PowerShell

A certificate roundup

Devin L. Ganger — Fri, 09 May 2008 23:55:07 GMT

Certificates are one of the biggest issues I keep hearing about with Exchange and OCS, and apparently I'm not the only one. Fellow MVP Michael B. Smith has recently posted two blog articles on certs: how to use SAN certificates with ISA 2006 and other certificate limitations. However, he's got a couple of points on the second article that I'm confused about:

According to this announcement on the Windows Mobile team blog, Windows Mobile 6.0 and up do in fact support wildcard certificates.
The first point he makes is also head-scratcher, because I've also heard this was an issue, but I'd also recently heard of a workaround for it:
1. In Outlook, go to the properties for your Exchange account (Tools, Account Settings, select your Exchange account and click Change) and click More Settings.
2. On the Connection tab, click Exchange Proxy Settings.
3. Look for the field Only connect to proxy servers that have this principal name in their certificate and make sure it's checked (you may need to check the Connect using SSL only checkbox first).
4. The value in this field should normally be set to msstd:server.external.fqdn, the FQDN the server is known as from the outside and that is the subject name of the certificate. So if my certificate was issued for 3Sharp, it would be msstd:mail.3sharp.com. To use this with a wildcard certificate issued to *.3sharp.com, this value would need to be set to msstd:*.3sharp.com.
  
  Let's try a diagram to make the point:

I'm doing more checking, trying to figure out what the deal is here; in the meantime, if you've got operational experience with either of these issues, please let me know.

At any rate, there's some more interesting factoids on certificates I've picked up:

If you want to use a certificate with the Exchange 2007 UM role, you need to have a certificate on the machine whose subject name matches the server's AD/DNS FQDN. It seems that you can't enable a certificate for the UM service using the Enable-ExchangeCertificate cmdlet if this does not match. Note that you can do this for other services, such as those hosted by the CAS role; the cmdlet performs different name checks on the certificate based on the services (SMTP, POP3, IMAP, HTTP, and UM) that you are enabling.
I've said it before, but it needs to be repeated: if you're not using the default self-signed certificate, simply use the Enable-ExchangeCertificate cmdlet to move all services to one or more additional certificates. Do not delete the default certificate; although in most cases Exchange will simply recreate it when the appropriate service is restarted, you can cause subtle errors that will take a while to figure out.
Learn more about certificate usage in Exchange in Creating a Certificate or Certificate Request for TLS.
And learn more about the Enable-ExchangeCertificate cmdlet.

More later!

Sweet PowerShell lovin'...for free!

Devin L. Ganger — Thu, 28 Feb 2008 19:04:00 GMT

And yes, that's "free as in beer," not "free as in what some people think all information wants to be."[1]

Frank Koch and Marcel Trümpy of Microsoft (in Switzerland) have created not one, but two Windows PowerShell ebooks, and you can get them both for free:

A Windows PowerShell course book with associated demo files and examples.
A Windows PowerShell server administration book with associated demo files and examples.

Get them both in one easy download either in English or German. The downloads are from Microsoft and no registration is required, according to the blog posting.

[1] If you believe all information wants to be free, I challenge you to put your money where your mouth is and post your Social Security number (if you live in the USA; equivalent if you don't), birthdate, address, personal phone number, and bank account information here in my comments. After all, that's all information -- and it wants to be free!

Liveblogging the Unified Communications Voice Ignite conference, day 3

Devin L. Ganger — Tue, 05 Feb 2008 22:09:00 GMT

Day Three of Devin's notes from the UC Voice Ignite event in Sydney, Australia.

Post-Connections report

Devin L. Ganger — Tue, 13 Nov 2007 22:37:00 GMT

Vegas was great again, this year; the hotel was as lovely as ever, but the overlap with the Latin Grammys sure did some interesting things to the elevators. Mandalay Bay felt full this year! On the other hand, the beach remodel was excellent; the wave pool and the Lazy River pool were both hits with my family. As is my wont, I'm making my session slide decks available for download.

EXC16: Advanced Exchange Protection using Data Protection Manager
Backing up and restoring Exchange servers is an essential part of keeping your messaging infrastructure up and running, even when you’re running an advanced clustering configuration. Why should you consider using the new version of Microsoft System Center Data Protection Manager (“v2“) to protect your Exchange server clusters? Is it any harder than backing up standalone servers? This session covers protecting Exchange 2003 and 2007 servers clustered configurations, including the new Exchange 2007 replication options.

I thought this session went pretty well; there was a Microsoft session on Tuesday morning that looked like it was going to cover the exact same material, but the overlap was both smaller and shallower than I expected. I got a lot of good questions from this session which I'll be answering in the next couple of days; I really hope that I was able to convey my own excitement about DPM and how it will make a great partner for protecting Exchange.
EXC17: Exchange Management Shell Annoyances
The Exchange 2007 Management Shell makes full use of the exciting new Windows PowerShell technology. It’s a great command-line management experience, but it’s still not perfect. You may have already been tripped up by annoyances and complications in what seem to be obvious tasks or you may just want to know what dangers lurk beneath the surface. This session will show you some common pitfalls and problems and give you the knowledge to successfully navigate them.

This session suffered from the inevitable technical glitches; my Exchange virtual environment died an hour or two before the session, so I ended up having to run it from a stock Windows PowerShell session. Luckily, I was able to cover most of the territory from there and even add a couple of things or two. Not having the Get-Help and cmdlet completion information for EMS, though, just sucked; my apologies.
EXC18: Getting Run Over by Exchange 2007
Common knowledge says that upgrading to Exchange 2007 isn’t nearly as hard as the upgrade from Exchange 5.5. That’s not to say that it doesn’t present its own set of challenges—and if you’re caught by them, it will still feel like getting run over by a truck. This session will present some of the common gotchas and how to avoid them. Be at the head of the upgrade parade, not caught in the wheels.

