microsoft Exchange Server 2013. Click Next.

3. Choose Route mail through smart hosts, and then click Add . In the Add smart host window, the fully qualified domain name (FQDN), such as relay.sjc.mx.trendmicro.com. Click Save.

4. Under Address space, click Add . In the Add domain window, make sure SMTP is listed as the Type. For Fully Qualified Domain Name (FQDN), enter * to specify that this send connector applies to messages sent to any domain. Click Save.

5. For Source server, click Add . In the Select a server window, choose a server and click Add . Click OK.

6. Click Finish.

Anonymous Relay

Create a new receive connector using Exchange Administration Center with the following parameters.

  • Name: Anonymous Relay
  • Role: Frontend Transport
  • Type: Custom
  • Available IP: Exchange 2013 server IP
  • Port: 25
  • Security: Anonymous
  • Authentication: TLS, Externally Secured
  • Permission: Exchange Servers, Anonymous users

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server. Click Mail flow, Click Receive Connector, Click Add or + icon

2. Select an Exchange Mailbox Server name AUPEREXMBX01, Type Anonymous Relay on the name, Click Frontend transport, Select Custom, Click Next..

3. On the Network Adapter Binding, Add Exchange 2013 MBX Server IP (10.10.10.11) and port 25. On the remote network settings, add printer, scanner, device and application server IPs. Click Save to create Anonymous Relay.

4. Select newly created Anonymous relay, Click Edit or Pencil Icon, Click Security parameter, Select TLS, Externally Secured in Authentication and Select Exchange Servers, Anonymous users in Permission groups.

5. Open Exchange 2013 Management Shell and execute the following

Get-ReceiveConnector “Anonymous Relay” | Add-ADPermission -User “NT AUTHORITYANONYMOUS LOGON” -ExtendedRights “Ms-Exch-SMTP-Accept-Any-Recipient”

6. Open Exchange management Shell in Exchange 2010 execute cmdlet

Get-ReceiveConnector –Identity “Anonymous relay” | Fl

From PowerShell Windows copy all the IP addresses of printer and scanner to a notepad

7. Edit Anonymous Relay in Exchange 2013 Administration center and add all the IPs addresses you copied in previous step into remote network setting of Exchange 2013 relay.

8. Repeat step 1 to step 7 on all mailbox servers.

Configure Public Name Space

At this stage, you are ready to configure public DNS record. Update your public DNS record including Hosted Email Security. You only need to configure public DNS if you are changing public IPs and hosted email security otherwise you just have to change the port 443 and port 25 forwarding rule in internal Cisco router in your organization.

You public DNS must look similar to this table.

superplaneteers.com MX Mail.superplaneteers.com
mail.superplaneteers.com A 203.17.x.x (Public IP)
autodiscover.superplaneteers.com A 203.17.x.x (Public IP)

Request your ISP who provided you 203.17.x.x public IP to create reverse DNS record for mail.superplaneteers.com. This is very important for Exchange to function correctly. When you send email to a destination, many destination server checks reverse DNS. If reverse DNS is wrong you could be banned from sending email to destination server. Note that outlook.com check reverse DNS and SPF records of domain sending email to an outlook address.

Configure TMG/UAG

If you are publishing internet facing Exchange 2013 CAS using TMG or UAG, follow the URL below and publish Outlook Web App and Active Sync.

Publish-exchange-server-2010-using-forefront-uag-2010-step-by-step/

Publish-outlook-web-access-and-exchange-servers-using-forefront-tmg-2010/

Create internal DNS Record

Create Host(A) record with reverse DNS in the forward lookup zone of forest superplaneteers.com. Internal DNS records must look similar to this table.

FQDN Record Type IP Address
Mail.superplaneteers.com A 10.10.10.16
Autodiscover.superplaneteers.com A 10.10.10.16

If you don’t have CAS NLB or load balancer then your internal host(A) record must point to Exchange 2013 CAS server.

Open PowerShell as an administrator, execute the following

Resove-Dnsname mail.superplaneteers.com

Nslookup mail.superplaneteers.com

Configure Offline Address Book

To create a new offline address book and set the same OAB on all mailbox databases at once, run the following command. The command example uses “Default Offline Address Book” for the name of the OAB.

Open Exchange Management Shell, execute the cmdlets

New-OfflineAddressBook -Name “Default Offline Address Book” -AddressLists “Default Global Address List”

Restart-Service MSExchangeMailboxAssistants

Wait a few minutes and check if the OAB files is created in C:Program FilesMicrosoftExchange ServerV15ClientAccessOAB<newGUID>

Try to access the new OAB in IE: https://mail.superplaneteers.com/oab/<newguid/oab.xml

Get-MailboxDatabase | Set-MailboxDatabase -OfflineAddressBook “Default Offline Address Book (Ex2013)”

To Change the generation server open Exchange 2010 Management Shell and run the following command:

Move-OfflineAddressBook –Identity “Default Offline Address Book” –Server AUPERCAS01,AUPERCAS02

Configure new transport rule in Exchange 2013 or Export transport rules from legacy Exchange.

