954NETWORK BLOG! » Windows Server

Microsoft Exchange Email Address Variables

digitalkid — Thu, 08 Oct 2009 13:40:31 +0000

From time to time it is necessary to apply an email address policy using a non-standard name for the user (e.g. instead of the users alias JOHN@DOMAIN.COM you need JSMITH@DOMAIN.COM). This can be accomplished across the entire organization by editing the Recipient Policies/email Address policies and using the following variables before (to the left of…) the @ symbol in the domain. Here are the variables and some examples:

%g = givenName (First Name)

%s = sn (surName or Last Name)

%d = Display Name

%m Exchange Alias (Usually default for email addresses).

Here are some examples of how to combine and use these variables to customize your Recipient Policy/Email Addresses.

%1g.%s@DOMAIN.COM — This will give you j.smith@DOMAIN.COM

%g%s@DOMAIN.COM — This will give you johnsmith@DOMAIN.COM

%g@DOMAIN.COM — This will give you john@DOMAIN.COM

I am sure there are more that I can think of but you get the idea.

Custom Attributes and Exchange 2007 Email Address Policies

digitalkid — Thu, 08 Oct 2009 13:38:08 +0000

There are a lot of useful things that can be accomplished using Custom Attributes in Exchange 2007. This Doc applies to Recipient Policies (email Address Policies) and applying email addresses to users based on their custom attributes. This is useful when you have multiple domain names that you need to receive mail for as well as multiple users that need to have their primary email address in a domain that is different from the default domain.

First, create an Accepted Domain by navigating to Organization Configuration > Hub Transport. Click “New Accepted Domain” in the Action Pane. Fill in all of the domain information as needed and continue below.

1. Create your Email address Policy: Open Exchange Management Console and navigate to Organization Configuration > Hub Transport and click the “Email Address Policies” Tab. In the Action Pane, click “New Email Address Policy”

2. When the new email address policy wizard starts, Give your Policy a name (Does not have to be the domain name but it is a good idea to use the domain name for ease of future understanding). Click Next.

3. On this page, choose the condition “Custom Attribute 1 Equals Value”. Below that (Step 2) click “Specified” and enter a value for the custom attribute (Once again, I use the domain name) click Add then OK. Click Next.

4. Add the email address. Click Add and choose the format you would like to use (Pretty self explanatory when looking at it). Also, select the accepted domain for email address that you created earlier for this domain. Click Next twice and you are done.

5. Now, to apply this policy based on custom attribute, choose the users that this policy will apply to and change their Custom Attribute value to match the one you created in step 3 above. Navigate to Organization Configuration > Recipient Configuration and edit each user to apply this policy to (On the general tab, choose custom attribute and enter your value).

That is it. All users with the specific Custom Attribute will have the email address that corresponds to that attribute in the Email Address Policy that you created. You can do this for as many domains as there are Custom Attribute Fields.

Send-As a Distribution Group Exchange 2007

digitalkid — Thu, 08 Oct 2009 13:18:23 +0000

I have had many requests over the past year from users that want to send as a distribution group as opposed to their primary account. This is useful when a user wants to send out something like an invoice from an email address such as accounting@domain.com. Fortunately, there is a way to easily grant a user or users permissions to send-as a distribution group using the Exchange Management Shell – Here is how:

1. Open the Exchange Management Shell as an Administrator.

2. Type in the following command, replacing GROUPNAME and USERNAME with the name of the distribution group that you want to grant the user(s) access to send as and the username(s) of the users that will be able to send-as this distribution group.

Add-ADPermission GROUPNAME -ExtendedRights Send-As -user USERNAME

Once you have entered that command for all of the users that will be sending as the distribution group, the user can now select the group in the FROM field of their Outlook client and send the message as that distribution group.

