How to manage groups with groups in Exchange 2010

You’ve migrated from Exchange 2003 to Exchange 2010. Your users are reporting that they’re unable to modify distribution groups that they could in the past. In How to Manage Groups that I already own in Exchange 2010?, we showed you that in Exchange 2010, users had permissions to create new distribution groups and remove the distribution groups they owned.

This did help a few of your users but some are still unable to modify their distribution groups. You need to look into this….

Issue

When User1 tries to add a new member to the DistributionGroup1 distribution group, she gets this error:

Changes to the distribution group list membership could not be saved. You do not have sufficient permissions to perform this operation on this object.


Figure 1: User gets a permissions error when trying ot modifying a distribution group membership in Microsoft Outlook

In the past, User1 was able to add/remove members to the distribution group by using Outlook and didn’t need to call the help desk for assistance. What has changed?

You know that you had previously configured SecurityGroup1 to be able to manage this distribution group. Did someone make a change to User1’s security group membership? You look at ADUC first. No change – the user’s still a member of SecurityGroup1.


Figure 2: The user’s still a member of the security group that’s configured to manage the distribution group

Next, you check the distribution group configuration in ADUC to verify that DistributionGroup1 is still being managed by SecurityGroup1.


Figure 3: The user’s still a member of the security group that’s configured to manage the distribution group

Okay, so what’s the deal here? You know you recently migrated to Exchange 2010. So you take a look at DistributionGroup1 in EMC (which reveals that it’s managed by SecurityGroup1, but also displays an ‘Object Not Found’ error).


Figure 4: EMC displays the security group with an ‘Object not found’ error

Why is Exchange 2010 doing this?

This behavior is by design. In Exchange 2010, distribution groups can’t be managed by groups – only individual users can manage groups. So it’s possible that using Exchange 2003, you used groups to manage a distribution group. Group ownership was handled at a different level. Now that these mailboxes have been moved to Exchange 2010, members of these groups can’t modify the group.

So are there any workarounds?

We’ve created a script to work around this limitation. Download Set-DistributionGroupOwners.ps1 from the Script Center.

The script will allow you to simulate a group having ownership of a distribution group in Exchange 2010. The script can be run in three different modes depending on the switches you pass.

  1. Mode 1 – Set Ownership for a particular distribution group. Modifications to the ManagedBy attribute are not set at this time. It will simply modify a Custom Attribute to have the information needed later when the script sets the ManagedBy attribute.
  2. Mode 2 – Modify the ManagedBy attribute of a specific distribution group so the members of either a security group or distribution group can manage it.
  3. Mode 3 – Is designed to be run as a scheduled task and ensure individual members of a group have ownership of the Distribution Group which they are set to own. This mode is used if you prefer to automate the process and perhaps run it nightly to look for any changes to security group and distribution group membership.

How do I run this thing?

  1. Windows 2008 R2 is required to run the script. This was needed in order to support Security Groups owning Distribution Groups. This does not have to be run on an Exchange server but the Exchange management tools must be installed.
  2. Download the script. The Set-DistributionGroupOwners.ps1 script is now available from TechNet Script Center. Download it and change the file extension to .ps1. I recommend Set-DistributionGroupOwners.ps1.
  3. Decide what CustomAttribute can be used in your environment. The script will populate the Distinguished Name (DN) of the group (specified in the ManagedBy attribute of the distribution group you want to manage) in a custom attribute. By default, this is CustomAttribute5, but this can easily be changed to use one of the fifteen custom attributes in the default schema. Find the following in Set-DistributionGroupOwners.ps1:

    $dn_storage = ”CustomAttribute5″

    Change CustomAttribute5 to the custom attribute of your choice.You’re now ready to run the script.

Mode 1 – Set Ownership of a Group

In this mode, run the script with both -DistributionGroup AND –GroupOwner parameters. Specify the distribution group (-DistributionGroup) and the group that you want to manage it (-GroupOwner). This will then set the DN of the owning group from –GroupOwner into the CustomAttribute you specified on the Distribution Group from –DistributionGroup.

In order to have DistributionGroup1 managed by SecurityGroup1, you would run the following:


Figure 5: The script populates the group owner’s DN in a custom attribute

A dump of the DL above shows that CustomAttribute5 is populated with the DN of SecurityGroup1 and the ManagedBy attribute remains with only SecurityGroup1 listed. Mode 2 is needed in order for members of SecurityGroup1 to be able to modify DistributionGroup1.

Mode 2 – Modify the ManagedBy attribute for one Group

Neither Mode 2 nor Mode 3 will work until you have set the value of the customer attribute to the DN of the Owning Group. If you have already run the Script in Mode 1, then Mode 2 will configure the ManagedBy attribute for a single group. To run in Mode 2, simply specify only the –DistrubitionGroup switch and list the DL that you want to have processed.

In our example, we have specified group, DistributionGroup1. This step will then set members of the owning group on the ManagedBy attribute. They are now listed by individual name.


Figure 6: The script populates the distribution group’s ManagedBy attribute with (individual) members of the owning group

Mode 3 – Run the Script as a Scheduled Task to look all new modifications to Group Ownership

When you run the script with no switches, it will search AD for all Groups that have the defined custom attribute set to a DN. It will then process all of them as in Mode 2.

The script is designed to be run in this mode as either a one off type operation when you know updates are needed or as a scheduled task to keep everything in sync. A key point is that when populating the ManagedBy attribute, it overwrites existing values with the current members of the owning group.

Note: This script in its current form will NOT chase nested groups. It will only take members of the group that’s listed in the defined custom attribute. There are currently no plans to add nested group functionality to the script.

