Export Mailbox in Exchange 2010

This article will describe how to export and import mailboxes with Exchange 2010. Although RC should be finally completed, this may be subject to change in the final release of Exchange 2010.

Why Export and Import

First off, we need to define if the task will be exported or imported in the mailboxes. In general, this is quite easy to define. This is what you should do:

Migrate from mailboxes completely out of range of your Exchange server environment only when you get the PST file from a user
Troubleshoot problems with existing mailboxes due to database errors or anything else
Backup all mailbox data manually to a tape without having the backup agent available

Fulfilling the Prerequisites

For export or import of mailboxes you will need to prepare a client system with the following prerequisites installed on it:

64 Bit Windows Operating System
Powershell 2.0
.NET Framework 3.51
Outlook Office 2010 64 Bit (which is currently in CTP release available)
Exchange Server 2010 management tools
Create domain membership for this client
Logon with an administrative account with Exchange’s full administrative permissions

Create a user account “ExportAdmin” in Active Directory; You can use any name of this account, as the primary function of this account is to export/import of mailboxes I am using “ExportAdmin” name.

Exchange Server 2010 comes with Roll-based Administration; you will need to run the following command first in exchange management shell:

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User “ExportAdmin”

This command gives the user permission to import and export mailboxes. Another way of doing this is creating an Active Directory group and adding permissions to this group using the following command:

New-ManagementRoleAssignment –Role “Mailbox Import Export” –Group “ExportAdmin”

When you are done, you will only have to add users to this group to allow them to export and import mailboxes.

If we take a look at how to import a mailbox, you will see that the powershell command for this task is actually quite simple:

Figure 1: Importing a mailbox

If we now take a look at how to export a mailbox, you will realize how easy this is! The following are the steps you need to take to carry out this task.

Figure 2: Starting a Mailbox Export

This procedure may take some time because this depends upon how big the personal folder itself is.

Figure 3: Finalizing the Mailbox Export

All these steps are Powershell commands. In the Release Candidate of Exchange Server 2010 there is no way of doing this in the graphical interface. With Exchange Server 2010 there is a way of doing this there.

After having installed Outlook 2010 in 64-Bit on the “Ex-/Import-Computer”, you will have two new commands (if you look at the context menu of each mailbox). These are “Export Mailbox” and “Import Mailbox”.

Figure 4: Mailbox Export in Exchange Administrative Console

When this is done, we need to specify the location of the target mailbox and the target server or the location of the personal folder (PST).

Figure 5: Detailled information on Exporting Mailbox

Importing a mailbox is quick and easy. You can see what option to choose from the Figure below.

Figure 6: Importing a mailbox using Exchange Management Console

The reason why Microsoft has disabled this feature may be (apart from the fact that it may come back in the final release or a first Service Pack) this task is especially for a mail server administrator and not for the general administrator.

SSL Certificates with Exchange 2007

Exchange Server 2007, adds a wealth of new features and makes many things easier to do. Unfortunately, installing SSL Certificates isn’t really one of them. Installing an SSL Certificate in Exchange 2007 requires you to run several commands in the Exchange Management Shell. Don’t fret yet! If you carefully following these instructions, you’ll have your Exchange 2007 server secured in no time!

Determine Your Needs

There are several methods of securing your Exchange 2007 server. This article will walk you through the process of ordering a Unified Communications SSL Certificate with multiple domains from a commercial certificate authority and installing it on your Exchange server. Exchange 2007 includes some new features, like Autodiscover, that require multiple names to be secured. There are other methods of securing the additional Exchange 2007 names but the recommended method is to use a Unified Communications Certificate so you only have to worry about one certificate and one IP address.