Follow this reference if you are migrating from Exchange 2007

You cannot migrate transport rules from Exchange Server 2007 to Exchange Server 2013

The following cmdlet example exports all your Transport Rules to the XML file, ExportedRules.xml, in the “c:TransportRules” folder:

Export-TransportRuleCollection -FileName “c:TransportRulesExportedRules.xml”

The following example cmdlet imports your transport rule collection from the XML file ExportedRules.xml in the “C:TransportRules” folder

[Byte[]]$Data = Get-Content -Path “C:TransportRulesExportedRules.xml” -Encoding Byte -ReadCount 0 Import-TransportRuleCollection -FileData $Data

To create new Transport rule,

1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server.

  1. Enter your user name and password in Domainuser name and Password, and then click Sign in.
  2. Click Mail Flow, Click Rules, Click Add or + Icon, Type the Name of Rule, Select rule conditions, Click More Option.
  3. Select Date when you would like to activate the rule
  4. Click whether you would like to enforce the rule or test the rule
  5. Follow the wizard to finish the rule settings.

Move mailboxes to Exchange 2013

  1. Open the EAC by browsing to https://AUPEREXCAS01/ecp?ExchClientVer=15 of your Client Access server.
  2. Enter your user name and password in Domainuser name and Password, and then click Sign in.
  3. Go to Recipients > Migration, click Add and then select Move to a different database.
  4. Under Select the users that you want to move, click Add .
  5. In the Select Mailbox window, select the mailboxes you want to move, click Add and then OK.
  6. Verify that the mailboxes you want to move are listed and then click Next.
  7. Specify a name for the new mailbox move and verify that Move the primary mailbox and the archive mailbox if one exists is selected.
  8. Under Target database, click Browse.
  9. In the Select Mailbox Database window, select a mailbox database on the Exchange 2013 server that you want to move the mailboxes to, click Add and then OK.
  10. Verify that the mailbox database displayed in Target database is correct and then click Next.
  11. Decide which user should receive the mailbox move report once the move is complete. By default, the current user will receive the move report. If you want to change which user receives the report, click Browse and select a different user.
  12. Verify Automatically start the batch is selected.
  13. Decide whether you want to have mailbox moves automatically complete. During the finalization phase, the mailbox is unavailable for a short time. If you choose to complete the mailbox move manually, you can decide when the move is finalized. For example, you might want to finalize the move during off-work hours. Select or clear Automatically complete the migration batch.

14. Click Finish.

OR

Open Exchange Management Shell

Get-Mailbox –Database “Exchange 2010 database name’ | New-MoveRequest –targetdatabase “Exchange 2013 database name”

Get-MoveRequest

Migrate Room or Resource mailboxes

Open EMS and execute the cmdlets

Get-Mailbox -RecipientTypeDetails roommailbox -database SOURCEDBNAME | new-moverequest -targetdatabase TARGETDBNAME

Upgrade Distribution groups

Open Exchange management Shell as an administrator, execute the following command.

Get-DistributionGroup -resultsize unlimited | Set-DistributionGroup –ManagedBy “CN=Organization

Management,OU=Microsoft Exchange Security Groups,DC=superplaneteers,DC=com”

Get-DistributionGroup -resultsize unlimited | Set-DistributionGroup –ForceUpgrade

Upgrading Distribution Groups with multiple owners to Exchange 2013

Open Exchange management Shell as an administrator, execute the following command.

foreach ($DL in (Get-DistributionGroup -ResultSize Unlimited)) { $owners = Get-ADPermission $DL.identity | ?{$_.User -notlike “*Exchange*” -and $_.User -notlike “S-*” -and $_.User -notlike “*Organization*” -and $_.User -notlike “NT*” -and $_.User -notlike “*Domain Admins*” -and $_.User -notlike “*Enterprise Admins” -and $_.User -notlike “BUILTIN*” -and $_.User –notlike “*Delegated Setup*”}  | %{$_.user.tostring()};Set-DistributionGroup $DL -BypassSecurityGroupManagerCheck -ManagedBy $owners }

Reference http://blogs.technet.com/b/microsoft_exchange_tips/archive/2013/11/07/upgrading-distribution-groups-with-multiple-owners-to-exchange-2013.aspx

Migrate Public Folder

In Exchange 2013, public folders were re-engineered using mailbox infrastructure to take advantage of the existing high availability and storage technologies of the mailbox database. Public folder architecture uses specially designed mailboxes to store both the public folder hierarchy and the content. This also means that there’s no longer a public folder database. High availability for the public folder mailboxes is provided by a database availability group (DAG).

There are two types of public folder mailboxes: the primary hierarchy mailbox and secondary hierarchy mailboxes. Both types of mailboxes can contain content:

  • Primary hierarchy mailbox   The primary hierarchy mailbox is the one writable copy of the public folder hierarchy. The public folder hierarchy is copied to all other public folder mailboxes, but these will be read-only copies.
  • Secondary hierarchy mailboxes   Secondary hierarchy mailboxes contain public folder content as well and a read-only copy of the public folder hierarchy.

There are two ways you can manage public folder mailboxes:

  • In the Exchange admin center (EAC), navigate to Public folders > Public folder mailboxes.

Before you migrate public folder, I would recommend creating new separate mailbox database in Exchange 2013 then start the migration process.

