Viewing the Exchange 2010 Anti-Spam Logs

In most cases, you should have anti-spam filtering for Exchange 2010 that is provided by software other than Exchange 2010. Exchange 2010 has some basic anti-spam filtering features but they are not as nice or easy to work with as online filtering services (such as ForeFront Online for Exchange) or on-premises services (such as Barracuda devices or Symantec Mail security).

Note: SBS2011 enables the built-in anti-spam filtering capabilities of Exchange 2010 by default.

If you select to use the spam filtering in Exchange 2010 (or do so by accident) it's pretty awkward to view the logs. The only interface provided by Exchange 2010 is the Get-Agent log cmdlet. This cmdlet only gives parameters to display by start date and end date. You'll need to filter down the output of Get-AgentLog to see only what you want.

To make life easier for you, here are the list of properties supplied for each message that you can filter based-on:

• RunspaceId - Not useful
• Timestamp - But you'd use the start and end date with Get-AgentLog to filter this instead
• SessionId - Not useful
• IPAddress - The mail server sending the message
• MessageId - Generally not useful unless the sender provides this information to help you search for it
• P1FromAddress
• P2FromAddresses
• Recipients
• Agent - Indicates which anti-spam filter caught the spam
• Event - When the filtering was applied (OnEndOfData is typical)
• Action - Look for RejectMessage when identifying spam that is filtered
• SmtpResponse - The SMTP code that was provided to the sender (5.7.1 is a spam rejection)
• Reason - Provides a summarized reason as to why the message was blocked
• ReasonData - When blocked because of a high SCL, this displays the SCL value
• Diagnostics - Codes that don't look useful to me

An example of filtering for rejected messages for a specific user:

Get-AgentLog -StartDate "06/11/2013 9:00:00 AM" | Where-Object {($_.Recipients -like "*username*") -and ($_.Action -eq "RejectMessage")}

The above example uses Get-AgentLog to list all messages in the log after 9am on June 11, 2013. The list of messages is piped to Where-Object for filtering.

The filter looks for recipients that contain the test username. You could use -eq and search for a specific full email address, but I find it easier to just search for the user portion of the email address. The list of recipients is an array and -eq may force you to put in all email addresses to match properly.

The filter also looks for messages that have an action of RejectMessage. I am only interested in viewing the rejected messages to verify is a sender is being blocked.

New DirSync Does Not Require ADFS for O365

On June 3rd, Microsoft released a new version of DirSync (Windows Azure Directory Sync Tool) that can synchronize on-premises password up to Office 365. With the addition of this functionality, you can have users log on to Office 365 without the requirement to configure Active Directory Federation Services (AD FS). Let me give a fairly long explanation as to why this is a good thing. First, how did it look with AD FS.

O365 Authentication with AD FS
A traditional configuration of O365 with single sign-on allows users to authenticate to O365 by using their corporate username and password. To enable this process, two components needed to be in place:

• DirSync. This component replicates information from the on-premises AD to O365. This allows on-premises user accounts to be automatically created in the cloud.
• AD FS. This component is a service that provides authentication for external services that use the on-premises AD as a source for user accounts.  For example, when you authenticate to O365, the credentials you provide are passed to AD FS in your organization for authentication. If AD FS indicates that your username and password are correct, then you are given access to your O365 account. Basically, it allows authentication to be outsourced from the location hosting the application.

There were two main issues with using AD FS:

1. If AD FS is not available, you could not authenticate to O365. So, if the corporate internet connection was down or if AD FS experienced any issues at all, your access to O365 was in jeopardy. When a selling feature of cloud-based services is high availability, this makes AD FS a major weak point.
2. AD FS is relatively complex to setup and configure if you want it to be highly available. At minimum, the recommended solution requires two AD FS servers and two AD FS proxies combined with load balancing for each level.

How Does the New DirSync Help
The new version of DirSync has an option to synchronize passwords from the on-premises AD to O365. Once the password has been synchronized, you authenticate only within O365. This can be used with hybrid deployments of Exchange Server.