Wow. This was a great session; standing room only and a lot of good feedback and questions. This is clearly a topic of concern to people -- if you have any other upgrade gotchas, let me know!

It's a release!

Devin L. Ganger — Tue, 09 Oct 2007 02:28:00 GMT

For those of you who have been waiting for that sweet, sweet DPM 2007 goodness...wait no more. It's gone RTM. DPM 2007 is an amazing product, so amazing that somebody and his cow-orker are writing a book about it. (Yes, Ryan and I have been pretty busy on this thing; in fact, I get to work on edits to a couple more chapters tonight after I leave work and Ryan is busy rocking the house with some phat lab tracks for your testing and learning pleasure.)

Of course, my absolutely favorite features of DPM 2007 are:

DPM makes it easy it makes protecting and restoring Exchange data. Imagine being able to restore an individual mailbox without having to do brick-level MAPI backups! You can do it with DPM.
In fact, DPM synchronizes your databases and transaction logs, so you can restore your data to any specific recovery point.
DPM 2007 takes a page from the Exchange 2007 playbook with the DPM Management Shell, based on Windows PowerShell. It's not quite as pervasive as the EMS, but it's a damned good start.

But don't take my word for it -- download the evaluation software and start playing with it.

Testing your new Exchange 2007 Send connector

Devin L. Ganger — Tue, 25 Sep 2007 20:21:00 GMT

Devin covers a common Exchange 2007 upgrade scenario: how to install a new Exchange 2007 Send connector and test it, then change route costs -- all without disrupting existing mail flow in your organization.

Using PowerShell to admin Exchange 2000/2003

Devin L. Ganger — Tue, 11 Sep 2007 00:23:00 GMT

Via Evan's blog, I found out about this pair of postings on using PowerShell's WMI provider to manage Exchange 2000/2003 servers. I'm still working up my notes on my Exhange Connections session on this topic; once I get past the first draft deadline for the DPM book later this week, I should have spare time to finish the notes and get my postings up online.

Post-Connections post

Devin L. Ganger — Fri, 06 Apr 2007 00:27:00 GMT

Devin returns from the Exchange Connections conference in Orlando and shares the PowerPoint presentations for his sessions.

Need some PowerShell help

Devin L. Ganger — Thu, 29 Mar 2007 19:38:00 GMT

Normally, when I write a blog post, I'm trying to help other people out. I forget that it can work both ways. So, today's post is a plea for help: if you know a lot about PowerShell, I could use an answer to the following three questions. If you've got any insights, please drop me an email using the Contact link.

Question the First:

I've got a script that manipulates a user's delivcontlength property in Exchange 2003. This helps me manage the situation where I've got a few users who need to be able to receive 20MB messages while most everyone else only needs 10MB. My script grabs all of the user objects in the directory, iterates through the collection, checks to see if the user is one of the special users, and if not it sets the per-user limit to be 10MB.

$ds=New-Object DirectoryServices.DirectorySearcher
$ds.Filter="(&(objectcategory=person)(objectclass=user))"
$AllUsers=$ds.FindAll()
Foreach ($User in $AllUsers) {
  $oUser=$User.GetDirectoryEntry()
  if ($oUser.sAMAccountName -ne "deving") {
    $oUser.Put("delivcontlength", "10240")
    $oUser.SetInfo()
    $oUser.psbase.RefreshCache()
  }
  $oUser | select displayname,delivcontlength
}

This script does what I want to do, but what I don't know how to do is reset the delivcontlength attribute. If there's no per-user limit set, this attribute doesn't exist on the user object -- so how do I remove an attribute through PowerShell? Setting it to 0 doesn't work.

Edit: The correct answer is to use the PutEx method, which allows you to handle a collection of attributes, as well as delete existing attributes. I'll post an updated snippet of code next week that shows how to use PutEx in live code. Thanks to Andy Webb for the answer.

Question the Second:

Continuing with the delivcontlength attribute, when I go to check its value on a single user:

$oUser.Get(“delivcontlength”)

This throws an exception if the attribute isn’t set. How do I trap that exception inside of a script so I know that the property doesn’t exist, and can do something else based on that information?

Edit: The answer, again from Andy Web, is to use the GetEx method and specify the delivcontlength as one of the attributes in the collection. Then, check to see if a value is returned in the array.

Question the Third:

Given a variable with a DN, what is the easiest way to open the corresponding object using ADSI? I've tried the following with no success:

$DN = "LDAP://red-dc01:389/CN=Devin Ganger,OU=Users,OU=3Sharp Accounts,DC=redmond,DC=3sharp,DC=com"
$oUser = [ADSI]$DN

The point, of course, is to be able to retrieve the DNs from some other list such as a CSV and perform some operation on the listed objects by iterating through with a loop.

Edit: I'm told that this should in fact work. When I go paste it into a clean instance, it does, in fact work. Weird!

Getting to know the legacy Routing Group Connector in Exchange 2007

Devin L. Ganger — Tue, 06 Mar 2007 08:49:00 GMT

Devin introduces the legacy interop Routing Group Connector in Exchange 2007, shows how it connects Exchange 2007 and Exchange 2000/2003 servers, and demonstrates modifying it using the Exchange Management Shell.