Step1: Perform Perquisites
Download all four of the Microsoft Exchange 2013 public folder migration scripts and save the script in C:PFScripts
Prerequisites in Exchange 2010 Server
Open Exchange Management Shell in Exchange 2010 server, run the following cmdlets one by one.
Run the following command to take a snapshot of the original source folder structure.
Get-PublicFolder -Recurse | Export-CliXML C:PFMigrationLegacy_PFStructure.xml

Run the following command to take a snapshot of public folder statistics such as item count, size, and owner
Get-PublicFolderStatistics | Export-CliXML C:PFMigrationLegacy_PFStatistics.xml

Run the following command to take a snapshot of the permissions.
Get-PublicFolder -Recurse | Get-PublicFolderClientPermission | Select-Object Identity,User -ExpandProperty AccessRights | Export-CliXML C:PFMigrationLegacy_PFPerms.xml

Save the information from the preceding commands for comparison at the end of the migration.
In Exchange 2010, to locate public folders that have a backslash in the name, run the following command:
Get-PublicFolderStatistics -ResultSize Unlimited | Where {$_.Name -like “**”} | Format-List Name, Identity

In Exchange 2007, to locate public folders that have a backslash in the name, run the following command:
Get-PublicFolderDatabase | ForEach {Get-PublicFolderStatistics -Server $_.Server | Where {$_.Name -like “**”}}

If any public folders are returned, you can rename them by running the following command:
Set-PublicFolder -Identity <public folder identity> -Name <new public folder name>

Make sure there isn’t a previous record of a successful migration. If there is, you’ll need to set that value to $false. If the value is set to $true the migration request will fail.
The following example checks the public folder migration status.
Get-OrganizationConfig | Format-List PublicFoldersLockedforMigration, PublicFolderMigrationComplete

Set-OrganizationConfig -PublicFoldersLockedforMigration:$false -PublicFolderMigrationComplete:$false

Prerequisites on Exchange 2013
Make sure there are no existing public folder migration requests. If there are, clear them.
Get-PublicFolderMigrationRequest | Remove-PublicFolderMigrationRequest -Confirm:$false

To make sure there are no existing public folders on the Exchange 2013 servers, run the following commands.
Get-Mailbox -PublicFolder
Get-PublicFolder

If the above commands return any public folders, use the following commands to remove the public folders.
Get-MailPublicFolder | where $_.EntryId -ne $null | Disable-MailPublicFolder -Confirm:$false
Get-PublicFolder -GetChildren | Remove-PublicFolder -Recurse -Confirm:$false
Get-Mailbox -PublicFolder |Remove-Mailbox -PublicFolder -Confirm:$false

Step2: Generate CSV Files
On the Exchange 2010 server, run the Export-PublicFolderStatistics.ps1 script to create the folder name-to-folder size mapping file.
.Export-PublicFolderStatistics.ps1 <Folder to size map path> <FQDN of source server>

Run the PublicFolderToMailboxMapGenerator.ps1 script to create the public folder-to-mailbox mapping file. This file is used to create the correct number of public folder mailboxes on the Exchange 2013 Mailbox server.
.PublicFolderToMailboxMapGenerator.ps1 <Maximum mailbox size in bytes> <Folder to size map path> <Folder to mailbox map path>

<Folder to size map path> is  \AUPEREX2010c$PFstat.csv
<Maximum mailbox size in bytes> is 20000000
<Folder to mailbox map path> is \AUPEREX2010c$PFMigrationmapgen.csv

Step3: Create public folder mailboxes on Exchange 2013
Run the following command to create the first public folder mailbox on the Exchange 2013 Mailbox server.
New-Mailbox -PublicFolder <Name> -HoldForMigration:$true –database “Exchange 2013 database”

Run the following command to create additional public folder mailboxes as needed based on the .csv file generated from the PublicFoldertoMailboxMapGenerator.ps1 script.

$numberOfMailboxes = 25;
for($index =1 ; $index -le $numberOfMailboxes ; $index++)
{
$PFMailboxName = “Mailbox”+$index;  if($index -eq 1) {New-Mailbox -PublicFolder $PFMailboxName -HoldForMigration:$true -IsExcludedFromServingHiearchy:$true;}else{NewMailbox-PublicFolder $PFMailboxName -IsExcludedFromServingHierarchy:$true}
}

Step4: Start Migration request

Legacy system public folders such as OWAScratchPad and the schema-root folder subtree in Exchange 2007 won’t be recognized by Exchange 2013 and will be treated as bad items. This will cause the migration to fail. As part of the migration request, you must specify a value for the BadItemLimit parameter.

From the Exchange 2013 Mailbox server, run the following command:

$PublicFolderDatabasesInOrg = @(Get-PublicFolderDatabase)
$BadItemLimitCount = 5 + ($PublicFolderDatabasesInOrg.Count -1)
New-PublicFolderMigrationRequest -SourceDatabase (Get-PublicFolderDatabase -Server <Source server name>) -CSVData (Get-Content <Folder to mailbox map path> -Encoding Byte) -BadItemLimit $BadItemLimitCount

To verify that the migration started successfully, run the following command.
Get-PublicFolderMigrationRequest | Get-PublicFolderMigrationRequestStatistics -IncludeReport | Format-List

Step 5: Lock Source Server
On the Exchange 2010 server, run the following command to lock the legacy public folders for finalization.

