Documentation Restructure
This commit is contained in:
@@ -0,0 +1,71 @@
|
||||
**Purpose**: If you want to set up automatic Let's Encrypt SSL certificates on a Microsoft Exchange server, you have to go through a few steps to install the WinACME bot, and configure it to automatically renew certificates.
|
||||
|
||||
!!! note "ACME Bot Provisioning Considerations"
|
||||
This document assumes you want a fully-automated one-liner command for configuring the ACME Bot, it is also completely valid to go step-by-step through the bot to configure the SSL certificate, the IIS server, etc, and it will automatically create a Scheduled Task to renew on its own. The whole process is very straight-forward with most answers being the default option.
|
||||
|
||||
### Download the Win-ACME Bot:
|
||||
|
||||
* Log into the on-premise Exchange Server via Datto RMM
|
||||
* Navigate to: [https://www.win-acme.com/](https://www.win-acme.com/)
|
||||
* On the top-right of the website, you will see a "**Download**" button with the most recent version of the Win-ACME bot
|
||||
* Extract the contents of the ZIP file to "**C:\\Program Files (x86)\\Lets Encrypt**"
|
||||
* Make the "**Lets Encrypt**" folder if it does not already exist
|
||||
|
||||
### Configure `settings_default.json`:
|
||||
|
||||
* The next step involves us making a modification to the configuration of the Win-ACME bot that allows us to export the necessary private key data for Exchange
|
||||
* Using a text editor, open the "**settings\_default.json**" file
|
||||
* Look for the setting called "**PrivateKeyExportable**" and change the value from "**false**" to "**true**"
|
||||
* Save and close the file
|
||||
|
||||
### Download and Install the SSL Certificate:
|
||||
|
||||
* Open an administrative Command Line (DO NOT USE POWERSHELL)
|
||||
* Navigate to the Let's Encrypt bot directory: `CD "C:\Program Files (x86)\Lets Encrypt"`
|
||||
* Invoke the bot to automatically download and install the certificate into the IIS Server that Exchange uses to host the Exchange Server
|
||||
* Be sure to change the placeholder subdomains to match the domain of the actual Exchange Server
|
||||
* (e.g. "**mail.example.org**" | "**autodiscover.example.org**")
|
||||
```
|
||||
wacs.exe --target manual --host mail.example.org,autodiscover.example.org --certificatestore My --acl-fullcontrol "network service,administrators" --installation iis,script --installationsiteid 1 --script "./Scripts/ImportExchange.ps1" --scriptparameters "'{CertThumbprint}' 'IIS,SMTP,IMAP' 1 '{CacheFile}' '{CachePassword}' '{CertFriendlyName}'" --verbose
|
||||
```
|
||||
|
||||
* When the command is running, it will ask for an email address for alerts and abuse notifications, just put "**infrastructure@bunny-lab.io**"
|
||||
* If you run into any unexpected errors that result in anything other than exiting with a status "0", consult with Nicole Rappe to proceed
|
||||
* Check that the domain of the Exchange Server is reachable on port 80 as Let's Encrypt uses this to build the cert.
|
||||
* Searching the external IP of the server on [Shodan](https://www.shodan.io/) will reveal all open ports.