Many special thanks to our scripting genius Matt Byrd, whose motto continues to be “If this needs to be done more than once, it’s getting scripted!”

Publiserat i Okategoriserade | Lämna en kommentar

New features in Forefront Online Protection for Exchange (FOPE) to meet your complex email flow scenarios

This latest release of Forefront Online Protection for Exchange (FOPE) brings a wealth of features that help you protect and secure complex mail flow scenarios. Great news for Microsoft Office 365 Beta users, you now get FOPE as your standard email protection solution. If you’re using a Microsoft Exchange Server, this release brings you the simplicity of single sign-on from the Exchange Control Panel to the FOPE Administration Center.

Use the links in this blog entry, start the video, or explore Microsoft.com on your own to learn about some of the other FOPE improvements in this 11.1 release. For example, new mail-routing capabilities with safe lists to skip IP address filtering, forced transport layer security with FOPE connectors, and also the ability to delegate administrator privileges.

Publiserat i Okategoriserade | Lämna en kommentar

Of memory and strings

This post was provoked by a recent Stack Overflow question which asked whether there was an efficient representation of ASCII strings in .NET.

Hosted Exchange 2010

In particular, the questioner wanted to story hundreds of thousands – possibly millions – of strings in memory, and knowing (or assuming) that they all consisted of ASCII characters, he wanted to avoid the waste of space that comes from storing each character in a .NET string as a UTF-16 code unit.

My answer to the question mostly consisted of saying that I didn’t think it would be worth the effort, and giving some reasons. But the more reasons I gave, the more I thought about the subtleties involved, and that it’s actually quite an interesting case study into memory use in .NET.

How are we going to measure object size?

If we’re going to work out any sort of benefit from a more compact string representation, we’ll need to be able to calculate how much memory our objects are taking to start with. Rather than work this out in a purely theoretical way, I’ve been running tests using code like this:

using System;

class Program
{
    static void Main(string[] args)
    {
        int size = 10000000;
        object[] array = new object[size];
        
        long before = GC.GetTotalMemory(true);
        for (int i = 0; i < size; i++)            
        {
            array[i] = new object();
        }
        long after = GC.GetTotalMemory(true);
        
        double diff = after – before;
        
        Console.WriteLine(”Per object: ” + diff / size);

        // Stop the GC from messing up our measurements
        GC.KeepAlive(array);
    }
}

Obviously that doesn’t take into account factors such as memory used by JITting, or anything that could be going on in other threads, but by using a suitably large number of objects, and by performing the division in floating point arithmetic (to avoid a slight variation making an 11.99999 come out as an 11, when it’s really just a ”12 with something else going on”, we can work out the size of objects pretty clearly. The sample above measures the size of a vanilla object, but the code can be adapted very easily.

The first important thing to point out is that C# doesn’t guarantee the results of this – it isn’t responsible for determining how all of an object is laid out in memory; that’s the runtime’s job. While there are attributes to affect the layout and padding of the data members of a type in memory, there are other aspects that are out of your control. In this post I won’t use any of the layout attributes – we’ll just use the defaults.

Not all runtimes are created equal, either. On my laptop I’ve got Mono 2.8, .NET 3.5 and .NET 4, with the two versions of .NET each having the 32-bit (x86) and 64-bit (x64) CLRs. For the sake of simplicity, I’m going to stick with .NET 4 for this post, but I’ll give results for both the x64 and x86 CLRs. To test each of them, I’m compiling with ”/platform:x64″ or ”/platform:x86″.

Some simple starter measurements

Before I start creating my own types, let’s try a few built-in types, including strings:

Type x86 size x64 size
object 12 24
object[] 16 + length * 4 32 + length * 8
int[] 12 + length * 4 28 + length * 4
byte[] 12 + length 24 + length
string 14 + length * 2 26 + length * 2

Note that all the x86 sizes are rounded up to the nearest 4 bytes, and all x64 sizes are rounded up to the nearest 8 bytes.

The string numbers are interesting, because strings are the only non-array types in .NET which vary in size. A long string consists of a single large object in memory. Compare this with Java, where a String is a ”normal” type in terms of memory consumption, containing an offset and length into a char array – so a long string consists of a small object referring to a large char array. This distinction will be very important when we come to build an AsciiString type. Another point about measuring string sizes is that it’s relatively tricky to measure the size of an empty string – because even if you use the ”new string(‘x’, 0)” constructor, the result is still cached – the same reference is returned each time.

You might be forgiven for looking at the numbers above and thinking that the ”overhead” of an object is 12 bytes in x86 and 24 in x64… but that’s not quite right. Let’s build our own straightforward classes and measure them…

Custom classes containing primitives

Here are six classes, all of which are measured with the same simple test code:

class Empty {}
class OneInt32 { int x; }
class TwoInt32 { int x, y; }
class ThreeInt32 { int x, y, z; }

class Mixed1
{
    int x;
    byte b1, b2, b3, b4;
    int y, z;
}

class Mixed2
{
    int x;
    byte b1;
    int y, z;
    byte b2, b3, b4;
}

The last case is mostly to check how the CLR handles an ”awkward” class declaration, where the int variables won’t naturally be aligned on 4-byte boundaries. The results look odd at first, but we’ll make sense of them in a minute:

Type x86 size x64 size
Empty 12 24
OneInt32 12 24
TwoInt32s 16 24
ThreeInt32s 20 32
Mixed1 24 32
Mixed2 24 32

A few interesting things to note here:

  • There’s a ”base” overhead of 8 bytes per object in x86 and 16 per object in x64… given that we can store an Int32 of ”real” data in x86 and still have an object size of 12, and likewise we can store two Int32s of real data in x64 and still have an object of x64.
  • There’s a ”minimum” size of 12 bytes and 24 bytes respectively. In other words, you can’t have a type which is just the overhead. Note how the ”Empty” class takes up the same size as creating instances of Object… there’s effectively some spare room, because the CLR doesn’t like operating on an object with no data. (Note that a struct with no fields takes up space too, even for local variables.)
  • The x86 objects are padded to 4 byte boundaries; on x64 it’s 8 bytes (just as before)
  • By default, the CLR is happy to pack fields pretty densely – Mixed2 only took as much space as ThreeInt32. My guess is that it reorganized the in-memory representation so that the bytes all came after the ints… and that’s what a quick bit of playing around with unsafe pointers suggests too… but I’m not sufficiently comfortable with this sort of thing to say for sure. Frankly, I don’t care… so long as it all works, what we’re interested in is the overall size, not the precise layout.

So what does an ASCII string look like?

In this blog post I’m not actually going to implement an ASCII string at all (well, not much). I’m merely pointing out what the data structures would look like. However, it’s worth working out what desirable qualities it should have. As far as possible, it should feel like System.String. In particular:

  • It should be immutable.
  • It should have fast access to individual characters, and the length.
  • It should mostly ”feel” like an immutable reference type, in that passing a value of type AsciiString around should be cheap, like copying a reference.
  • It should use as little memory as possible… less than the equivalent string, or it’s pointless.
    • One caveat to this: in theory that could mean storing 8 characters in every 7 bytes, as ASCII really only uses 7 bits per character. I’m not going to those extremes, but you can think about them if you want.

We’re going to store the characters as a byte array. We have three options as to exactly how we handle that byte array:

  • We could go the Java way, where several strings share references to the same array. Each string then has an offset and a length to say which bit of the array they’re interested in.
    • Pros: Substring becomes really cheap
    • Cons: You can end up having just a tiny substring responsible for keeping a huge character array alive
  • We could go the .NET way, where each string has its own character data, but the buffer may be longer than necessary… so it stores the length too. (A bit like a List<T>.)
    • Pros: Can potentially make building strings cheap, if you just keep whatever potentially oversized buffer you’ve already got.
    • Cons: Wasted space for the unused part of the array, and a field for the length.
  • We could just have a byte array of exactly the right size – and it already knows its size.

I’m going to assume the third option here. So all the data our type needs is a byte array. That’s going to be pretty cheap… we hope. Let’s look at what we can build.

Option 1: A simple class

To give a flavour of the implementation, I’ve decided to implement four members for each option:

  • A way of creating an AsciiString from a regular string
  • The Substring overload with both a start and length
  • The Length property
  • The indexer returning a char

Hopefully that will give enough of an idea of what’s going on to be useful. Note that these aren’t production-quality implementations at all… none of the code has ever been run at all. I have made sure it compiles, so just be grateful for that :)

using System;
using System.Text;

public sealed class AsciiString
{
    private readonly byte[] data;

    public AsciiString(string text)
    {
        // TODO: Rather more data validation etc!
        data = Encoding.ASCII.GetBytes(text);
    }
    
    private AsciiString(byte[] data)
    {
        // This constructor is private: we can trust that it’s been called
        // by code which isn’t going to modify the contents of the array
        // afterwards.
        this.data = data;
    }
    
    public AsciiString Substring(int startIndex, int length)
    {
        if (startIndex < 0 || startIndex > data.Length)
        {
            throw new ArgumentOutOfRangeException(”startIndex”);
        }
        if (startIndex + length > data.Length)
        {
            throw new ArgumentOutOfRangeException(”length”);
        }
        byte[] newData = new byte[length];
        Buffer.BlockCopy(data, startIndex, newData, 0, length);
        return new AsciiString(newData);
    }
    
    public int Length { get { return data.Length; } }
    
    public char this[int position] { get { return (char) data[position]; } }
    // etc…
}

Hopefully this is pretty straightforward – it’s meant to be the most ”obvious” solution. Note that we’ve not got the nice locality of reference which the real String class has – it’s possible that the an AsciiString could end up with its backing array a long way away in memory, so a indexer operation for a single character could end up with three cache misses – one for the AsciiString object, one for part of the data array storing the length (for argument validation) and one for the part of the data array containing the character we’re looking for. That may be unlikely, and it’s not the kind of thing I normally think about – but it’s probably the kind of thing the BCL team pay a lot of attention to.

We get the same ”immutable reference type” behaviour present in the normal string type, however – you can have a null AsciiString reference just as normal, any assignments will just be reference assignments, etc.

What about the size though? There are two objects to consider:

  • The array, of size 12 + length or 24 + length (x86 and x64 respectively; rounded up to 4 or 8 bytes as well)
  • The object itself, of size 12 or 24

So we’ve got a total size of 24 + length or 48 + length, depending on architecture. To show how the break-even point works, here’s a little table showing the sizes of string and AsciiString for various sizes on both architectures:

Length string-x86 string-x64 AsciiString-x86 AsciiString-x64
0 16 32 24 48
1 16 32 28 56
2 20 32 28 56
3 20 32 28 56
4 24 40 28 56
5 24 40 32 56
6 28 40 32 56
7 28 40 32 56
8 32 48 32 56
9 32 48 36 64
10 36 48 36 64
..
16 48 64 40 64
24 64 80 48 72
32 80 96 56 80

As you can see, the break-even point in x86 is at length 10; in x64 it’s at length 16. After that, we start winning – as we’d expect. The penalty for very small strings is quite hefty though – you’d really better hope you didn’t have lots of single-character strings, taking 56 bytes each in x64.