Set-OrganizationConfig -PublicFoldersLockedForMigration:$true

Step6: Finalize public folder migration
Set-PublicFolderMigrationRequest -Identity PublicFolderMigration -PreventCompletion:$false
Resume-PublicFolderMigrationRequest -Identity PublicFolderMigration

Step7: Test Public Folder Migration
Run the following command to assign some test mailboxes to use any newly migrated public folder mailbox as the default public folder mailbox
Set-Mailbox -Identity <Test User> -DefaultPublicFolderMailbox <Public Folder Mailbox Identity>

Log on to Outlook 2007 or later with the test user identified in the previous step, and then perform the following public folder tests:

Post Migration Check

1. Verify Internal and external DNS records and aliases of autodiscover and mail are pointing to Exchange 2013 CAS server or load balancer VIP or CAS NLB IP. At this stage do not delete Host(A) record of legacy exchange servers until you decommission them.

2. Point your Spam Guard or hosted email security to forward all the emails to exchange 2013 to receive incoming mail via Exchange 2013.

3. Configure Spam Guard or hosted email security to accept emails from all Exchange 2013 Mailbox servers.

4. Configure smart host if necessary.

5. Configure all other application to send email via the Exchange 2013 Mailbox Servers

6. Test inbound and outbound email from outlook client and mobile devices.

7. Start Monitoring Exchange, Open EMS and execute Get-mailbox –monitoring

8. Go to https://testconnectivity.microsoft.com/ to test connectivity of Exchange 2013

9. Go to http://mxtoolbox.com/ to test your MX, Reverse DNS and DNS records.

Decommission Legacy Exchange Server

Before you decommission legacy Exchange server, make sure you have completed the following tasks

  1. Make sure public and internal DNS, MX and CNAME are correct.
  2. Move all user mailboxes to Exchange 2013.
  3. Move all room mailboxes to Exchange 2013.
  4. Move all public folders to Exchange 2013
  5. Move all arbitration mailboxes to Exchange 2013.
  6. Move all Discovery Search mailboxes to Exchange 2013
  7. Add all Exchange 2013 mailbox servers in all the send connectors and remove the Exchange 2007/2010 servers from Send Connector.
  8. Create new anonymous relay receive connectors in Exchange 2013 and all IPs in remote network settings properties of relay
  9. Ensure you have configured Autodiscover correctly at AutoDiscoverServiceInternalUri properties if all CAS 2013. Issue Get-ClientAccessServer | fl cmdlet to view internal url of autodiscover.

10. Remove Exchange 2010 CAS arrays. Execute Get-clientaccessarray | remove-ClientAccessArray in Exchange 2010 management shell

11. Point all the applications to use Exchange 2013 SMTP.

12. Test inbound and outbound email from various supported clients.

Now is the time to shutdown legacy exchange servers in your organization and test Exchange 2013 mail flow again. Make sure you shut down the server during working hours and working days. Keep the legacy exchange down for at least 48hrs. To decommission legacy Exchange follow the steps

1. Bring all legacy servers online means power on all servers which were down in previous step.

2. Remove all Public Folder replicas else Public Folder Database will not be removed. To remove public folder replicas, open Exchange Management Console in exchange 2010, Click Tools, Open Public Folder Management Console, Select Default Public Folder, Click properties, Click Replication, Remove exchange 2010 database from replication. Repeat the same for systems public folder.

3. Remove Exchange 2007/2010 mailbox database and Public folder databases from EMC or EMS.

4. Go to Control Panel to remove Exchange 2007/2010. On Program and Features screen click on Uninstall. On the Maintenance Mode page of the Exchange Server 2007/2010 Setup wizard begins the process of removing your Exchange installation. Click Next to continue.    

5. On the Server Role Selection page, uncheck in 2007/2010 all Exchange server roles and Exchange management tools to remove. In Exchange 2007 CCR remove passive node first then follow the same steps on active node. Click next to continue.

6. On the Readiness Checks page, view the status to determine if the organization and server role prerequisite checks completed successfully. If the prerequisites check doesn’t complete successfully, review the Summary page and fix any issues that are preventing Setup from removing exchange 2007/2010. If the checks have completed successfully, click Uninstall to remove the entire installation of Exchange 2007/2010.

7. On the Completion page, click Finish.

8. Verify the setup log files and folder located at c:ExchangeSetupLogs.

9. Uninstall Internet Information Services (IIS) from windows Server 2008 or add/remove program and features in Windows Server 2003.

10. Disjoin the legacy Exchange servers from the Domain.

11. Delete Host(A) DNS record of Legacy Exchange Server. Delete ONLY legacy DNS record.

References

http://technet.microsoft.com/en-us/library/ee332361(EXCHG.141).aspx

http://technet.microsoft.com/en-us/library/bb123893(EXCHG.80).aspx

http://technet.microsoft.com/en-US/exdeploy2013/Checklist?state=2284-W-CABEAgAAQAAACQEAAQAAAA~~

http://support.microsoft.com/kb/2846555

http://support.microsoft.com/?kbid=940726

http://www.petenetlive.com/KB/Article/0000036.htm

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-1-step-by-step-exchange-2007-to-2013-migration.aspx

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-2-step-by-step-exchange-2007-to-2013-migration.aspx

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-3-step-by-step-exchange-2007-to-2013-migration.aspx

http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-4-step-by-step-exchange-2007-to-2013-migration.aspx

http://www.expta.com/2013/05/owa-2013-cu1-redirection-is-broken-for.html

TrendMicro Worry-Free Business Advanced Configuration Step by Step

Trend Micro Worry-Free Business Security (WFBS) protects business users and assets from data theft, identity theft, risky websites, and spam (Advanced only).