|
||||
|
||||
### Troubleshooting:
|
||||
If you find that any of the services such as [https://mail.example.org/ecp](https://mail.example.org/ecp), [https://autodiscover.example.org](https://autodiscover.example.org), or [https://mail.example.org/owa](https://mail.example.org/owa) do not let you log in, proceed with the steps below to correct the "Certificate Binding" in IIS Manager:
|
||||
|
||||
* Open "**Server Manager**" > Tools > "**Internet Information Services (IIS) Manager**"
|
||||
* Expand the "**Connections**" server tree on the left-hand side of the IIS Manager
|
||||
* Expand the "**Sites**" folder
|
||||
* Click on "**Default Web Site**"
|
||||
* On the right-hand Actions menu, click on "**Bindings...**"
|
||||
* A table will appear with different endpoints on the Exchange server > What you are looking for is an entry that looks like the following:
|
||||
* **Type**: https
|
||||
* **Host Name**: autodiscover.example.org
|
||||
* **Port**: 443
|
||||
* Double-click on the row, or click one then click the "**Edit**" button to open the settings for that endpoint
|
||||
* Under "**SSL Certificate**" > Make sure the certificate name matches the following format: "**\[Manual\] autodiscover.example.org @ YYYY/MM/DD**"
|
||||
* If it does not match the above, use the dropdown menu to correct it and click the "**OK**" button
|
||||
* **Type**: https
|
||||
* **Host Name**: mail.example.org
|
||||
* **Port**: 443
|
||||
* Repeat the steps seen above, except this time for "**mail.example.org**"
|
||||
* Click on "**Exchange Back End**"
|
||||
* On the right-hand Actions menu, click on "**Bindings...**"
|
||||
* A table will appear with different endpoints on the Exchange server > What you are looking for is an entry that looks like the following:
|
||||
* **Type**: https
|
||||
* **Host Name**: <blank>
|
||||
* **Port**: 444
|
||||
* Repeat the steps seen above, ensuring that the "**\[Manual\] autodiscover.example.org @ YYYY/MM/DD**" certificate is selected and applied
|
||||
* Click the "**OK**" button
|
||||
* On the left-hand menu under "**Connections**" in IIS Manager, click on the server name itself
|
||||
* (e.g. "**EXAMPLE-EXCHANGE (DOMAIN\\dptadmin**")
|
||||
* On the right-hand "**Actions**" menu > Under "Manage Server" > Select "Restart"
|
||||
* Wait for the IIS server to restart itself, then try accessing the webpages for Exchange that were exhibiting issues logging in
|
||||
|
||||
### Additional Documentation:
|
||||
|
||||
* [https://www.alitajran.com/install-free-lets-encrypt-certificate-in-exchange-server/](https://www.alitajran.com/install-free-lets-encrypt-certificate-in-exchange-server/)
|
||||
@@ -0,0 +1,117 @@
|
||||
**Purpose**:
|
||||
This document is meant to be an abstract guide on what to do before installing Cumulative Updates on Microsoft Exchange Server. There are a few considerations that need to be made ahead of time. This list was put together through shere brute-force while troubleshooting an update issue for a server on 12/16/2024.
|
||||
|
||||
!!! abstract "Overview"
|
||||
We are looking to add an administrative user to several domain security groups, adjust local security policy to put them into the "Manage Auditing and Security Logs" security policy, and run the setup.exe included on the Cumulative Update ISO images within a `SeSecurityPrivilege` operational context.
|
||||
|
||||
## Domain Group Membership
|
||||
You have to be logged in with a domain user that possesses the following domain group memberships, if these group memberships are missing, the upgrade process will fail.
|
||||
|
||||
- `Enterprise Admins`
|
||||
- `Schema Admins`
|
||||
- `Organization Management`
|
||||
|
||||
## User Rights Management
|
||||
You have to be part of the "**Local Policies > User Rights Assignment > "Manage Auditing and Security Logs**" security policy. You can set this via group policy management or locally on the Exchange server via `secpol.msc`. This is required for the "Monitoring Tools" portion of the upgrade.
|
||||
|
||||
It's recommended to reboot the server after making this change to be triple-sure that everything was applied correctly.
|
||||
|
||||
!!! note "Security Policy Only Required on Exchange Server"
|
||||
While the `Enterprise Admins`, `Schema Admins`, and `Organization Management` security group memberships are required on a domain-wide level, the security policy membership for "Manage Auditing and Security Logs" mentioned above is only required on the Exchange Server itself. You can create a group policy that only targets the Exchange Server to add this, or you can make your user a domain-wide member of "Manage Auditing and Security Logs" (Optional). If no existing policies are in-place affecting the Exchange server, you can just use `secpol.msc` to manually add your user to this security policy for the duration of the upgrade/update (or leave it there for future updates).
|
||||
|
||||
## Running Updater within `SeSecurityPrivilege` Operational Context
|
||||
At this point, you would technically be ready to invoke `setup.exe` on the Cumulative Update ISO image to launch the upgrade process, but we are going to go the extra mile to manually "Enable" the `SeSecurityPrivilege` within a Powershell session, then use that same session to invoke the `setup.exe` so the updater runs within that context. This is not really necessary, but something I added as a "hail mary" to make the upgrade successful.
|
||||
|
||||
### Open Powershell ISE
|
||||
The first thing we are going to do, is open the Powershell ISE so we can copy/paste the following powershell script, this script will explicitely enable `SeSecurityPrivilege` for anyone who holds that privilege within the powershell session.
