Some Exchange Topologies

These are some of the most common Exchange topologies I have encountered. Although, I have been expossed to much more bigger environments with multiple domains and sites.  It is in those environments that I find the most challenging situations.  Stay tune as I add more content on this blog.

Moving Exchange 2003 Databases and Transaction Logs files to a SAN LUN or Virtual Disk

If you want to move log files and/or database files to a LUN, use the following procedures. 

 

1.      Attached the SAN LUN to the Exchange server. One for the Database files and one for the Transactional Logs if at all possible (let's say N: and L:)  If not possible, one LUN will suffice for the Database and Transaction Logs.  How big are the databases and how many mailboxes? Do you have Blackberry in the environment? I ask these questions because I'm thinking of performance optimization as well.

 

2.      Create a Folder Structure similar to the original "Exchsrvr\Mdbdata" file structure for consistency reasons (optional).  But, it is recommended  that you have the Folder structure with these permissions specified:

       

Administrators: Full Control

Authenticated Users: Read and Execute, List Folder Contents, Read

Creator Owner: None

Server Operators: Modify, Read and Execute, List Folder Contents, Read, Write

System: Full Control

 

Note Only assign permissions to the Server Operators group if the Exchange server is a domain controller. Otherwise, assign permissions to the Power Users group. Only domain controllers should have permissions to the built-in Server Operators group. Stand-alone and member servers should have permissions to the built-in Power Users group.

       

        You may also have to grant the following permissions to the root drive that contains the new Mdbdata folder:

 

System: Full Control

 

 

3.      Move the Log Files.  Follow this procedure:

 

        a.      Open ESM (Exchange System Manager)

        b.      Expand the Administrative Groups.  If it does not appear, you need to enable the option to show the Administrative Group.  To allow the Administrative group to be shown, right click on the Exchange Organization and click on Properties and click on select the Display Administrative Group check box.

        c.      Locate the Storage Group(s) where you want to change the path for the log files. Right-Click the Storage Group and then click on Properties.

        d.      In the General tab click the browse button next to the Transaction log location box, and then specify the new drive or folder location for the log files.

 

 

4.      Move the databases Files.  Follow this procedure:

 

1. Open ESM (Exchange System Manager)
2. Expand the Administrative Groups that contains the databases that you want to change.
3. Under Storage Group, right-click the mailbox store or the public folder store that you want to change, and then click on Properties.
4. Click the Database tab.
5. Next to the database that you want to change, click Browse, and then specify the new drive folder location for the files.

You can move the EDB and STM files for the databases.

If the databases are still mounted, you will receive a pop-up window message that informs you of the action that you are about to perform will dismount the stores.  Click YES to dismount the database automatically and move the location.

6. When you finish moving the databases, remount the databases manually.

 

One last note, moving log files or database files invalidates all existing incremental and differential backups; therefore, make a full backup after these changes.

 

Regards,

Alessandro

 

How to add an SPF Record

How to Add an SPF Record On a Windows DNS MMC

 

Step 1: Select and open the domain in which you wish to add the SPF record. Right-click in the record list and select "Other New Records..." from the menu.

Step 2: Select the Text (TXT) record type and click the "Create Record..." button.

Step 3: Type the SPF record data in the "Text" textbox. Click the OK button.

 

v=spf1 a –all

or,

v=spf1 mx -all

 

Step 4: If you are done adding new records, click the "Done" button. Note the new SPF TXT record.

 

For adding the SPF record to BIND or TinyDNS (djbdns)

If you run BIND

Paste this into your zone file:

yourdomain.com. IN TXT "v=spf1 a mx ptr include:yourdomain.com ~all"

When a mail server sends a bounce message, it uses a null MAIL FROM: and a HELO address that's supposed to be its own name. SPF will still operate, but in "degraded mode" by using the HELO domain name instead. Because this wizard can't tell which name your mail server uses in its HELO command, it lists all possible names, so there may be multiple lines shown below. If you know which hostname your mail server uses in its HELO command, you should pick out the appropriate entries and ignore the rest.

