User accounts in Active Directory have two types of logon credentials: pre-Windows 2000 (or the so called down-level) logon name, and UPN (User Principal Name). The UPN is the preferred logon method, according to Microsoft documentation. By convention, the UPN should map the user’s e-mail address. That will consolidate the e-mail and logon namespaces so that the user will have to remember and use a single name.

The UPN which you see and which you can modify, in Active Directory Users and Computers or in Active Directory Administrative center is the so called explicit User Principle Name. It’s value is stored in the userPrincipleName attribute of the user account. As we demonstrate in Step1, there is one more UPN, associated with each account – the Implicit User Principle Name. It is based on the sAMAccountName attribute and the Active Directory DNS domain name of the account. You cannot delete the implicit UPN, and modifying the sAMAccount name changes automatically the implicit UPN. In addition, Active Directory always uses the implicit UPN in Kerberos authentication.

For you convenience, Microsoft provides one more UPN – the so called UPN with flat domain name, which uses the NetBIOS AD domain name, instead of the DNS one.

In the following Step-by-Step video tutorial, we discuss the different types of UPN and demonstrate their use on local domain clients (Windows XP and Windows 7) and remote (Outlook Web App and Outlook Anywhere) clients.

Next we focus on adding UPN suffixes:

– For the whole forest, in Active Directory Users and Computers

– For specific Organization Unit, in ADSIEDT.msc

Then we compare the use of Active Directory Administrative Center and Active Directory Users and Computers and outline some of the limitations of the latter when specifying UPN suffix for a specific OU.

Finally, we demonstrate how to bulk modify the explicit UPN in Exchange Management shell to match the e-mail address of the accounts.

Stay tuned on NetoMeter – subscribe to NetoMeter RSS.

Dean

If you have already installed an SSL certificate and allowed your remote clients to use OWA (Outlook Web App), as we have demonstrated in our Screencast:
How to Install GoDaddy Multiple Domain (UCC) SSL Certificate in Exchange 2010 then configuring Outlook Anywhere is the next logical step. The advantages of this feature are:
– Users get full access to their mailboxes over virtually any network without the need of a VPN solution or additional firewall rules
– You can use the same URL that you use for Outlook Web App and Microsoft Exchange ActiveSync
– You can use the same SSL certificate implemented for Outlook Web App and Exchange ActiveSync
– Unauthenticated requests from Outlook cannot access Exchange Server

The SSL certificate which you are using on your Exchange 2010 Client Access server is one of the key factors which determine the configuration steps which you should follow.
Using a trusted Multiple Domain SSL certificate is the easiest (and recommended) scenario and we will start with it. As you will see in our demo, this allows fully automated client configuration of autodiscover capable remote clients – MS Outlook 2010 and Outlook 2007, based solely on the users e-mail address. MS Outlook 2003 clients require manual configuration. We demonstrate it (Step3), as it is a good idea to be able to perform a manual Outlook Anywhere configuration (even with autodiscover capable clients) as part of your troubleshooting techniques.
Your other SSL certificate options are:
– Generating and using a Self-Signed Multiple Domain Certificate
– Configuring a Microsoft CA and issuing a Multiple Domain Certificate, signed by it
– Using a trusted Single Domain SSL certificate and configuring an Autodiscover SRV record in your external DNS zone

In our demo, we are using a Single Exchange Server 2010 SP1 installed on a Windows Server 2008 R2.

Stay tuned on NetoMeter – subscribe to NetoMeter RSS.

Dean

Out of the box Exchange 2010 comes with a self-signed certificate, generated and assigned automatically to exchange services during the installation of the Client Access Server role. It is provided as a temporary certificate – just to get you started, and it should be replaced as soon as possible.

There are three types of SSL certificates which you can use with Exchange server 2010:

1. Trusted Third-Party (commercial) Certificates – as the name suggests, they are issued by trusted CA (Certificate Authorities) and you have to pay for them. You can request and install a Multiple Domain certificate – also known as SAN (Subject Alternative Name), or UCC (Unified Communications Certificate). This is the recommended certificate for Exchange 2010 and we demonstrate how to request and install a GoDaddy Multiple Domain (UCC) certificate in this screencast.
Alternatively, you can request and install a Single Name certificate, which requires significant administrative efforts on your side – configuring split DNS, adjusting SCP and Web Services URL, configuring a SRV record in the external DNS zone, and still there will one time security (redirection) popup for the remote Outlook Anywhere clients.