Let’s see if we can do better…

Option 2: A simple struct

A lot of the overhead here has come from the fact that we’ve got an object which only has a single field. The field is all we’re interested in… why are we bothering with all the overhead of the object? Let’s make it a struct instead, effectively inlining that field wherever we use the type. Assignment, passing arguments to methods etc will still only be copying a reference – it’s just the reference will be the byte array rather than a wrapper object.

It all sounds good, but there are two snags:

  • The value can never be null; that at least diverges from the familiar string behaviour
  • We won’t be able to prevent code from creating an instance of our struct with new AsciiString() – and that won’t be good.

We can actually pit these two downsides against each other by making the ”default” value a pseudo-null value… we can even throw NullReferenceException just as if it were a reference type. We don’t even need to do any work in order to get that NullReferenceException – every member is going to use the data array anyway, and dereferencing that will automatically throw an exception. We might want to change things around a bit to make that the very first thing that can throw an exception, but that’s all.

It’s nasty, but it appeals very slightly. In an evil kind of way. It makes things slightly more familiar, but at the cost of being generally weird in other ways.

We still need to be able to check whether an AsciiString value is the logical null value. I’ll add an IsNull property for that purpose. (An alternative would be HasValue, but that would be confusing with Nullable<T>.)

Most of the code remains untouched – it looks like this:

public struct AsciiString
{
    private readonly byte[] data;

    public bool IsNull { get { return data == null; } }
    
    // Remainder of code as before
}

Now let’s look at the sizes, which should be a lot more favourable than before. Note that I had to change the size-checking code to create an array of type AsciiStruct[] instead of object[] to avoid boxing. Should we take the size of the array itself into consideration when computing the size of the AsciiString? We haven’t when working out the size of string… in each case the size of any individual element will be the size of a reference. For the table below, I haven’t included it… but bear in mind that this form of measurement would count the size of most value types (int etc) as 0. It just goes to show that when you talk about the size of a data type, you really need to be very precise in what you mean.

Length string-x86 string-x64 AsciiString-x86 AsciiString-x64
0 16 32 12 24
1 16 32 16 32
2 20 32 16 32
3 20 32 16 32
4 24 40 16 32
5 24 40 20 32
6 28 40 20 32
7 28 40 20 32
8 32 48 20 32
9 32 48 24 40
10 36 48 24 40
..
16 48 64 28 40
24 64 80 36 48
32 80 96 44 56

This time, unsurprisingly, AsciiString is always more space-efficient than the normal string. It just takes a certain amount of holding our noses. Speaking of which…

Option 3: Extension methods on byte[]

Suppose we really, really want to have ”proper” null references. We don’t really need the struct. We could treat any byte array as an array of ASCII characters, with extension methods like this:

public static class ByteArrayExtensions
{
    public static byte[] Substring(this byte[] data, int startIndex, int length)
    {
        if (startIndex < 0 || startIndex > data.Length)
        {
            throw new ArgumentOutOfRangeException(”startIndex”);
        }
        if (startIndex + length > data.Length)
        {
            throw new ArgumentOutOfRangeException(”length”);
        }
        byte[] newData = new byte[length];
        Buffer.BlockCopy(data, startIndex, newData, 0, length);
        return newData;
    }    
}

The size is the same as with option 2 – in both cases there’s just the byte array, basically. This option is truly horrible in many ways though:

  • You can no longer tell in your code (just through typing) what’s meant to be an AsciiString and what isn’t
  • Kiss immutability goodbye
  • We can’t guarantee that all the characters will be valid ASCII any more
  • We can’t add extension properties or extension indexers
  • We can’t make it implement the interfaces we want it to

Obviously, we’d never take this route. I just thought I’d include it for a regular dose of evil-ness.

Conclusion

Implementing an ASCII-only string representation sounds like it should be an obvious win in terms of memory, at the cost of doing a lot of work that’s already been done for us in String. However, the most obvious implementation takes a while to break even in memory usage, compared with the normal string type, due to the ”special” nature of string within the CLR. We can’t mimic the ”stretchiness” of string ourselves. The BCL/CLR teams could, of course, if they really wanted to. I’m not holding my breath though.

If we’re dead keen on saving space at the cost of some design wonkiness, we can use a value type instead of a reference type. Other than nullity, it works pretty well… but you have all the disadvantages which go with value types, such as the unavoidable parameterless constructor and the need to watch out for boxing.

Aside from anything else, I hope this was useful as a delve into how much space objects actually take up in .NET – and as a way of highlighting the extra memory used when running in the x64 CLR.

Publiserat i Okategoriserade | Lämna en kommentar

Controlling Exchange ActiveSync device access using the Allow/Block/Quarantine list

What is the Allow/Block/Quarantine list?
In Exchange 2010 we added a feature called the Allow/Block/Quarantine list (or ABQ for short). This feature was designed to help IT organizations control which of the growing number of Exchange ActiveSync-enabled devices are allowed to connect to their Exchange Servers. With this feature, organizations can choose which devices (or families of devices) can connect using Exchange ActiveSync (and conversely, which are blocked or quarantined).

Some of you may remember my previous post on this topic dealing with organizations that do not have Exchange 2010 and thus I wanted to show you the far better way you can do this in Exchange 2010 (which is also what you will see in Office 365 and Exchange Online if you are looking at our cloud-based offerings).