So this should also appear in DNS. You may or may not be in charge of the DNS for these entries; if you are, add them.

mail.yourdomain.com. IN TXT "v=spf1 a -all"

or, for your parent hosting domain or secondary MX record

smtp.yourHostParentDomain. IN TXT "v=spf1 a -all"

 

If you run tinydns (djbdns)

'yourdomain.com:v=spf1 a mx ptr include\072yourdomain.com ~all:3600

'mail.yourdomain.com:v=spf1 a -all:3600

'smtp.yourdomain.com:v=spf1 a -all:3600

 

 

Alessandro

My C: Drive on my server is running out of space - What to do

A quick and cheap solution will be to move the Page File to a different partition, But, what can you do when your Page File is already in another partition and you have less than 5% of free space on your System or C partition. This is what I did for one of my customers that didn’t have the budget to buy another server and wanted a quick fast solution without bringing the server down while on production.

 

On a HP Proliant server with one array controller and 4 disks configured as a RAID 5 with a C and a D partition.  We physically added a 72 GB hard drive in one of the empty HD slots while the server is running. The HP servers allow you to add a HD on the fly and it will automatically recognize that there is a new hardware in the bay.  

Then, I launched the ACU (Array Controller Utility) under the Array Controller Configuration there is the original RAID5 array and the newly added HD unallocated and not part of the array.

 

The first task is to add the new hard drive to the existing array.  For that, we select the existing array and on the right side there is an option to “Expand” the array.

This process could take hours and in some cases a couple of days.  It depends on the hardware and the array controller memory cache.  You need a minimum of 128MB Cache – I’ve seen 64MB been able to be expanded as well.

After this process has completed, and you could check the progress by refreshing the array status and it will display the percentage completed, there will be an option to “Merge” or “Extend”.

 

Now you need to Extend the array with the newly incorporate hard drive.  This process is faster than the previous, but after this step is completed, you will see the unallocated free space on the Windows Disk Management MMC.

 

For this particular customer I decided to create two mount points. One for the Software Distribution folder and the other one for the Installer folder. These two folders are under the Windows directory or %systemroot%.

 

Now follow these steps in this order:

-              Open the Task Manager and kill the wuauclt.EXE process by selecting it and click on end process.

-              Then, open a CMD prompt and type: net stop "Automatic Updates"

-              Open the Windows Explorer and navigate to the Windows or %systemroot% directory and rename both the “SoftwareDistribution” folder and the “Installer”  to something like “SoftwareDistributionTEMP”  and “InstallerTEMP”

-              Now create two new empty folders labeled “SoftwareDistribution” folder and the “Installer” just as they were originally.

-              Open the Windows Disk Management MMC if don’t have it open.

-              Select the unallocated space and create a new Extended Partition with the all the available unallocated space.

-              Within that new partition we now can create two new Logical Drives mount point formatted as NTFS and with 10GB in size each.

Note: The logical drives don’t need to have a drive letter assign. You want to specify the folder paths that these logical drives will be mounted as

-              Finally, move the content or data inside the Temp folders to the original place.

 

Leave the rest of the unallocated space for future space needs.

 

At last we want to restore the Windows Automatic operations as normal.  Type following command in the CMD prompt:

net start "Automatic Updates"

wuauclt /detectnow

 

Alessandro 01/02/2009

Alan Becker: Animator vs. Animation

Awesome animation Animator vs. Animation by Alan Becker Follow with part deux Animator vs. Animation II, and finally play the game!

The ports you need open from the internal network and the DMZ for a HUB CAS server in the DMZ

I was doing some research about the connectivity of Exchange Front-End with the Back-End and the DCs/GCs,

And I found this article that shows Event ID 2080 and what to look for in reach ability and state of the DCs/GCs.

http://support.microsoft.com/kb/316300/

 

Now, I was on the quest to find what ports we need open in order to deploy a Front-End server in the DMZ.

And these are my findings on the ports you need open:

·         For RPC: 135 TCP and other Dynamic RPC ports for Windows RPC communication

·         For LDAP: 389 TCP and 389 UDP for AD objects lookup to the DC

·         For LDAP GC: 3268 TCP also for AD objects lookup to the DC/GC

·         For Kerberos: 88 TCP and 88 UDP for authentication

·         For DNS: 53 TCP and 53 UDP for name server lookups

 

…and of course these ports 80, 443, and 25 for HTTP(S) and SMTP.