Trend Micro offers the following editions:

Standard: Designed to protect clients (desktops, portable computers, and servers) on your local network. This edition includes Outbreak Defence, Firewall, and Antivirus/Anti-spyware scanning. It also comes with technical support, malware/virus pattern file downloads, real-time scanning, and program updates for one year.

Advanced: Designed to protect clients and Microsoft Exchange servers on your network. In addition to all the features in Worry-Free Business Security Standard, this edition includes Anti-spam, Content Filtering, Data Loss Prevention, and Attachment Blocking.

Features worry-free business Features

  • Component Updates
  • Device Control
  • Antivirus/Anti-spyware
  • Firewall
  • Web Reputation
  • URL Filtering
  • Behavior Monitoring
  • User Tools
  • Instant Messaging Content
  • Filtering
  • Mail Scan (POP3)
  • Mail Scan (IMAP)
  • Anti-Spam (IMAP)
  • Email Message Content
  • Filtering
  • Email Message Data Loss Prevention
  • Attachment Blocking

TrendMicro Components:

Registration Key

A Registration Key comes with your purchase of Worry-Free Business Security. It has

22 characters (including hyphens) and is in the following format: xx-xxxx-xxxxx-xxxxx-xxxxx

Use a fully licensed Registration Key to register Worry-Free Business Security on the Trend Micro website at http://olr.trendmicro.com.

Security Server

At the center of Worry-Free Business Security is the Security Server. The Security Server hosts the web console, the centralized web-based management console for Worry-Free Business Security. Hosts the Web Console, downloads updates from the Trend Micro ActiveUpdate Server, collects and stores logs, and helps control virus/malware Outbreaks Manages all agents from a single location

Scan Server

The Security Server includes a service called Scan Server, which is automatically installed during Security Server installation. As such, there is no need to install it separately. The Scan Server runs under the process name iCRCService.exe and appears as Trend Micro Smart Scan Service from Microsoft Management Console.

Downloads scanning-specific components from Trend Micro and uses them to scan clients

Agents

Agents protect clients from security threats. Clients include desktops, servers, and Microsoft Exchange servers.

Security Agent Protects desktops and servers from security threats and intrusions Protects Windows 7/Vista/XP/Server 2003/Server 2008 computers from malware/viruses, spyware/grayware, Trojans, and other threats

Messaging Security Agent Protects Microsoft Exchange servers from email-borne security Threats

Web Console

The web console is the central point for monitoring clients throughout the corporate network. It comes with a set of default settings and values that you can configure based on your security requirements and specifications. The web console uses standard Internet technologies, such as Java, CGI, HTML, and HTTP.

WFBS Ports

WFBS uses the following ports:

Server listening port (HTTP port): Used to access the Security Server. By default, WFBS uses one of the following:

IIS server default website: The same port number as your HTTP server’s TCP port.

IIS server virtual website: 8059

Apache server: 8059

Client listening port: A randomly generated port number through which the Security Agent and Messaging Security Agent receive commands from the Security Server.

Trend Micro Security (for Mac) Communication port: Used by the Trend Micro Security (for Mac) server to communicate with Mac clients. The default is port 61617.

SMTP port: Used by the Security Server to send reports and notifications to administrators through email. The default is port 25.

Proxy port: Used for connections through a proxy server.

Systems requirements:

  • 1 vCPU, 2GB RAM, 10GB additional space
  • IIS 7.5 Windows Server 2008 R2
  • Internet Explorer
  • Adobe Acrobat
  • Java client
  • Clients that use Smart Scan must be in online mode. Offline clients cannot use Smart Scan
  • Administrator or Domain Administrator access on the computer hosting the
  • Security Server
  • File and printer sharing for Microsoft Networks installed
  • Transmission Control Protocol/Internet Protocol (TCP/IP) support installed
  • If Microsoft ISA Server or a proxy product is installed on the network, you need to open the HTTP port (8059 by default) and the SSL port (4343 by default) to allow access to the Web Console and to enable client-server communications

TrendMicro Download Location:

WFB 8.0

Download Center

Installation:

1. Double-click the SETUP.EXE file. The Trend Micro Installation screen appears.

2. Click Next. The License Agreement screen appears.

3. Read the license agreement. If you agree with the terms, select I accept the terms of the license agreement.

4. Click Next. The Setup Type screen appears.

5. From the Setup Type page, choose one of the following options:

  • Typical install (Recommended) – This provides an easy solution for installing WFBS using Trend Micro default values. This method is suitable for a small business using a single Trend Micro Security Server and up to ten clients.
  • Minimal Install
  • Custom install – This provides flexibility in implementing your network security strategy. This method is suitable if you have many computers and servers or multiple Exchange servers.

6. Click Next. The Product Activation page appears Note: If you do not have an Activation Code, you may not have registered your copy of WFBS yet. Click Register Online to open a new browser window.

7. Click Next. The Setup Overview page appears. The Setup Overview page shows the components that you need configure in order to install the Trend Micro Security Server and the Security Agent (as well as the Messaging Security Agent [MSA] if you are using WFBS Advanced).

8. Click Next. If you selected Custom Installation, the Select Target Folder page would appear. The default WFBS install folder is C:Program FilesTrend MicroSecurity Server. If you want to install WFBS in another folder, click Browse.

9. Click Next. The Select Components page appears.

10. Select the components that you want to install. For WFBS Advanced only: The Configure Security Server page now highlights the Security Server.