DigitalKid (jason)
www.954network.com

Schedule Hard Drive Defrag through Logon Script

digitalkid — Wed, 03 Jun 2009 19:57:34 +0000

Hello again,

Recently I had a need to schedule a monthly defrag on all of the client machines in one of the networks that I manage. As usual, finding an efficient way of centrally deploying such a task is much easier than going to each machine and manually creating the task. I accomplished this by editing the SBS_LOGIN_SCRIPT.bat that is present on all SBS 2003 servers by default. Of course, if you are not in an SBS environment, you can apply this to any other login scripts that you may already have or create a new one and deploy it through Group Policy.

For my purposes, I needed a defrag to run automatically monthly on all machines so I used an app called schtasks.exe that is already installed on all 2000/XP machines. You can read the syntax by typing “schtasks /?” at the command prompt. Below is the line I added to my login script.

schtasks.exe /create /SC MONTHLY /D 20 /TN DefragMonthly /TR “C:\Windows\System32\defrag.exe\”C: -f” /ST 00:45:00 /SD 06/01/2009 /RU SYSTEM

Now, let me explain that as it may look cryptic..

/create – Indicates you are creating a scheduled task.
/SC – Specifies the Schedule Frequency (MONTHLY in this case).
/D – The Day of the month is should run (the 20th of each month in this case).
/TN – The Task Name (MonthlyDefrag in this case).
/TR – Task Run specifies the task to be ran or the application to be executed (”C:\Windows\System32\defrag.exe\”C: -f” in this case ((defrag.exe /? for more info on this))).
/ST – Start Time is the Hour at which the task should start in 24 hour format.
/SD – The Start Date, pretty self explanatory.
/RU – The user to run the task as (SYSTEM in this case – Must be SYSTEM or and Administrator).

After adding the above line to the Login Script, a new scheduled task will be added to the machines that run the login script. You can then wait until after the schedule was set to be run and check if it ran.

That is it for now..

DigitalKid (Jason)
www.954network.com

Remove Dell Splash Screen/Wallpaper Terminal Server

digitalkid — Tue, 10 Mar 2009 19:25:34 +0000

As a Systems Administrator, procedures that take longer than they should is an extreme annoyance. That being said, I am sure that some of you out there are wondering the same thing that I was when dealing with Dell Servers and Terminal Services. How do you remove that annoying splashscreen/Wallpaper when logging into a Dell Server? Well my friends, it turns out that it is a simple registry hack – Below:

Navigate to HKEY_USERS\.DEFAULT\Control Panel\Desktop

You will see a number of values on the right, find the one labeled “Wallpaper”, Edit it and clear the contents of the value. Once complete, Log off and back on and see if the Wallpaper comes up again.

Jason (Digitalkid)
www.954network.com

Windows Server 2008 – Initial Thoughts

digitalkid — Mon, 08 Dec 2008 19:03:21 +0000

I recently had a client that decided to upgrade their enterprise from Small Business Server 2003 to Windows Server 2008 and Exchange 2007. After working with Windows Server 2003 (and SBS 2003) for so long, and only VERY briefly demoing 2008, I was excited to see what Server 2008 had to offer. After the initial install, I logged into the new OS. The first thing that I noticed is the similarity of the start menu and general GUI to Vista (Minus Aero). The start menu has all of the familiar Vista features such as the Instant Search and single level All Programs as well as The absence of My Computer (Now just Computer) and the presence of the Home directory style file structure. I like this new format in Vista and it is a bonus in server 2008 over the somewhat clunky Administrator Environment of 2003.

Another item that stood out prominently was the new Server Manager interface, which now features a lot more options and control over the servers roles and management tasks. It is basically an MMC Snap in with the most common tasks bundled in one convenient interface that starts at log-in. It includes Roles, Features, Diagnostics, Configuration and Storage management by Default and displays a server summary upon opening which is much more convenient than previous 2003 versions.

Also changed is the ACL Interface when setting files and sharing permissions on NTFS directories. There is now an added step to setting the permissions which was not there before. Basically, upon displaying the properties of a file, directory or share, you can view what permissions are in place but have to click edit to actually change them. This took a little getting used to at first but allows for better management once accustomed to it. Another addition to the properties window for directories is the addition of “Share” and “Advanced Sharing” buttons on the Sharing tab. The “Share” button allows you to configure basic sharing such as share name and permissions while the “Advanced Sharing” button allows you to configure all that Share does plus caching and permissions.