Autodiscover, OWA, EAS, Outlook Anywhere, WebDav and Internet

mail traffic are services that depend on these ports.

 

Other ports that might be important to open if you’re offering these services are:

·         For  POP3: 110 TCP for POP3 client access

·         For POP3 secure: 995 TCP for POP3 secure client access

·         For IMAP4: 143 TCP for IMAP4 client access

·         For IMAP4 secure: 993 TCP for secure IMAP4 client access

 

Some additional port worth noting:

·         For SMB: 445 TCP for GPO support

·         For BackupExec: 10000 TCP and other dynamic ports for BackupExec control signals

 

Some resources to check for more info:

http://support.microsoft.com/?kbid=154596 for RPC dynamic port allocation

http://technet.microsoft.com/en-us/library/bb331973.aspx for Exchange 2007 firewall requirements

http://seer.entsupport.symantec.com/docs/278944.htm for BackupExec configurations with firewalls

 

Peace brothers…

 

“make it so.”

- Captain Jean Luc-Picard, USS Enterprise, NCC 1701-D

 

Alessandro Squeo
SWC | TECHNOLOGY PARTNERS
1420 Kensington Road, Suite 110
Oak Brook, Illinois 60523-2144
630-286-8181 DIRECT
630-572-0390 FAX

www.swc.com
alessandro.squeo@swc.com

 

Monitoring Server Performance

It is good idea to perform a server performance health check and compare it with the baseline from time to time, especially when a major update or software application is installed.  Sometimes, these performance checks can be done to troubleshoot a performance issue with the server and to justify an upgrade to new and additional hardware.

 

One of the tools that most commonly used is Microsoft Performance Monitor and these are the key counters that I collect every 30 seconds or every minute for a period of one week and I later analize.

 

-          Processor(_Total)\%Processor Time

If you're monitoring this counter and it's running at or near100% for extended periods, you should drill down at the process level by examining Process(instance)\%Processor Time counter for various process instances on your server.  For example, on an IIS web server you might track Proces(InetInfo)\%Processor Time, while on Exchange server a good counter to watch is Process(Store)\%Processor Time and so on.

-          Memory Pages/Sec

The number of pages per second should not exceed 50 per paging disk on your system.  Another key counter to watch is Memory\Available Bytes, and if this counter s greater than 10% of the actual RAM in your machine then you probably have more than enough RAM and don't need to worry.

Pages\Sec value counts the number of times per second that the computer must access virtual memory rather than physical memory.  A value of 20 is considered to be problematic, but it might indicate a problem with the way that your virtual memory is configured rather than a problem with the physical memory.

-          Cache Bytes

This counter monitors the amount of memory being used for the file system cache.  Anything over 4 MB is considered to be too much.  The solution is to add more memory

-          Physical Disk (instance)\Disk Transfer/Sec

For each physical disk if it goes above 25 disk I/Os per second then you've got poor response time for your disk. A bottleneck from a disk can significantly impact response time for applications running in your system.  So, you should investigate further by tracking Physical Disk(instance)\%Idle Time, which measures the percent time that your hard disk is idle during the measurement interval, and if you see this counter fall below 20% then you've likely got read\write requests queuing up for your disk which is unable to service these requests in a timely fashion. In this case, it's time to upgrade your hardware to use faster disks or scale up and out your application to better handle the load.

-          Average Disk Queue Length

This counter tells you how many I\O operations are waiting for the hard disk to become available.  Again, this number should be as low as possible.  Experts give different opinions of what is an acceptable value, but my opinion is that the average disk queue length should be 3 or less.

-          Network Interface \ Bytes Total/Sec

Bytes transmitted per second, multiply by 8 to get the amount of bits transmitted per second.  This average amount should not exceed more than 40% of total bandwidth depending of the number of machines and protocols used in the same segment.  The more devices are transmitting in the same segment the more are the packet collisions.

Other network counters to check for more detail network performance monitoring are:

-          Network Interface \ Bytes Sent/Sec

-          Network Interface \ Bytes Received/Sec

-          Network Interface \ Current Bandwidth this is total bandwidth bits

--
Alessandro