What names do you need to include? It depends on what services and features you plan to use. At a minimum, you need to include the external name that people use to send and receive mail (mail.yourdomain.com) and the base domain and local name (yourdomain.com and yourdomain.local). You will also want to include the name for Autodiscover (autodiscover.yourdomain.com) so that Outlook 2007 users can use the Autodiscover feature without receiving errors. If you would like to use OWA internally, you will also want to include two NetBIOS names (Server01.yourdomain.local and Server01). So, in a typical scenario, you would include the following names in your UC Certificate:

mail.domain.com
autodiscover.domain.com
domain.com
domain.local
Server01.domain.local
Server01

For more information about which names to include see the resources in the Links section below. Once you have determined which names you need to secure you are ready to create a Certificate Signing Request and order the certificate.

Can I use a Wildcard certificate?

A Wildcard certificate (*.yourdomain.com) will secure all first-level subdomains of a particular domain. This could work to secure your Exchange 2007 server, but it is not reccomened for these reasons:

You wouldn’t be able to access the server using the internal server name (Server01) because it is not covered by the certificate and you would receive a “name mismatch” error.
A wildcard certificate is incompatible with POP3 and IMAP4 on Exchange 2007. See Microsoft’s explanation of what certificates to use with Exchange 2007 for more information.

Create the Certificate Signing Request

Before you can order an SSL certificate for Exchange 2007, you need to create a Certificate Signing Request using the instructions below:

Click on the Start menu, go to All Programs, then Microsoft Exchange Server 2007 and click on Exchange Management Shell.

2. Run the New-ExchangeCertificate command below replacing the appropriate values with your own.

New-ExchangeCertificate -domainname mail.domain.com, domain.com, domain.local, autodiscover.domain.com, server01.domain.com, server01 -Friendlyname domain.com -generaterequest:$true -keysize 2048 -path c:\certrequest.txt -privatekeyexportable:$true -subjectname “c=US, o=Domain Inc., cn=server01.domain.com, s=California, l=Mountain View, ou=IT”

Name	Explanation	Examples
-domainname	Enter all of the names that you determined you needed to secure in the step above.	mail.domain.com autodiscover.domain.com domain.com domain.local Server01.domain.local Server01
-Friendlyname	Any name you want to use to keep track of the certificate on this server.	my domain certificate
-keysize	The size of the key that is generated. Bigger numbers are more secure but can be slower. Use at least 1024.	1024 2048
-path	The location where you want to save the CSR.	c:\certrequest.txt
Common Name (cn=)	Enter the first name in your list above. This is the most visible name in the certificate (the other names are listed as Subject Alternative Names and they aren’t displayed as clearly)	mail.yourdomain.com
Organization (o=)	The legal name of your organization. This should not be abbreviated and should include suffixes such as Inc, Corp, or LLC. Do not include commas or the command won’t work.	Domain Inc.
Organizational Unit (ou=)	The division of your organization handling the certificate.	Information Technology Web
City/Locality (l=)	The city where your organization is located.	Mountain View
State/province (s=)	The state/region where your organization is located. This shouldn’t be abbreviated.	California
Country/Region (c=)	The two-letter ISO code for the country where your organization is location.	US GB

Once you have generated a CSR you can use it to order the certificate from a certificate authority. Not all providers offer Unified Communications Certificates, but you can pick one from our list of Unified Communications SSL Certificates or you can compare SSL UC certificates using the SSL Wizard to find one. Once you find the provider that you want to buy from, click the Buy Now button and go through the order process. You will paste in the CSR and provide information about your company so it can be validated. Once the SSL provider validates your order, you will receive your new UC certificate file.

Install the Certificate

To install your newly acquired SSL certificate in Exchange 2007, first copy the certificate file somewhere on the server and then follow these instructions:

Click on the Start menu, go to All Programs, then Microsoft Exchange Server 2007 and click on Exchange Management Shell.
Run the Import-ExchangeCertificate command below. Make sure to specify the path to the certificate file you downloaded and remove any services that you will not be using.

Import-ExchangeCertificate -path c:\domain.p7b | Enable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP

3. If you didn’t receive any errors, then it should have installed correctly. Run the Get-ExchangeCertificate command to verify that the certificate is enabled for the correct services. If you aren’t sure which thumprint it is, you can view the thumbprint of the certificate you just installed by double-clicking it and looking for the thumbprint on the details tab.