  • Security Server (default): The Security Server hosts the centralized web-based management console.
  • Security Agent (default): The agent protects desktops and servers.
  • Messaging Security Agent (optional): When installing the Security Server on a computer that has a Microsoft Exchange server installed on the same computer, Setup prompts you to install a local MSA.
  • Remote Messaging Security Agent (optional):When installing the Security Server on a computer that cannot detect the existence of local Microsoft Exchange servers, Setup prompts you to install the remote MSA to remote servers.

11. Configure the Security Server. The Security Server configuration tasks consist of pre-scanning the server for malware as well as configuring the web server and the proxy server.

12. Click Next. The Computer Prescan page appears.

13. Choose whether or not to pre-scan your computer for threats by selecting one of the following options:

Prescan my computer for threats– The prescan targets the most vulnerable areas of the computer, which include the following:

  • the boot area and boot directory (for boot sector viruses)
  • the Windows folder
  • the Program Files folder
  • Do not prescan my computer for threats – Trend Micro highly recommends pre-scanning your computer for security threats to ensure that the installation goes into a clean environment. Not pre-scanning the computer could prevent a successful installation.

14. Click Next. If you selected Custom Installation, the Web Server page would appear. Select a web server to host the Security Server web console. Choose one of the following:

  • Internet Information Services (IIS) server
  • Apache Web server 2.0.xx

15. Click Next. The Web Server Identification page appears.

16. Choose from one of the following server identification options for client-server communication:

  • Server information – Choose domain name or IP address:
  • Fully Qualified Domain Name – Use the web server’s domain name to ensure successful client-server communications.
  • IP address – Verify that the target server’s IP address is correct.

17. Click Next. The Administrator Account Password page appears.

18. Specify different passwords for the Security Server web console and the Security Agent.

Note: The password field holds 1-24 characters and is case sensitive.

  • Security Server web console – You will need a password to log on the web console. Provide the password and confirm the password.
  • Security Agents – You will need the password to uninstall Security Agents and remove them from your computer.

19. Click Next. The SMTP Server and Notification Recipient(s) page appears.

20. Enter the required information:

  • SMTP server – the IP address of your email server
  • Port – the port that the SMTP server uses for communications
  • Recipient(s) – the email address(es) that the SMTP server uses to send alert notifications. You can enter multiple email addresses when more than one person needs to receive notifications.

21. Click Next. The Trend Micro Smart Protection Network page appears.

22. Choose whether or not you want to participate in the Trend Micro Smart Protection Network feedback program.

23. Click Next. If you selected Custom Installation, the General Proxy Settings page would appear. The Configuring Security Agent page highlights the Security Agent.

  • Proxy server type
  • Server name or IP address
  • Port
  • User name and Password – Provide these only if the proxy server requires authentication.

24. Configure the Security Agent. The Security Agent configuration tasks consist of setting the agent installation path, configuring the agent’s server and desktop settings as well as the proxy server settings for additional services.

25. Click Next. If you selected Custom Installation, the Security Agent Installation Path page would appear.

26. Set the following items:

  • Installation Path – This is the destination folder where the Security Agent files are installed.
  • Security Agent Listening Port – This is the port number used for Security Agent and Security Server communications.

27. Click Next. If you selected Custom Installation, the Configuring Security Agents Settings page would appear.

28. You can configure Security Agent settings for Servers and Desktops: In each group, you can configure the following components:

  • Servers – Windows Server 2003/2008 computers will be added to the default Servers group when you first add them to the web console. You can enable different technologies for this group based on your particular needs.
  • Desktops – Windows XP/Vista/7 computers will be added to the default Desktops group when you first add them to the web console. You can enable different technologies for this group based on your particular needs.
  • Smart Scan – Smart Scan uses a central scan server on the network to take some of the burden of the scanning of clients.
  • Antivirus and Anti-Spyware – This scans files for malicious code as they are accessed or created.
  • Firewall – This protects clients against malware attacks and network viruses by creating a barrier between the clients and the network.
  • Web Reputation – This blocks malicious websites through the credibility of web domains and assigning a reputation score based on several identifying factors.
  • URL Filtering – This blocks specified categories of websites (for example, pornographic sites and social networking) according to your company’s policy.
  • Behavior Monitoring – This analyses program behaviour to proactively detect known and unknown threats.
  • Device Control – This regulates access to external storage devices and network resources.

29. Click Next. If you selected Custom Installation, the Proxy Setting for Additional Services page would appear. The Smart Scan, Web Reputation, and Behaviour Monitoring services use the proxy server address and port used by Internet Explorer on client computers. If that proxy server requires authentication, use this page to specify logon credentials.

30. For WFBS Advanced only: Configure the MSA. You will be prompted to install the MSA at one of the following points: Note: This procedure applies to both local and remote MSA installation.

  • When installing the Security Server on a computer that has Microsoft Exchange server installed on the same computer, Setup prompts you to install a local Messaging Security Agent.
  • When installing the Security Server on a computer that cannot detect the existence of local Microsoft Exchange servers, Setup prompts you to install the remote Messaging Security Agent to remote servers.