To me this provides two big benefits:

1. The complexity and cost of AD FS is avoided.
2. O365 accounts can be authenticated even when the on-premises network is unavailable.

Things to Think About
Nothing is a completely free ride. So, there are things that you need to consider when selecting password synchronization over AD FS:

1. How paranoid are you? Your AD password information being replicated into the O365. This is done by replicating the hash value of the password, not the actual password, but if someone got the hash value, they could run a brute force attack on the hash and might be able to get the password.
2. Users will be prompted for credentials. AD FS provides single sign-on. For domain joined computers, this meant that access to O365 could be made seamless by passing workstation credentials to O365 for authentication. When you use password synchronization, users will be prompted for a password when starting Outlook. At least until you save the credentials during logon to O365.
3.  Password synchronization from AD to O365 is not immediate. Password synchronization takes place outside the standard 3 hour interval for synchronization. Typically, password synchronization is complete within a few minutes, but it is not immediate.
4. This tool has apparently been available on the eduction side of O365 for a while. So, it's not completely new. That makes me feel better about looking at implementing it sooner rather than later.
5. You can convert from an AD FS federated domain to using password synchronization fairly easily by using Convert-MsolDomainToStandard.

Additional Resources
Here are some additional resources that will help you evaluate whether password synchronization is right for your organization:

• New Azure Active Directory Sync tool with Password Sync is now available
  http://blogs.technet.com/b/educloud/archive/2013/06/03/new-azure-active-directory-sync-tool-with-password-sync-is-now-available.aspx
• Implement Password Synchronization
  http://technet.microsoft.com/en-us/library/dn246918.aspx
• Install or upgrade the Directory Sync tool
  http://technet.microsoft.com/en-us/library/jj151800.aspx

Renewing an Exchange 2010 Certificate from Go Daddy

When you use the Exchange Management Console for Exchange Server 2010 to generate a certificate renewal request, the format used is not compatible with Go Daddy. The EMC provides some sort of binary request. Go Daddy expects a standard text-based renewal request.

You can use this process instead:

1. Perform the certificate renewal on the Go Daddy web site and select the option to  reuse the existing CSR. If you do this then you do not need the renewal request from Exchange.
2. Download the approved certificate in zip format and extact it to obtain the .crt file.
3. Use IIS Manager (at the server node) to complete a certificate request. Provide the .crt file and a friendly name that you recognize. Note that .crt files are not displayed by default when browsing for the file.
4. Use the Exchange Management Console to assign services to your renewed certificate.

And my best recommendation for avoiding this process is using multi-year certificates. And remember to use the discount codes in the Go Daddy spam messages. Typically you can get about 20% off.

Cheap US Roaming for Canadians

I do occasional travel to the US for work and vacations. My biggest annoyance when traveling is the cost of cell phone roaming. It adds up to a ton of money for voice, text, or data (especially data).

I had been considering getting a T-Mobile prepaid account and a separate phone to use just for travelling. They have prepaid service for $3/day. Which is pretty good with unlimited data, voice, and text.

However, I recently learned about a new option that is based in Canada and it seems to work really well. Roam Mobility resells T-Mobile services for use when you are roaming.

Roam Mobility has plans with unlimited voice, unlimited text, and 100MB of data for $4 per day. This is a bit more that T-Mobile, but Roam Mobility has a couple of advantages:

• You can keep your number for up to a year without using it. T-Mobile expires the prepaid cards after 3 months.
• Voice to Canada is included. I have not verified, but I believe that outbound T-Mobile to Canada would be long distance.
• I like the idea of someone specializing in the task we're trying to accomplish. They provide tech support.

You need an unlocked cell phone
To use Roam Mobility, you need a cell phone that is unlocked. Most are locked by the vendor (your friendly telco) because they don't want you to switch networks. There are a bunch of places online that will provide a code to unlock your cell phone for $10-15. If you are more adventurous, there are a lot of hits on Google about how to unlock your particular model of phone for free.