4. If the certificate isn’t enabled for the correct services (S=SMTP, I=IMAP, P=POP, U=Unified Messaging, W=Web/IIS) you need to run the Enable-ExchangeCertificate command below. You can copy the thumbprint from the output of the Get-ExchangeCertificate command that you just ran.

Enable-ExchangeCertificate -Services IMAP, POP, UM, IIS, SMTP -thumbprint 896B74B25F7EBF330C93E56DA2A76CFC6A7

5. After running the Enable-ExchangeCertificate command, run the Get-ExchangeCertificate command again to verify that the certificate is enabled for the correct services.

Install any Intermediate Certificates

This step is not necessary if you received a .p7b certificate file from your SSL provider because this file contains all the Intermediate certificates and they are automatically installed. If you received an individual .crt certificate file you may need to follow the instructions in this step.

Most SSL providers issue server certificates off of an Intermediate certificate so you will need to install this Intermediate certificate to the server as well or your visitors will receive a Certificate Not Trusted Error. You can install each Intermediate certificate (sometimes there is more than one) using these instructions:

Download the intermediate certificate to a folder on the server.
Double click the certificate to open the certificate details.
At the bottom of the General tab, click the Install Certificate button to start the certificate import wizard. Click Next.

4. Select Place all certificates in the following store and click Browse.

5. Check the Show physical stores checkbox, then expand the Intermediate Certification Authorities folder, select the Local Computer folder beneath it. Click OK. Click Next, then Finish to finish installing the intermediate certificate.

Subject Alternate Names for your Exchange 2010 SSL Certificate

Choosing your SAN names for Exchange 2010 has been simplified from Exchange 2007 by the new graphic interface “New Exchange Certificate” wizard.

Exchange GUI SAN NAMES

If you prefer to use the Exchange Power Shell, you still have that option.

When choosing your Subject Alternate Names, the same basic rule applies to both the GUI & the Power Shell. Any name through which your server will be accessed should be listed in the certificate either as the common name or a subject alternate name.

In fact, the common name is automatically added to your certificate as a SAN.

If you access your Exchange 2010 server through the network and over the internet via the same url, make sure that you include that exact name in the certificate.

For example, if you use owa.domain.com externally and owa.domain.local internally, both owa.domain.com and owa.domain.local should be listed in the certificate. If you use owa.domain.com for both internal and external access, you do not need to include it twice.

The easiest thing to do when working with SSL Certificates in Exchange 2010′s new GUI is to check the boxes provided under “Exchange Configuration” for the applicable exchange roles. Your server will then suggest SAN names to use with Exchange 2010. You will need to confirm that the information that was pre-provided is accurate for your particular server configuration.

While we can’t tell you exactly what SAN names to include in your SSL certificate, the follow points hold true for SAN Names in Exchange 2010:

Include the fully-qualified domain name and netbios name of your Exchange server(s) (e.g, owa.domain.com and owa.local).
When using the autodiscover service, include an entry for autodiscover. Autodiscover with Exchange automatically uses autodiscover.yourdomain.com
If using a distinct URL for OWA, Activesync, Outlook Anywhere, or any other service you might be using on the Exchange 2010 server, or have any CAS servers involved for which you must create a secure connection, include those names as well.If you are using any CAS servers, make sure to include the netbios and internal fully-qualified domain name of every CAS server involved.If you do not use different URLs for any other secure services, you should have all the Subject Alternate Names you need

So my friends here are two approach for you

Approach 1

Obtain the certificate from third party but one small problem you have to pay for it and third party are GoDaddy, VerySign and DigiCerti….many more are in market (trust me I am not doing any advertisement).

Approach 2

Oh! but I don’t want to spend money. No problem here is the solution for you.You can refer to below article from one of my friend:

http://blog.onlinehelpboard.com/2011/04/17/subject-alternate-name-san/

Exchange 2003 server to Exchange 2010 Mail Flow issue.