Speaking of Administrative environments! Windows Server 2008 now has a Power Shell which can be used to administer any aspect of the server from a command line (PowerShell). This is a new market for the new Operating System, and as most System Administrators with Linux Experience will agree; it is a long overdue addition to Microsoft’s OS’s. The Power Shell can supplement the GUI for common Administrative tasks for those that are somewhat comfortable in a command line environment or completely replace the GUI for those that prefer a command line environment. This allows the Operating System to take advantage of the resources used by the GUI and gives Administrators more flexibility and granularity when configuring and maintaining their servers.

Another exciting feature added to the new Windows Server 2008 is Server Core. This is basically a GUI-Less server that can be virtualized and administered remotely similar to the way Admins are used to doing things now without ANY GUI on the actual server. This provides a more secure and robust server while allowing the server to once again allocate the resources previously consumed by the GUI back to more critical applications and services.

I am very excited to explore these and all of the other new innovations in Windows Server 2008, and as mentioned in this post, this is my first real look at the OS. I will most certainly be posting a lot more with regards to Server 08 in the coming months as I gain more knowledge and experience administering the Servers that I have deployed it to – So Stay Tuned!

Jason (Digitalkid)
www.954network.com

Active Directory JRNL_WRAP_ERROR 2000/2003 Server

digitalkid — Mon, 08 Dec 2008 18:36:19 +0000

Active Directory, as many know, is the life blood of the domain environment. It provides all authentication, user/group management and access control to the network. So what do you do when it is broken? There are many scenarios that can cause Active Directory to encounter issues; Replication, Low Disk Space, Drive Failures and Power Outages. In this article, I am outlining the infamous JRNL_WRAP_ERROR (Event ID: 13568). If your server is in a JRNL_WRAP_ERROR state, you will see these events Daily in the File Replication Service log in Event Viewer. It can cause issues with Exchange, Authentication and Replication. Luckily, it is relatively easy to resolve, as shown below:

1. MAKE SURE YOU HAVE A BACKUP OF ACTIVE DIRECTORY! As always, having a current backup is your best defense against disaster.

2. Stop the NTFRS service. Open a command prompt and type net stop ntfrs.

3. Open registry editor and navigate to the following location: HKLM\System\CurrentControlSet\Services\NtFrs\Parameters\Backup\Process at Startup.

4. In the right pane, Edit the DWOR value for BurFlags. It should be set to 0. Type D2 and exit registry editor.

5. Return to the command prompt and type: net start ntfrs.

This should take the DC out of JRNL_WRAP_ERROR. Monitor your logs for the next 24 hours to make sure that you do not see any Event ID: 13568 errors in the File Replication Service Logs. If this does not work, you will need to do a non-authoritative restore of Active Directory. You do have a current backup right? There are also instructions for repairing this issue in the Event Log error itself (They Differ from the procedure outlined above but have the same effect).

Jason (Digitalkid)
www.954network.com

Remotely Enable Terminal Services

digitalkid — Tue, 04 Nov 2008 18:06:57 +0000

From time to time, I find the need to enable Remote Desktop connections on remote machines (When it is not enabled on a client and I need to log into that PC). Luckily there is a neat little way to accomplish this, as long as you have Administrative rights to the remote computer and can connect it VIA remote registry. Here is how:

1. On the computer that has administrative rights to the target machine, open registry editor (Start > Run > Regedit – Enter)

2. Once in registry editor, click File and choose “Connect Remote Registry”.

3. Enter the target computers name or IP address and click OK.

4. Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server

5. Find the value on the right labeled: fDenyTSConnection (REG_DWORD) and change the value to “0″ (Zero) without the quotes.

6. Exit registry editor and connect to the remote computer with Terminal Services Client.

This is very useful when remotely managing new computers that were originally set up without this option enabled. Typically, this option is set under System > Remote tab.

Jason (Digitalkid)
www.954network.com