2. Windows Public Key Infrastructure Certificates – in plain words this means installing and using a stand alone (we have already demonstrated this approach with Exchange 2007) or Enterprise Windows CA.

3. Self-signed certificate. Like the default, out of the box Exchange 2010 certificate, it is generated by Exchange server and valid for 5 years, but you can choose the included Common name and Subject Alternative names.

Ideally, you should be purchasing and installing a Multiple Domain (UCC) SSL certificate

In the following Step-by-Step video tutorial, you will see how to install and configure GoDaddy Multiple Domain (UCC) SSL Certificate in Exchange Server 2010.

Stay tuned on NetoMeter – subscribe to NetoMeter RSS.

Dean

Bulk Creating and modifying user accounts in Active Directory is a common task which every administrator has met or will meet at some point of his career.

In the following Step-by-Step video tutorial, we will give you a simple algorithm which will allow you to perform easily bulk operations in Exchange Management Shell. We do not expect you to have any programming or PowerShell experience.

It is very possible that at some point you will feel the need to add information about your users that does not easily fit into the existing fields. Our last example is about modifying Exchange Custom Attributes and using them when creating Dynamic Distribution groups in Exchange Server 2010.

Stay tuned on NetoMeter – subscribe to NetoMeter RSS.

Dean

If your organization doesn’t use Edge Transport servers and has only Hub Transport servers, you should install and enable the anti-spam features on Hub Transport servers that receive messages from the internet. In this Step-by-Step Screencast we will demonstrate how to install, configure and test Anti-Spam functionality on Exchange 2010 Hub Transport Server.

A very efficient Anti-Spam feature is the use of IP Block List providers. In our demo we will show you how to configure and test SpamHAUS as a DNSBL – DNS-based Block List (or Blackhole, black list) provider. We will be using the combined and most powerful ZEN list – zen.spamhaus.org, and you will see different approaches to test your configuration.

One of the overlooked steps, when configuring Exchange 2010 anti-spam functionality is specifying the internal SMTP servers in the InternalSMTPServers parameter. This will be reflected in your logs as event ID 1022 (MSExchangeTransport) – Anti-spam agents are enabled, but the list of internal SMTP servers is empty.

Configuring and checking the Anti-Spam updates is also a very important task for the Exchange administrator. We compare the two update modes – manual and automatic, and the corresponding Standard and Enterprise Anti-Spam updates provided by Microsoft. You will see that even though the name of the update mode is manual, you can have your Standard Anti-Spam updates downloaded and installed automatically, and we will show you how to switch between manual and automatic Exchange 2010 Anti-Spam updates mode.

In the following Step-by-Step video tutorial, you will see how to enable Anti-Spam Features on Exchange 2010 Hub Transport Server.

Stay tuned on NetoMeter – subscribe to NetoMeter RSS.

Dean

In the following Step-by-Step video tutorial, we will demonstrate Exchange 2010 initial configuration. We are using a single Exchange Server 2010 typical installation in a scenario without Exchange 2010 Edge Server. You will see the post installation steps that you have to go through to make your server functional.

These steps are required because out of the box a typical Exchange Server 2010 installation:
● is unable to receive e-mails from the Internet – anonymous SMTP connections are dropped, and that’s how most e-mail servers will send e-mails to your Exchange Server.
● does not configure any explicit Send Connectors, and is unable to send e-mails to the Internet.
● the default e-mail address policy and accepted domain are using the forest root FQDN (Fully Qualified Domain Name). In many cases, the external (e-mail) domain name which a company uses is different from the one used for Active Directory. It is also possible that you need to be able to accept e-mails for more than one e-mail domains.

As we are not using Edge server in our scenario, we will create manually Internet Send and Internet Receive Connectors, and we will set them to use our Exchange 2010 Server public Fully Qualified Domain Name. Finally, we will We will show you an easy way to check and configure external postmaster address, using the GUI – Exchange Management Console.

Following  the steps outlined bellow, you will have your Exchange Server 2010 up and ready to send and receive e-mails using the e-mail domain that you need.

Stay tuned on NetoMeter – subscribe to NetoMeter RSS.

Dean