Hi Friends…here we are this is for persons who suffers the problem of mail flow during migration of Exchange 2003 server to Exchange 2010 server.

One of the most common problems with co-existing Exchange Servers (an organization consisting of an Exchange 2003 server and Exchange 2010 server) mail flow between the servers. The issue of mail flow between exchange 2003 to exchange 2010 can harm all your exchange mailbox move and mail flow process so it is very important for every migration experts to check the proper connectivity between servers including mail flow between them, the reason is suppose you are dealing with such an organization which have 10000+ mailboxes, in such an organization none of the administrator will move all the mailboxes in a day, it’s also not a good recommendation, we always move mailboxes in a little chunks never whole in a single click, now suppose what you will do if you have moved the mailbox of CEO to Exchange 2010 box and after this he/she is not able to send mails to all other users those mailboxes are still in exchange 2003 server……!!!!????…. (God Save me what to do….I need help)

Here is the help……which can really help you. Check below things:

When Exchange 2010 is installed in an existing Exchange 2003 organization a Routing Group Connector (RGC) is configured during the installation of the Exchange 2010 server to allow mail flow between the legacy server and the new one. The way Exchange 2003 servers communicate with other Exchange 2003 servers or 2010 servers is by utilizing the Default SMTP Virtual Server.

One of the most common causes of disrupted mail flow is that the Default SMTP Virtual Server has been modified. Either the default port has been changed from the port 25 or a smart host has been added (Delivery Tab / Advanced Button). You can check the mail flow from port 25 by using telnet follow process for this

Test connectivity between your exchange 2010 server to exchange 2003 on port 25, for this open command prompt and type Telnet Exchange2003.domain.com 25 and see is this able to connect to your exchange 2003 server or not.

If telnet is not able to connect to your existing exchange 2003 then check that is there any rule configured in the firewall of local server that is blocking the conversation if this is the case you can disable that rule of can disable all firewall rules that are between your exchange 2003 and exchange 2010 server also in exchange 2003 there is options to configure SMTP port you should also check that.

There are 2 places where the port number can be changed on the SMTP Virtual Server. The first is for Incoming Mail and this is located on the General tab, click Advanced here we can specify the inbound port that Exchange will listen to for SMTP Connections and the second is for Outbound Connections and this is located under the Delivery tab, click Outbound Connections then in the Outbound Connections box should be the port number. These should both be port 25.
If TLS Encryption is configured on the Default SMTP Virtual Server then any Exchange 2010 server will force this to be used. So if it is incorrectly configured, certificate expired or corrupt then mail flow will fail.

The smart host configuration in Exchange 2003 should be performed using an SMTP Connector rather than modifying the Default Virtual SMTP Server. The general rule of thumb is to create a new SMTP Virtual Server rather than modify the existing one if a different port is required to send to a smart host or a SPAM/Virus Appliance.

All of these actions can be performed using the Send Connectors in Exchange 2010 so these settings should all be returned to default. This means that the Default SMTP Virtual Server should be using port 25 and should not have a smart host configured.

To prevent this simply turn off the TLS Encryption requirement. For inbound communication this is found under the properties of the Default SMTP Virtual Server > Access > Authentication and uncheck the box for TLS Authentication. For outbound communication this is found under the properties of the Default SMTP Virtual Server > Delivery > Outbound Security.

Once you have made changes to the Default SMTP Virtual Server you will need to restart the Simple Mail Transfer Protocol for the changes to take effect.

Apart from all above configurations you can also check the Routing Group Connector between Exchange 2003 to Exchange and vice versa. For this run below command in Exchange Management Shell at Exchange 2010 server.

Get-RoutingGroupConnector

Note- The Get-RoutingGroupConnector cmdlet displays the configuration details of routing group connectors that exist when an organization is running Exchange 2010 and Exchange Server 2003. A routing group connector is used to send and receive messages between Exchange 2010 Hub Transport servers and Exchange 2003 bridgehead servers. You need to be assigned permissions before you can run this cmdlet better use your admin account that has full access to exchange organization otherwise it will show some errors related to permissions. Change the name of servers as per your organization in above command before using.