It is important to understand that the ABQ list is not meant to displace policy controls implemented using Exchange ActiveSync policies. Policy controls allow you to control and manage device features (such as remote wipe, PIN passwords, encryption, camera blocking, etc.) whereas the ABQ list is about controlling which devices are allowed to connect (for example, there may be a lot of devices that support EAS PIN policies, but some IT departments only want to allow certain devices to connect to limit support or testing costs). The easy takeaway is that Exchange ActiveSync policies allow you to limit device access by capabilities while the Allow/Block/Quarantine list allows you to control device access by device type. If you’re curious as to what devices OS support which policies, the Wikipedia article we blogged about is a good place to look.

Different device access models for different folks
When we designed the ABQ list, we talked to a lot of organizations to find out how all of you use (or wanted to use) this kind of technology. What we realized is that there is a continuum of organizations; from permissive organizations that let employees connect whatever device they have to their Exchange Server, all the way to restrictive organizations that only support specific devices. Since we always want to make our software as flexible for IT as possible (as we know there are a lot of you folks that are using our software in a lot of different ways) we created this feature so that no matter which type of organization you are (or even if you are one that is in between these two extremes) we could help meet your needs. Below are some descriptions and ”how-to”s for using the ABQ list in these different ways.

The restrictive organization
Restrictive organizations follow a more traditional design where only a set of supported devices is allowed to connect to the Exchange server. In this case, the IT department will only choose to allow the particular devices they support and all other devices are blocked.

It’s important to note that a restrictive organization is created by specifying a set of allowed devices and blocking the unknown.

Below is a flow chart of the logic.

Figure 1: Restrictive organizations specify a set of allowed devices and block unknown devices
The permissive organization:
Permissive organizations allow all (or most) to connect to their Exchange Server. In these cases, the ABQ list can help organizations block a particular device or set of devices from connecting. This is useful if there’s a security vulnerability or if the device is putting a particularly heavy load on the Exchange server. In these cases, the IT department can identify the misbehaving device and block that device until a fix or update for that device brings it into compliance. All other devices, including the unknown devices, are given access. Below is a flowchart of that logic.

Figure 2: Permissive organizations allow all devices and block specified misbehaving devices
The one off case:
Of course, if you are limiting the devices that connect to your organization, there’s almost always a need for an exception. Whether it’s testing a new device before rolling it out to the organization as a supported device, or an exception made for an executive, we wanted to give you the ability to make an exception without allowing all users with that device to access your organization’s email and PIM data. Below is a flowchart of that logic.

Figure 3: You can allow specific devices to connect without having to create rules to allow or block all devices of that type
When to quarantine:
Quarantining devices is useful when an IT department wants to monitor new devices connecting to their organization. Both permissive and restrictive organizations may choose to employ this mechanism. In a permissive organization, quarantine can be used so that IT administrators know what devices, and which users, are making new connections. In restrictive organizations, this can be used to see who is trying to work around policy and also gauge demand from ”Bring Your Own Device” (BYOD) users. Below is a flowchart of that logic. Note that you could also choose to quarantine at the device/device family level if you wanted (not shown in the diagram for simplicity sake).

Figure 4: Quarantine devices to monitor new devices connecting to your Exchange organization
Now that we’ve gone through the theory, let’s talk about how we would do this in practice.

Accessing the ABQ settings:
1.Log in to the Exchange Control Panel (ECP)
(you can also access the ECP from Outlook Web App (OWA) by selecting Options > See all options)
2.In the ECP, make sure you are managing My Organization (#1 in the screenshot below). Be aware that most users won’t see the ”My Organization” option — it’s only visible to users with Exchange Administrator access.
3.Select Phone & Voice (#2 in the screenshot below) > ActiveSync Access tab (#3 in the screenshot below). This is the Allow/Block/Quarantine configuration screen.
Note for all you Exchange Management Shell (EMS) gurus, you can also configure device access using PowerShell cmdlets if you prefer.

Figure 5: Accessing ABQ settings from the Exchange Control Panel
Creating a device (or a family of devices) rule:
To create a new rule, select New from the Device Access Rules section of the ABQ page (#5 in the screenshot above).

When setting up a rule for a device, it is important to understand the difference between the ”family” of the device and the specific device. This information is communicated as part of the EAS protocol and is reported by the device itself. In general, you can think of the deivce rule as applying only to the particular device type (like an HTC-ST7377 as shown in the image below) whereas a device family might be something more broad like ”Pocket PC”. This distinction between the specific (device type) and the general (device family) is important since many device manufacturers actually release the same device with different names on different carriers. To make it so that you don’t have to make a separate rule for each device. For instance, the HTC Touch Pro was available on all four majour US carriers as well as some of the regional ones, and that’s just the USA, not to mention the other versions around the world. As you can see, making a rule for each of those different devices (which are all in the same family and effectively the same device) could mean a lot of extra work for IT, so we added the family grouping to help you make good decisions about devices in bulk. It’s important to note that when making a new rule you select the device family or the model but not both. Once you’ve selected the device or a device family, you can then choose what Exchange will do with that device (in this example, I’m just going to do a specific device).

This brings you to the New Device Access Rule page. The easiest way to set the rule is to select Browse, which will show you a list of all the devices or device families that have recently connected to your Exchange Server. Once you’ve selected the device or family, you can choose the action to take. This is where you can choose to block the device if you are a permissive organization looking to limit a specific device for a specific reason or where you can set access rules if you are a restrictive organization (in such a case you would just create an allow rule for each supported device and then set the state for all unknown devices to block (we’ll talk about how to set the action for unknown devices in the next section)). Once you select the action (Allow access, Block access, or Quarantine), click Save and you’re done! You can repeat this process for each rule you want to create. You can also have both block and allow rules simultaneously.