|
||||
|
||||
!!! warning "Run Powershell ISE as Administrator"
|
||||
In order for everything to work correctly, the ISE has to be launched by right-clicking "Run as Administrator", otherwise it is guarenteed that the updater application will fail at some point.
|
||||
|
||||
```powershell title="SeSecurityPrivilege Enablement Script"
|
||||
# Create a Privilege Adjustment
|
||||
$definition = @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public class Privilege
|
||||
{
|
||||
const int SE_PRIVILEGE_ENABLED = 0x00000002;
|
||||
const int TOKEN_ADJUST_PRIVILEGES = 0x0020;
|
||||
const int TOKEN_QUERY = 0x0008;
|
||||
const string SE_SECURITY_NAME = "SeSecurityPrivilege";
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
public static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, out IntPtr TokenHandle);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
|
||||
public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, int BufferLength, IntPtr PreviousState, IntPtr ReturnLength);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
public struct TOKEN_PRIVILEGES
|
||||
{
|
||||
public int PrivilegeCount;
|
||||
public long Luid;
|
||||
public int Attributes;
|
||||
}
|
||||
|
||||
public static bool EnablePrivilege()
|
||||
{
|
||||
IntPtr tokenHandle;
|
||||
TOKEN_PRIVILEGES tokenPrivileges;
|
||||
|
||||
if (!OpenProcessToken(System.Diagnostics.Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out tokenHandle))
|
||||
return false;
|
||||
|
||||
if (!LookupPrivilegeValue(null, SE_SECURITY_NAME, out tokenPrivileges.Luid))
|
||||
return false;
|
||||
|
||||
tokenPrivileges.PrivilegeCount = 1;
|
||||
tokenPrivileges.Attributes = SE_PRIVILEGE_ENABLED;
|
||||
|
||||
return AdjustTokenPrivileges(tokenHandle, false, ref tokenPrivileges, 0, IntPtr.Zero, IntPtr.Zero);
|
||||
}
|
||||
}
|
||||
"@
|
||||
|
||||
Add-Type -TypeDefinition $definition
|
||||
[Privilege]::EnablePrivilege()
|
||||
```
|
||||
|
||||
### Validate Privilege
|
||||
At this point, we now have a powershell session operating with the `SeSecurityPrivilege` privilege enabled. We want to confirm this by running the following commands:
|
||||
|
||||
```powershell
|
||||
whoami # (1)
|
||||
whoami /priv # (2)
|
||||
```
|
||||
|
||||
1. Output will appear similar to "bunny-lab\nicole.rappe", prefixing the username of the person running the command with the domain they belong to.
|
||||
2. Reference the privilege table seen below to validate the output of this command matches what you see below.
|
||||
|
||||
| **Privilege Name** | **Description** | **State** |
|
||||
| :--- | :--- | :--- |
|
||||
| `SeSecurityPrivilege` | Manage auditing and security log | Enabled |
|
||||
|
||||
### Execute `setup.exe`
|
||||
Finally, at the last stage, we mount the ISO file for the Cumulative Update ISO (e.g. 6.6GB ISO image), and using this powershell session we made above, we navigate to the drive it is running on, and invoke setup.exe, causing it to run under the `SeSecurityPrivilege` operational state.
|
||||
|
||||
```powershell
|
||||
D: <ENTER> # (1)
|
||||
.\Setup.EXE /m:upgrade /IAcceptExchangeServersLicenseTerms_DiagnosticDataON # (2)
|
||||
```
|
||||
|
||||
1. Replace this drive letter with whatever letter was assigned when you mounted the ISO image for the Exchange Updater.
|
||||
2. This launches the Exchange updater application. Be patient and give it time to launch. At this point, you should be good to proceed with the update. You can optionally change the argument to `/IAcceptExchangeServersLicenseTerms_DiagnosticDataOFF` if you do not need diagnostic data.
|
||||
|
||||
!!! success "Ready to Proceed with Updating Exchange"
|
||||
At this point, after doing the three sections above, you should be safe to do the upgrade/update of Microsoft Exchange Server. The installer will run its own readiness checks for other aspects such as IIS Rewrite Modules and will give you a link to download / upgrade it separately, then giving you the option to "**Retry**" after installing the module for the installer to re-check and proceed.