31. Click Next. The Install Messaging Security Agent page appears.

32. Provide the following information:

i. Exchange Server

ii. Domain Administrator Account

iii. Password

33. Click Next. If you selected Custom Installation, the Messaging Security Agent Settings page would appear. Configure the following:

  • Target Folder – This is the folder where the MSA files are installed.
  • Temp Folder – This is the system root folder for MSA Agent installation.
  • Spam management
  • End User Quarantine – If selected, WFBS creates a separate spam folder on Microsoft Outlook in addition to the Junk E-mail folder.
  • Outlook Junk Email folder – If selected, WFBS stores spam mail into this folder. Since Outlook typically moves spam mail in the End User Quarantine (EUQ) folder to the Junk E-mail folder, Trend Micro recommends to select this option.

35. Proceed with the installation process. The Start Copying Files page shows a summary of all the parameters that will be used during the installation of WFBS. Do one of the following:

    • If you wish to verify previous installation settings, click Back.
    • Click Next to proceed with the actual installation.

The Install Third Party Components page appears. This page informs you which third party components will be installed.

36. Click Next to start installing the selected components. The entire installation process may take some time to complete. During the installation, a status page will show the progress being made. When the Setup Wizard Complete screen appears, click Finish.

Installing the Client/Server Security Agent (CSA) or Security Agent (SA) using Remote Install

  1. Log on to the WFBS console.
  2. Click Security Settings > Add. The Add Computer page appears.
  3. Under Computer Type section, choose Desktop or server.
  4. Under Method section, choose Remote install.
  5. Click Next. The Remote Install page appears.
  6. From the Groups and Computers list, select the computer on which you will install the CSA and click Add. A prompt for a username and password appears. Note: You need an account with administrator rights for the installation.
  7. Type the username and password of an account with administrator rights, and click Login. For the domain computers, use the Domain_NameUsername format; for workgroup computers, use the Target_Computer_NameLocal_Administrator_User_Name format.
    The computer is added to the Selected Computers list.
  8. Repeat Steps 6-7 if you want to add more computers to the list.
  9. Click Install, and then click Yes when the confirmation window shows up. A progress screen will show the installation status, and the computer names will have a green check mark when the installation is complete.

Installing Agent for Exchange Server

The Messaging Security Agent (MSA) can also be installed from the Web Console.

1. Log on to the Web Console.

2. Click the Security Settings tab, and then click the Add button.

3. Under the Computer Type section, click Microsoft Exchange server.

4. Under Microsoft Exchange Server Information, type the following information:

Server name: The name of the Microsoft Exchange server to which you want

to install MSA.

Account: The built-in domain administrator user name.

Password: The built-in domain administrator password.

5. Click Next. The Microsoft Exchange Server Settings screen appears.

6. Under Web Server Type, select the type of Web server that you want to install on

the Microsoft Exchange server. You can select either IIS Server or Apache Server.

7. For the Spam Management Type, End User Quarantine will be used.

8. Under Directories, change or accept the default target and shared directories for

the MSA installation. The default target and shared directories are C:Program

FilesTrend MicroMessaging Security Agent and C$, respectively.

9. Click Next. The Microsoft Exchange Server Settings screen appears again.

10. Verify that the Microsoft Exchange server settings that you specified in the

previous screens are correct, and then click Next to start the MSA installation.

11. To view the status of the MSA installation, click the Live Status tab.

Configure Smart Host for Outbound Email

1. Open the Exchange Management Console.

2. Click on the plus sign (+) next to Organization Configuration.

3. Select Hub Transport and click the Send Connectors tab.

4. Right-click the existing Send Connector then select Properties and go to the Network tab.

5. Select Route mail through the following smart hosts and click Add.

6. Select Fully Qualified Domain Name (FQDN)and specify the HES relay servers:

o HES US / Other Regions Relay Record: relay.sjc.mx.trendmicro.com

o HES Europe, Middle East, and Africa (EMEA) Relay Record: relay.mx.trendmicro.eu

7. Click OK.

8. Go to the Address Space tab and click Add.

9. Add an asterisk (*) and then click OK.

10. Click Apply > OK.

11. Go to the Source Server tab and add your Exchange Server.

12. Click Apply > OK.

Before you begin next step, make sure you have a valid public DNS and MX record configured and available via ping or nslookup. To find Out MX Record, follow the step or contact your ISP.

C:Usersraihan >nslookup

> set type=mx

> domainname.com.au

Non-authoritative answer:

domainanme.com.au MX preference = 20, mail exchanger = mx1.domainname.net.au

domainanem.com.au MX preference = 10, mail exchanger = mail.domainname.com.au

mx1.domainname.net.au internet address = 203.161.x.x

mail.domainname.com.au internet address = 116.212.x.x

Pinging domainname.com.au [203.161.x.x] with 32 bytes of data:

Registered Hosted Email Security

Firstly you’ll need to have registered with Trend Micro Online https://olr.trendmicro.com/registration/ .

Create service account (See upcoming post on creating a secure services account)

  1. Open ActiveDirectory Users and Computers
  2. Create a user sa-TrendMicroHE with password never expires

Open Hosted Email Security Web console

Register Your Domains with Trend Micro

1. Go to the Trend Micro Online Registration portal.

2. Create a new OLR account.

a. Under the “Not registered” section, select your country and language from the dropdown list, then click Continue.

clip_image002

Enter your HES Registration Key.

clip_image004

If you have other Trend Micro products or services you want to register, enter their Registration Keys and click Continue. Otherwise, click No. The License Terms page appears.

Select I Accept, then click Submit.