Figure 6: Creating a device access rule
Setting up a rule for unknown devices:
To access the rule for unknown devices, select Edit (#4 in Figure 5 above). On the Exchange ActiveSync Settings page, you can configure the action to take when Exchange sees a user trying to connect with a device that it does not recognize. By default, Exchange allows connections from all devices for users that are enabled for EAS. This example configures the Exchange organization to quarantine all unknown devices. This means that if there’s no rule for the device (or device family) or if there’s no exception for the particular user, then an unknown device will follow this behavior.

Figure 7: You can create a default rule for unknown devices and select administrators to be notified about quarantined devices
Quarantine notifications We have the ability to specify who gets an email alert when a device is placed in quarantine. You can add one or more administrators (or users) or even a distribution group to this list of notified individuals. Anyone on this list will receive an email like the one shown in the screenshot below. The notification provides you information about who tried to connect the device, the device details and when the attempt was made.

Figure 8: Quarantined device notifications inform you about connection attempts from unknown devices
Custom quarantine message You can also set a custom message that will be delivered to the user in their Inbox and on their device. Although the device is in quarantine, we send this one message to the device so the user doesn’t automatically call help desk because their device isn’t syncing. The custom message is added to the notification email to the user that their device is in quarantine (see example image below).

Figure 9: Quarantined devices receive a notification
The user and device will also now appear on the Quarantined Devices list on the ABQ configuration page (circled in red in the image below).

Figure 10: Quarantined devices in ECP
Managing Quarantined Devices
The device will stay in quarantine until an administrator decides to allow or block the device in quarantine. This can be done by selecting the device and then clicking on the Allow or Block buttons in Quarantined Devices (#1 in the screenshot below). This creates a personal exemption (the ”one off case” mentioned earlier). If you wish to create an access rule that is to apply to all devices of the same family or model, you can select Create a rule for similar devices. (#2 in the image below) to open a new, prepopulated, rule.

Figure 11: You can allow or block a quarantined device or create a device access rule for the device model or family
Making changes:
Of course we realize that many organizations are dynamic and have changing requirements and policies. Any of the rules that have been set up can be changed dynamically by accessing the ABQ page in the ECP and editing, deleting, or adding the desired rule.

Publiserat i Okategoriserade | Lämna en kommentar

Announcing the Re-release of Exchange 2010 Service Pack 1 Update Rollup 3 (V3)

On March 14th we posted an announcement to the EHLO blog about removing Update Rollup 3 for Exchange Server 2010 SP1 due to an issue related to Blackberry devices.

The Exchange Servicing team has fixed the reported issue with E2010 SP1 RU3 and is making available a new version of RU3 for our customers, version 14.01.289.007, (KB2529939). We strongly advise all customers install this newly released version of Microsoft Exchange Server 2010 SP1 Update Rollup 3 and to discard any prior version of RU3 (KB2492690) which you may have.

RU3 Installation Guidance:

  • Customers with RU3 already installed within your Exchange environmentIt is not necessary for you to uninstall the existing RU3 within your environment. The new RU3 package can be installed over the top of the existing package installed on your servers.
  • Customers with previous SP3 RU’s installed within your Exchange environmentYou can simply install the new version of the RU3 package.

General RU Installation Guidance

  • Note for deployments that leverage Forefront Security for Exchange: For those of you running Forefront Security for Exchange perform these important steps from the command line in the Forefront directory before and after this rollup’s installation. Without these steps, Exchange services for Information Store and Transport will not start back up. You will need to disable Forefront via ”fscutility /disable” before installing the patch and then re-enable after the patch by running ”fscutility /enable” to start it up again post installation.

We deeply regret the impact that these issues have had on you, our customers, and as always, we continue to identify ways to better serve your needs through our regular servicing releases.

Hosted Exchange 2010

Publiserat i Okategoriserade | Lämna en kommentar

Effects of Throttling on Your Deployment in Exchange 2010 SP1

Exchange 2010 features a new resource protection mechanism – user throttling. This feature is designed to limit the amount of resources a single user or application can take up on a CAS to prevent poorly written applications from causing denial of service (DoS) to the rest of the users. You can read about throttling in Understanding Client Throttling Policies. If any of the terminology in this post sounds unfamiliar, please refer to this documentation.

While Exchange 2010 RTM shipped with user throttling ”off” by default (most limits were set to infinite), after more testing in Exchange 2010 SP1, we’ve come up with a tighter set of limits for the throttling policies, and have thus turned user throttling on by default.

We have also changed what happens when users exceed their budget in some cases. In Exchange 2010 RTM version, Exchange rejected any Exchange Web Service (EWS), Exchange ActiveSync (EAS) and Outlook Web App (OWA) requests made by users who exceeded their budget. We’ve improved on this idea in SP1 in the EWS and ActiveSync protocols, by instead delaying the call just enough for the budget to recharge back into the positive and then execute the request. This means that end users will generally see fewer errors from the ActiveSync client or EWS application. In some rare conditions, such as if the caller is exceeding max number of connections or subscriptions in EWS, we’ll still reject the request.

The longest a single request can be delayed is a minute, but this would be an extreme case and one that would signify that something is out of place either on the server, or with the caller. Typically, users and applications will not encounter throttling (except maybe if the user is doing a sync of the whole mailbox). However, some resource-heavy applications may start to get throttled in SP1. If throttling does kick in, the delays will be short enough that users won’t notice any effect. However, we’ve provided ways to gain an insight into what is the user’s experience is like due to throttling.