|
||||
|
||||
## Post-Update Health Checks
|
||||
After the update(s) are installed, you will likely want to check to ensure things are healthy and operational, validating mail flow in both directions, running `Get-Queue` to check for backlogged emails, etc.
|
||||
|
||||
!!! note "Under Construction"
|
||||
This section is under construction and will be based on some feedback from others to help build the section out.
|
||||
@@ -0,0 +1,72 @@
|
||||
## Purpose
|
||||
If you operate an Exchange Database Availability Group (DAG) with 2 or more servers, you may need to do maintenance to one of the members, and during that maintenance, it's possible that one of the databases of the server that was rebooted etc will be out-of-date. In case this happens, it may suspend the database replication to one of the DAG's member servers.
|
||||
|
||||
## Checking DAG Database Replication Status
|
||||
You will want to first log into one of the DAG servers and open the *"Exchange Management Shell"*. From there, run the following command to get the status of database replication. An example of the kind of output you would see is below the command.
|
||||
|
||||
```powershell
|
||||
Get-MailboxDatabaseCopyStatus * | Format-Table Name, Status, CopyQueueLength, ReplayQueueLength, ContentIndexState
|
||||
```
|
||||
|
||||
| **Name** | **Status** | **CopyQueueLength** | **ReplayQueueLength** | **ContentIndexState** |
|
||||
| :--- | ---: | ---: | ---: | ---: |
|
||||
| DB01\MX-DAG-01 | Mounted | 0 | 0 | Healthy |
|
||||
| DB01\MX-DAG-02 | Healthy | 0 | 0 | Healthy |
|
||||
|
||||
!!! info "Example Output Breakdown"
|
||||
In the above example output, you can see that there are two member servers in the DAG, `MX-DAG-01` and `MX-DAG-02`. Then you will see that there is a status of `Mounted`, this means that `MX-DAG-01` is the active production server; this means that it is handling all mailflow and web requests / webmail.
|
||||
|
||||
**CopyQueueLength**: This is a number of database "*transaction logs*" that have taken place since a replica database stopped getting updates. This is the queue of all database transactions that are being copied from the production (mounted) database to replica databases. This data is not immediately written to the replica database(s).
|
||||
|
||||
**CopyReplayLength**: This represents the queue of all data that was successfully copied from the production database to the replica database on the given DAG member that still needs to process on the replica database. The "**CopyQueueLength**" will need to reach zero before the "**CopyReplayLength**" will start making meaningful progress to reaching zero.
|
||||
|
||||
When both the "**CopyQueueLength**" and "**CopyReplayLength**" queues have reached zero, the replica database(s) will have reached 100% parity with the production (active/mounted) database.
|
||||
|
||||
## Changing Active/Mounted DAG Member
|
||||
You may find that you need to perform work on one of the DAG members, and that requires you to failover the responsibility of hosting the Exchange environment to one of the other members of the DAG. You can generally do this with one command, seen below:
|
||||
```powershell
|
||||
Move-ActiveMailboxDatabase -Identity "DB01" -ActivateOnServer "MX-DAG-02" -MountDialOverride BestAvailability
|
||||
```
|
||||
|
||||
!!! info "Argument Breakdown"
|
||||
`-MountDialOverride`
|
||||
Specifies how tolerant Exchange should be to database copy health when mounting a database on the target server. This setting controls the level of availability Exchange requires before mounting the mailbox database after the move.
|
||||
|
||||
`-MountDialOverride`
|
||||
Instructs Exchange to mount the database as long as at least one healthy copy is available. This option maximizes uptime by allowing a database to mount even if some copies are unhealthy, prioritizing availability over strict health checks.
|
||||
|
||||
## Troubleshooting
|
||||
You may run into issues where either the `Status` or `ContentIndexState` are either Unhealthy, Suspended, or Failed. If this happens, you need to resume replication of the database from the production active/mounted server to the server that is having issues. In the worst-case, you would re-seed the replica database from-scratch.
|
||||
|
||||
### If `Status` is Unhealthy or Suspended
|
||||
If one of the DAG members has a status of "**Unhealthy**", you can run the following command to attempt to resume replication.