Complete the registration information form.

clip_image006

Specify your OLR logon ID.

clip_image008

Note: The OLR logon ID will also serve as your HES portal login ID.

Click Submit.

The next page will show your HES Activation Code (AC). This means that you have successfully registered HES. You will receive an email copy containing your Activation Code, username and temporary password.

3. Using the provided OLR username and password, log on to the HES console:

For US: https://us.emailsec.trendmicro.com/loginPage.imss

For EMEA: https://emailsec.trendmicro.eu/loginPage.imss

Note: Make sure that the Log on with Trend Micro Online Registration user name and password checkbox is ticked.

4. Enter your domain and IP information, then click Add Domain.

clip_image010

5. Once your managed domain list is complete, tick the checkbox beside your managed domain and click Submit.

6. Wait for your confirmation email. This will take 48 hours at most. The confirmation email will guide you through the final steps needed before starting the service.

clip_image012

Navigate to Administration > Domain Management

  1. All the fields are pretty much self-explanatory, except for Seats assigned: 1 (no need to use more)
  2. Click Activate Domain
  3. Now this you would think would be it, except it goes to the list below which you then need to check the tick box of the domain and then Click Check MX Record

Download the ActiveDirectory Sync Client

  1. Navigate to Administration > Directory Management

clip_image014

  1. Click Imported User Directories so it becomes Enabled with a green tick
  2. Navigate to Administration > Web Services

clip_image016

  1. Click on the Applications bar so it get’s a Green Tick as above
  2. Click on Generate Service Authentication Key, copy this key for use later in the setup
  3. Click and download the ActiveDirectory Sync Client

Install the ActiveDirectory Sync Client

http://esupport.trendmicro.com.au/solution/en-us/1059663.aspx

http://esupport.trendmicro.com.au/solution/en-us/1060411.aspx

1. Extract the ActiveDirectory Sync Client file and run setup.exe

2. Usual I agree, next, next stuff

3. Then you’ll need your DOMAIN, the user will be the sa-TrendMicroHE we created earlier along with it’s password.

4. Click Next

5. Leave installation path as is, and change to install for Everyone

6. Click Next

7. Click Next

8. Click Close when finish

9. The ActiveDirectory Sync Client will then open

10. For the source paths you’ll need to enter the LDAP source paths for your server where users and groups are located to get you start some defaults are (don’t forget to change it to <yourdomain>)

LDAP://OU=Users,,OU=CompanyName,DC=<yourdomain>,DC=com

11. Click Add

LDAP://OU=Distribution Groups, OU=companyname,DC=<yourdomain>,DC=com

12. Click Add

13. Click Configure

  • Username: as per web login
  • Service Auth Key: as the key we copied earlier from the web console under Administration> Web Services
  • Proxy: leave as automatic unless your network requires otherwise
  • Synchronize: leave at 1

14. Click OK

15. Click Apply

16. This will restart the service

Amend ClientMHS_AD_ACL.config

1. Open C:Program Files (x86)Trend MicroHosted Email Security ActiveDirectory Sync ClientIMHS_AD_ACL.config in notepad

2. Installed Config file looks like this:

<?xml version=”1.0″ encoding=”utf-8″?>
<ad_acl>
<ldap_path name=”default”>
<objectClass name=”User”>
<displayNameAttr>displayName</displayNameAttr>
<emailAttr>mail</emailAttr>
<emailAttr>proxyAddresses</emailAttr>
</objectClass>
</ldap_path>
</ad_acl>

3. Change the following to add groups and public folders. Ref

<?xml version=”1.0″ encoding=”utf-8″?>

<ad_acl>

<ldap_path name=”default”>

<objectClass name=”User”>

<displayNameAttr>displayName</displayNameAttr>

<emailAttr>mail</emailAttr>

<emailAttr>proxyAddresses</emailAttr>

</objectClass>

</ldap_path>

<ldap_path name=”default”>

<objectClass name=”group”>

<displayNameAttr>displayName</displayNameAttr>

<emailAttr>mail</emailAttr>

<emailAttr>proxyAddresses</emailAttr>

</objectClass>

</ldap_path>

 

<ldap_path name=”default”>

<objectClass name=”publicFolder”>

<displayNameAttr>displayName</displayNameAttr>

<emailAttr>mail</emailAttr>

<emailAttr>proxyAddresses</emailAttr>

</objectClass>

</ldap_path>

 

<ldap_path name=”default”>

<objectClass name=”*”>

<displayNameAttr>displayName</displayNameAttr>

<emailAttr>mail</emailAttr>

<emailAttr>proxyAddresses</emailAttr>

</objectClass>

</ldap_path>

</ad_acl>

4. Save this (you’ll need to save to desktop then move it back over the original file, otherwise it will Access Denied) and return the the ActiveDirectory Sync Client

5. Click Sync Now

6. Give it a few moments then click History

7. Here you should see the correct number of groups and users you expect.  Check the times are correct for when you’ve pressed. And it should finish with Sync domain <yourdomain.com> successful

8. Click Close

9. Click Close

Post Configuration Check

  1. open the Hosted Email Security Console
  2. Navigate to Administration > Directory Management
  3. Click the Export to CSV for the domain you’re wanting to check
  4. This will generate a CSV file, which you can use notepad to check that all your email addresses have synced

Worry Free Business Files and Folder Exclusion

Worry-Free Business Best Practice