There are two main ways to monitor throttling – by monitoring perf counters and by looking at IIS logs. First, SP1 offers the following useful perf counters (instance is per CAS process) to monitor throttling under the MSExchange Throttling category on a CAS:

Max Delay Per Minute – this value represents the longest amount of time in msec that anyone was delayed due to throttling in the past minute.
Max Effective Time In * – this set of counters say that if the throttling policy was set to the counter values, then all requests that have been encountered in the past minute would all go through unthrottled.
Users Delayed X Milliseconds – the number of users who saw delays greater than ”X” (see Delay Time Threshold) milliseconds in the past minute.
Users X Times OverBudget – the number of users whose requests were rejected more than ”X” times in the past minute (see OverBudgetThreshold).
OverBudgetThreshold – the ”X” value for the ”Users X Times OverBudget” counter.
Delay Time Threshold – the ”X” value for the ”Users Delayed X Milliseconds” counter.
Total Unique Budgets – number of unique budgets (ie callers/users) seen in the past minute
Unique Budgets OverBudget – number of unique budgets that went over budget in the past minute
The general rule is that if the ”Unique Budgets OverBudget” counter is graphing a line that’s close to the ”Total Unique Budgets” line, then most of the users in your system are getting throttled. You can further refine that by checking how many users are seeing rejections vs how many are getting delayed by viewing the appropriate ”Users X times …” counter. Finally, you can see if and how much users are delayed by viewing the ”Max Delay Per Minute” counter. Also, all of these counters are saved off to SCOM once every minute.

If you do determine that many of your users are getting throttled, you may further try to understand why by digging into IIS logs. As of SP1, only ActiveSync, OWA and EWS log throttling info to IIS. By searching IIS for users or the string ”overbudget”, you can view which requests they have been making and which have been going over budget. You can refer to Budget Snapshots in the IIS Logs for a breakdown of the different parts of the budget.

If you do determine that your users or applications are throttled too much by your standards and their scenarios are in fact legitimate, then you can tweak the throttling settings to reflect your environment’s use by:

Turning throttling off
Running your regular traffic through Exchange
Watching what the ”Max Effective Time In *” counters report over the course of a few days
Setting the throttling policies to that value. To do this, call Get-ThrottlingPolicy ?| { $_.IsDefault} | Set-ThrottlingPolicy

Alternatively, if it is an EWS application using a service account that becomes throttled, and you determine that it is not resource intensive to the Exchange server, you should create a new, custom throttling policy for it. To do this:

Call New-ThrottlingPolicy and set the proper parameters (refer to Exchange documentation at the top of the document for explanation of the parameters)
Call Get-Mailbox

The changes will be picked up within 15 minutes, or immediately after you recycle the EWS app pool in IIS. Please note that custom policies are meant as one-off solutions when a few applications or users are getting throttled and the load they are putting on the system is actually legitimate. You shouldn’t update everyone’s link to a custom policy – if you need to change throttling settings for the majority of your users, edit the default policy. For more information on throttling please refer to the official documentation linked at the top of this article.

Publiserat i Okategoriserade | Lämna en kommentar

E2010 Calculator, Megacycles, SPECInt2006, and Cores…Huh?

Since the release of v12.8 of the Exchange 2010 Mailbox Server Role Calculator, I have received several questions with regards to the changes in the processor input section.

In particular, the one question that keeps coming up is ”Why doesn’t the CPU results change when I change the number of cores (e.g., change from 12 cores to 6 cores)?”

The answer is relatively simple: you didn’t change the SPECInt2006 Rate value when you changed the number of total cores that are in the system. Remember that the SPECInt2006 Rate value is a function of the server’s architecture, processor architecture, and the number of processors being deployed in the server. The same server with 1 processor versus 2 processors will have completely different SPECInt2006 Rate values.

But let me explain all of this with an example. Let’s say you had a design that requires 20,000 megacycles during the worst failure mode. The system you have initially chosen is 12 cores with a SPECInt2006 Rate value of 351.

With 12 cores (351 rate value), this means you have is 351/12*3333/18.75=5200 adjusted megacycles/core. In other words, the server supports 62394 adjusted megacycles. From a utilization perspective, this is 20000/62394*100=32%.

If you were to change the input requirements to use 6 cores with the same SPECInt2006 Rate value, then:

With 6 cores (351 rate value), this means you have is 351/6*3333/18.75=10399 adjusted megacycles/core. In other words, the server supports 62394 adjusted megacycles. From a utilization perspective, this is 20000/62394*100=32%.

Because the example reduced the number of cores in the system by one half, but the Specint2006 rate value didn’t change, the capability of each core, measured in megacycles, was doubled. But the total amount of work the system can do is still the same. What this means is that the utilization of the server would still be the same. Incidentally, the number of cores required to support the mailbox load during the worst failure event, will be halved as the capability of each core doubled.

In the end, you must adjust both the total number of processor cores and the SPECInt2006 Rate value, if you want to see a corresponding change in the CPU utilization.

Publiserat i Okategoriserade | Lämna en kommentar

Public Folder Replication Changes in Exchange 2010 Sp1

Many of you who have migrated or are still migrating public folders from Exchange 2003 to Exchange 2007 or 2010 have run into replication failures due to property validation. This validation was first introduced in Exchange 2007, and I initially blogged about some those issues in this old post on EHLO. I later posted a script on my personal blog that fixes some of those problems, and described another troubleshooting technique here.