|
||||
```powershell
|
||||
Resume-MailboxDatabaseCopy -Identity "DB01\MX-DAG-02"
|
||||
```
|
||||
|
||||
If this fails to cause replication to resume, you can try telling the database to just focus on replication, which tells it to copy the queues and replay them on the replica database, while avoiding interacting with the "**ContentIndexState**" which can be individually fixed in the commands below:
|
||||
```powershell
|
||||
Resume-MailboxDatabaseCopy -Identity "DB01\MX-DAG-02" -ReplicationOnly
|
||||
```
|
||||
|
||||
### If `Status` is `ServiceDown`
|
||||
If you see this, it generally means that the Exchange Services for some reason or another are not running. You can remediate this with a powershell script. You will then have to double-check your work to ensure that all "Microsoft Exchange" services that have a startup mode of "Automatic" are running, if not, manually start them, then check on the status of the DAG again to see if the status changes from `ServiceDown` to `Healthy`. Depending on the speed of the Exchange server, it may take a few minutes, 5-10 minutes, for the services to fully initialize and be ready to handle requests. Go get a coffee and come back and check on the status of the DAG at that time.
|
||||
|
||||
[:material-powershell: Restart Exchange Services Script](../restart-exchange-services.md){ .md-button }
|
||||
|
||||
### If `ContentIndexState` is Unhealthy or Suspended
|
||||
If you see that the "ContentIndexState" is unhappy, you can run the following command to force it to re-seed / rebuild itself. (This is non-destructive this this is happening on a replica database).
|
||||
```powershell
|
||||
Update-MailboxDatabaseCopy "DB01\MX05" -CatalogOnly -BeginSeed
|
||||
```
|
||||
|
||||
### If Replica Database is FUBAR
|
||||
If the replica database just is not playing nice, you can take the *nuclear option* of completely rebuilding the replica database.
|
||||
|
||||
!!! warning
|
||||
This will destroy the replica database, so be careful to ensure you have a backup (if possible) before you do this. The following command will completely replace the replica database and replicate the data from the production active/mounted database to the newly-created replica database.
|
||||
```powershell
|
||||
Update-MailboxDatabaseCopy -Identity "DB01\MX-DAG-02" -SourceServer "MX-DAG-01"
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
### Purpose:
|
||||
Sometimes Microsoft Exchange Server will misbehave and the services will need to be *bumped* to fix them. This script iterates over all of the Exchange-related services and restarts them automatically for you.
|
||||
|
||||
``` powershell
|
||||
$servicelist = Get-Service | Where-Object {$_.DisplayName -like "Microsoft Exchange *"}
|
||||
$servicelist += Get-Service | Where-Object {$_.DisplayName -eq "IIS Admin Service"}
|
||||
$servicelist += Get-Service | Where-Object { $_.DisplayName –eq "Windows Management Instrumentation" }
|
||||
$servicelist += Get-Service | Where-Object { $_.DisplayName –eq "World Wide Web Publishing Service" }
|
||||
|
||||
foreach($service in $servicelist){
|
||||
Set-Service $service -StartupType Automatic
|
||||
Start-Service $service
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,20 @@
|
||||
**Purpose**: Sometimes you need to set an autoreply on a mailbox on behalf of someone else. In these cases, you can leverage the "Exchange Admin Shell" to configure an auto-reply to anyone who sends an email to the mailbox.
|
||||
|
||||
In the example below, replace `<username>` with the shortened username of the target user. (e.g. `nicole.rappe` not `nicole.rappe@bunny-lab.io`)
|
||||
|
||||
``` powershell
|
||||
Set-MailboxAutoReplyConfiguration -Identity <username> -AutoReplyState Scheduled -StartTime "1/1/2025 00:00:00" -EndTime "1/15/2025 00:00:00" -InternalMessage "Example,<br><br>Message here.<br><br>Thank you." -ExternalMessage "Example,<br><br>Message here.<br><br>Thank you."
|
||||
```
|
||||
|
||||
!!! note "Internal vs External"
|
||||
When you configure auto-replies, you can have different replies sent to people within the same organization versus external senders, keep this in mind based on the roles of the person.
|
||||
|
||||
!!! example "Example Email Reply"
|
||||
The email auto reply will look something like this based on the command above.
|
||||
```
|
||||
Example,
|
||||
|
||||
Message Here.
|
||||
|
||||
Thank you.
|
||||
```
|
||||
Reference in New Issue
Block a user