I haven't played much with unlocking phones, but my wife won an HTC Desire from Telus somehow that we've never used with phone service. It has been our "not-a-phone" with Wifi for the last couple of years. So, armed with Google, optimism, and a phone I didn't really care about, I set off and unlocked the phone. I did it for fun. Everyone else should probably just kick out the $10 and be done with it.

To test the unlocked phone, we took a SIM card from an MTS Blackberry and put it in the phone. The phone came up and connected to the MTS network. Sweet.

You need to get a SIM card
Next up was purchasing the SIM card from Roam Mobility. In Winnipeg, the only vendor at this time is London Drugs in St. Vital Mall. The first day we went, they were sold out but let us know there would be more in a couple of days.

London Drugs sold the SIM card, but didn't provide any service to speak of (like explaining that additional setup may be required). So, I'd be happy to recommend to anyone that they purchase online instead of from a local retailer.

After purchasing the SIM card for $20, we inserted it into the phone, but there was no way to tell if it was working because we were not anywhere near the T-Mobile network.

You need to do additional configuration of your phone for data
My wife was the first to travel with the phone and was surprised that, when she arrived in the US, the voice and text functionality was working, but not the data. We were both pretty confused by this, but like the older and wiser technical geek that I am, I recommended calling Roam Mobility tech support (611 from your phone, or 1-888-762-6487) instead of me trying to figure it out. The younger version of me would have spent a week researching it instead.

It turns out that in order to connect to data, you need to perform some additional configuration steps:

1. Enable data roaming
2. Add the APN (Access Point Name) for Roam Mobility ("roam")

After performing these steps with tech support the data on the phone was good to go.

Some info about this configuration:

• A description of changing the APN
• A configuration file with APN settings for iOS (iPad, iPhone)
• A video showing how to configure the APN in Android devices

You will save a ton of money
Standard rates from Rogers are: $1.45/min, $.75/text, and $8 per 50MB of data in 24 hours. You can get Travel Packs that lessen the pain, but they are still expensive. For example, the cheapest data plan that can be used for up to 1 month is $80 for 50 minutes, 50 outbound texts, and 50MB of data. Some people would use that in a day.

Traveling to the US for 5 days cost us $20 for the SIM card and $20 for unlimited voice, unlimited texts, and 500 MB of data. The only hassle is unlocking the phone. In the future, it will be just the $4/day.

Exchange 2013 Management Pack - RELEASED!

Microsoft is on a roll this week. Not only do we now have the role requirements calculator for Exchange 2013, but now we have the management pack for Exchange 2013. For many larger organizations that use System Center Operations Manager this was a critical components before considering the deployment of Exchange 2013.

• http://blogs.technet.com/b/momteam/archive/2013/05/14/exchange-2013-management-pack-released.aspx

Exchange 2013 Hybrid Configuration Wizard Fails

Several weeks ago I was working on a project where we were implement a hybrid environment with Office 365 by using Exchange 2013 as the hybrid servers for an existing Exchange 2010 environment. Adding Exchange 2013 went pretty smoothly overall and I thought the hybrid wizard would be the easy part.

When we ran the hybrid configuration wizard and selected the certificate, we got the following error:

The length of the property is too long

What a delightfully vague response. Well, after several days working with Office 365 tech support, the client was able to identify that the subject in the certificate was too long. The certificate was perfectly valid, but the hybrid configuration wizard was unable to handle the subject length.

The client had obtained an extended validation certificate that included a lot of additional information in the subject such as a long organization ID. After replacing the extended validation certificate with a standard certificate it completed without any problems.

Exchange 2013 Role Requirements Calculator - RELEASED!

At long last, the Exchange 2013 Role Requirements Calculator has been released. Any Exchange 2013 deployments up to this point have been based on educated guesses. Now we have official guidance from Microsoft.

• http://blogs.technet.com/b/exchange/archive/2013/05/14/released-exchange-2013-server-role-requirements-calculator.aspx