While the validation was good in that it kept ‘bad’ items out of your shiny new public stores, the items usually weren’t ‘bad’ in a way that a user would ever notice. Maybe they had a null Category, or the PR_SENDER_NAME was empty, or the start/end dates on an appointment weren’t all in sync. And while my script fixes a few of the problems, some of the problems can’t be fixed and the item simply has to be deleted.

For any of you still struggling with these issues, I have good news. Exchange 2010 SP1 completely turns off validation for items in public folder replication messages. Once you apply SP1, any public folder replication problems due to validation will simply go away.

Of course, this means that on your new public stores you might end up with items that have bad Category values and similar problems. If you like, you can still use my script to correct some of those problems, but in most cases the users never notice them anyway.

Exchange 2010 SP1 will make life a lot easier for anyone still migrating public folders from Exchange 2003. We are evaluating a similar fix for Exchange 2007.

Publiserat i Okategoriserade | Lämna en kommentar

Exchange 2010 SP1 and Support for FIPS Compliant Algorithms

When will Exchange Server 2010 support FIPS compliance?
Exchange Server 2010 SP1 provides for the ability to disable algorithms which are not FIPS 140-2 compliant. These algorithms are used for encryption, hashing, and signing within the Windows Server 2008 and Windows Server 2008 R2 operating systems that support Exchange Server 2010. When the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing setting is enabled in a Group Policy or Local Policy, it disables the use of non-FIPS compliant algorithms such as RC-4. In Exchange 2010 RTM, it caused certain functions to fail. The most notable issue was in Outlook Web App (OWA), as documented in Microsoft Knowledge Base Article KB977961, and in the web-based Exchange Control Panel (ECP).

What is FIPS?
Federal Information Processing Standards (FIPS) are standards utilized to define security and interoperability requirements for cryptographic algorithms that the US Government uses. The FIPS 140-2 publication and standard (Security Requirements for Cryptographic Modules – PDF) defines the cryptographic algorithms as well as standards for key generation and key management. There are several FIPS publications which define how to further secure information systems and provide a standard upon which systems can be evaluated.

For more information on how Microsoft products and libraries comply with FIPS 140, see FIPS 140 Evaluation.

The importance of FIPS compliance to specific customers
Within the United States our customers utilize several guidelines, checklists, and requirements for securing systems, all which call for this policy setting to be enabled on the application’s host operating system (OS). In addition we have customers that do business with the US Government or work in industries where there is significant government oversight.

This policy setting ensures that the host OS, Windows Server 2008 SP2 or greater and Windows Server 2008 R2 or greater, in this case, only utilizes cryptographic algorithms that have passed the Cryptographic Module Validation Program and have been certified by the National Institute for Standards and Technology. Try saying that really fast three times.

The Windows Server OS, specifically the Windows Cryptographic Service Provider (CSP) is responsible for leveraging FIPS compliant algorithms for cipher, hashing, signing and encryption and we don’t actually need to enable anything within Exchange Server 2010. Exchange 2010 does have to know how to process the information provided via the OS, OS components such as Internet Information Server (IIS), and the Windows CSP. Exchange 2010 was released without support for servers which had this setting enabled, but had support and testing aligned for release with Exchange 2010 SP1.

What happens when this policy setting is enabled?
In Exchange 2010 RTM, when the policy setting System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing is enabled on the Windows Server 2008 or Windows Server 2008 R2 OS, the Schannel Security Provider (SSP) disables Secure Sockets Layer (SSL) protocols which are not part of the FIPS 140 standard. When this policy setting is enabled only FIPS 140-2 approved cryptographic algorithms are utilized. Examples of FIPS 140-2 compliant algorithms are the Triple Data Encryption Standard (3DES) and Triple Data Encryption Algorithm (TDEA) cipher, Advanced Encryption Standard (AES) algorithm and the Secure Hashing Algorithm (SHA) for hashing. In addition only the Transport Layer Security for Secure Sockets Layer (TLS/SSL) protocols will be utilized.

For those of you who have enabled the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing setting on an Exchange 2010 server, you may have discovered two distinct issues. The first is that Outlook Web App on your Client Access Servers (CAS) appears to work but generates errors once the customer provides their username and password or smartcard PIN.

For those of us that have customers using Kerberos constrained delegation (KCD), OWA errors out with:
! An unexpected error occurred and your request couldn’t be handled

Expanding the Show Details link provides additional detail, specifically an exception message stating:
The type initializer for ‘Microsoft.Exchange.Data.Storage.GccUtils’ threw an exception

Additionally, an error event (Event ID 4999, Source: MSExchange Common) will be logged in the Application event log on the Exchange CAS.

The second issue is near-identical where the web-based ECP functionality, also provided by the CAS, will fail.

How will this be fixed?
In Exchange 2010 SP1, changes have been made to the code base, tested and verified, to support this setting. Exchange 2010 SP1 operates with support for FIPS 140-2 algorithms if the Windows Server 2008 SP2 and Windows Server 2008 R2 operating systems are configured to utilize the FIPS 140-2 algorithms for system cryptography.

My agency/organization/customer/co-worker asked about this support yesterday. When will Exchange Server 2010 SP1 be released?
Exchange 2010 SP1 has been released and can be downloaded here.

Thanks for your time and my customers and I look forward to it as well!

Publiserat i Okategoriserade | Lämna en kommentar

Hej världen!

Välkommen till WordPress. Det här är ditt första inlägg. Redigera det eller radera det. Sedan kan du börja blogga!

Publiserat i Okategoriserade | 1 kommentar