The above command will display two routing group connectors; one for exchange 2003 to exchange 2010 and the second one will be for vice versa.

If you are not able to see any or any one is missing then you can create these connectors by commands also using exchange system manager in exchange 2003. You can create these connectors by using below cmdlet:

New-RoutingGroupConnector -Name “Interop RGC” -SourceTransportServers “Hub2010.domain.com” -TargetTransportServers “Bridgehead2003.domain.com” -Cost 100 -Bidirectional $true

The above command will create a connector from Exchange 2010 hub server to exchange 2003 bridge head server (If there is any bridgehead servers exist in your exchange environment otherwise use the name of your exchange 2003 server that act as an SMTP server.)

Note- The New-RoutingGroupConnector cmdlet to establish a connection between a Microsoft Exchange Server 2010 routing group and an Exchange Server 2003 routing group when the organization is running more than one version of Exchange. Change the name of servers as per your organization in above command before using.

SUBJECT ALTERNATE NAME (SAN)

Hi Friends,

Here we are again with an important requirement “I need to protect my website. I need HTTPS.” But one motto “Knowledge is increased by sharing….so here we are…..”

Oh! I have to save money and secure my IIS , OWA ….much more. What I should do?

Here is the simple solution, you can install the Certificate authority in Windows server (2000/2003/2008). Now Certificate authority can be Enterprise or standalone. If you already have a certificate authority and you want to know whether it is Enterprise or Standalone then run the command “certutil -cainfo” (without quotes) and this will give you necessary information.

Once you have certificate authority and you want to secure your website which is hosted on server “Server1” and in domain “PQR.COM” and you want to access this website as https://server1.PQR.COM and you also want to access the same site as https://webserver1.pqr.com and also as https://web.pqr.com here “webserver1” and “web” are subject alternate name for the website

Here is the solution:

Ran the below command on your certificate authority:

certutil-setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

[Version]

Signature=”$Windows NT$

[NewRequest]

Subject = “CN=server1.pqr.com”; must be the FQDN of domain controller;Change this line as per your requiremnet

Exportable = TRUE ; TRUE =Private key is exportable KeyLength= 2048 ; Common key sizes: 512, 1024, 2048, 4096, 8192, 16384

KeySpec=1 ; Key Exchange

KeyUsage= 0xA0 ; Digital Signature, Key Encipherment

MachineKeySet = True

ProviderName= “Microsoft RSA SChannel Cryptographic Provider”

ProviderType = 12

RequestType = CMC

; Omit entire section if CA is an enterprise CA

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1 ; Server
Authentication

;Omit line if CA is a stand-alone CA

[RequestAttributes]

CertificateTemplate = WebServer

; Below line is very important this will add SAN feature for your certificate

SAN=”dns=server1.pqr.com&dns=webserver1.pqr.com &dns=web.pqr.com” ;Changethis line as per your requiremnet

· Copy the above code in notepad and save the same as “request.inf” file.

· Now run the command “certreq–new request.inf certnew.req” (Run this command without quotes and on the server “server1” because it will create the private key and this key will stored on the server itself).

· Copy the file certnew.req on the Certificate Authority.

· Run the command “certreq –submit certnew.req certnew.cer” (Run this command without quotes on the Certificate authority and output of this command will give you the request id)

· Run the command “certreq–retrieve <Request ID> certnew.cer”

· Now take the file certnew.cer on the file server “server1”

· Run the command “certreq –accept certnew.cer” (Run this command without quotes and on the server “server1” because we want to secure the website on this server)

· Now open MMC and Add remove snap in and add the certificate and select the computer account , now you will see the certificate and its pivate key if private key is not there then please use the below command:

Certutil –repairstoremy <serial number of certificate>

This article is already published by Microsoft and for further information please referto below link:

http://support.microsoft.com/kb/931351