Search-AdminAuditLog and Search-MailboxAuditLog with parameter return empty results in Exchange 2019 server

 Search-AdminAuditLog and Search-MailboxAuditLog with parameter return empty results - Exchange | Microsoft Docs

How to enable online archive in Hybrid Exchange

https://social.technet.microsoft.com/wiki/contents/articles/51966.office-365-hybrid-enabling-in-place-archive-with-powershell.aspx

Once more about Skype EWS

http://www.uclabs.blog/2013/01/lync-and-exchange-web-services-ews-and.html

if you have SIP and SMTP (primary) different, then you need to make sure that autodiscover works ok.  You can redirect _autodiscover._tcp_smtp.domain to autodiscover.another.smpt.domain 443 if the later is defined and works ok.  Then you do not need to worry about UC SAN SSL.

With autodiscover.smpt.domain SFB client will try to connect directly, with SRV you can redirect to another domain.

Exchange 2016 CU15 tips

run updatecas.ps1 script to fix OWA and ECP
also check out this

https://social.technet.microsoft.com/Forums/windowsserver/en-US/5259018c-aec7-4490-a500-e1af54798f14/exchange-2013-ecp-error-line-43?forum=exchangesvrgeneral

1. Application Settings >> BinSearchFolders
2. Change the path with C:\Program Files\Microsoft\Exchange Server\V15\bin;C:\Program Files\Microsoft\Exchange Server\V15\bin\CmdletExtensionAgents;C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\Owa\bin
3. Then reset IIS to check this issue.

how to put server in maintenance mode:

https://practical365.com/exchange-server/installing-cumulative-updates-on-exchange-server-2016/

https://www.enowsoftware.com/solutions-engine/exchange-2019-cu4-and-exchange-2016-cu15-explained


# start maintenance on the computer

$Computer = $ENV:ComputerName
Set-ServerComponentState $Computer -Component HubTransport -State Draining -Requester Maintenance
Redirect-Message -Server $Computer -Target

# Prevent DAG member becoming PAM
Suspend-ClusterNode $Computer

# Move all Mailbox Databases and prevent hosting copies on current server
Set-MailboxServer $Computer -DatabaseCopyActivationDisabledAndMoveNow $True
Set-MailboxServer $Computer -DatabaseCopyAutoActivationPolicy Blocked

# Put the Exchange 2013 server in Maintenance Mode:
Set-ServerComponentState $Computer -Component ServerWideOffline -State Inactive -Requester Maintenance
# verify

Get-ServerComponentState $Computer | ft Component,State –Autosize


# stop maintenance on the computer

$Computer = $ENV:ComputerName
Set-ServerComponentState $Computer -Component ServerWideOffline -State Active -Requester Maintenance
Resume-ClusterNode $Computer
Set-MailboxServer $Computer -DatabaseCopyActivationDisabledAndMoveNow $False
Set-MailboxServer $Computer -DatabaseCopyAutoActivationPolicy Unrestricted
Set-ServerComponentState $Computer -Component HubTransport -State Active -Requester MaintenanceRestart-Service MSExchangeTransport
Restart-Service MSExchangeFrontEndTransport

Get-ServerComponentState $Computer | ft Component,State –Autosize

.net 4.8 is slow

First of all it is slow, yes, wait up to 30 minutes...

Otherwise start Windows installer service is not running as well as go via link below:

https://dotnet.microsoft.com/download/dotnet-framework/net48


https://support.microsoft.com/en-us/help/2570538/installing-updates-for-the-microsoft-net-framework-4-can-take-longer-t

https://www.catalog.update.microsoft.com/Search.aspx?q=4486153

Exchange internal relay must not include Exchange DAG servers

We see some issues with Shadow queue accumulating on one of the servers, it seems to be related to the fact that Exchange servers have been added to internal FrontEnd relay connector:

https://practical365.com/exchange-server/no-need-create-connectors-internal-exchange-server-mail-flow/

We see that this server is not cleaning shadow often enough - look for code XQDISCARD
in the hub smtp logs on other servers:

https://docs.microsoft.com/en-us/exchange/mail-flow/transport-high-availability/shadow-redundancy?view=exchserver-2019

Exchange hybrid migration errors decoded

https://blogs.technet.microsoft.com/exovoice/2017/06/30/hybridmigrationerrors/

OWA or ECP ADFS error "wrongaudienceuriorbadsigningcert"

https://vandijk.cloud/ad-fs-for-ecp-or-owa-fails-with-error-wrongaudienceuriorbadsigningcert/

Office 365 Exchange Online Protection and DMARC

If you want to protect your domain with DMARC or use DMARC to filter spam and you use Office 365, note that Microsoft decided to alter normal DMARC policy. Imagine the domain protects itself and a message was identified as DMARC=fail and policy is set to reject with 100%. DMARC policy example: v=DMARC1;p=reject;pct=100
Office 365 will ignore reject and will deliver email marked as spam. A header will contain

"dmarc=fail action=oreject" (oreject being overwritten reject.)

Here is how Microsoft justifies this design decision:

"If the DMARC policy of the sending server is p=reject, EOP marks the message as spam instead of rejecting it. In other words, for inbound email, Office 365 treats p=reject and p=quarantine the same way.

Office 365 is configured like this because some legitimate email may fail DMARC. For example, a message might fail DMARC if it is sent to a mailing list that then relays the message to all list participants. If Office 365 rejected these messages, people could lose legitimate email and have no way to retrieve it. Instead, these messages will still fail DMARC but they will be marked as spam and not rejected. If desired, users can still get these messages in their inbox through these methods:

• Users add safe senders individually by using their email client
• Administrators create an Exchange mail flow rule (also known as a transport rule) for all users that allows messages for those particular senders."

https://docs.microsoft.com/en-us/office365/securitycompliance/use-dmarc-to-validate-email#inbounddmarcfail

Client connectivity in Exchange 2016 and 2010 co-existence

https://blogs.technet.microsoft.com/exchange/2015/10/26/client-connectivity-in-an-exchange-2016-coexistence-environment-with-exchange-2010/

No UC in Exchange 2019?

http://www.expta.com/2018/07/say-bye-bye-to-exchange-unified.html 

Exchange and Skype for Business error 14563: Two servers cannot be configured at the same FQDN with different server version numbers.

Event ID 14563
Source LS Protocol Stack

Two servers cannot be configured at the same FQDN with different server version numbers.

Cannot configure a server at FQDN [exchange.doamin.com] because another server is already configured there with a different server version number.
Cause: This is a configuration problem.
Resolution:
Review the server roles that are configured at this FQDN and ensure that they have identical version numbers.


Please review https://blogs.technet.microsoft.com/jenstr/2012/11/13/when-to-have-a-lync-trusted-application-pool-for-exchange-owa-im-integration/


It seems that you have trustedapplicationpool defined in Topology and also UM server is assigned for a dial plan.  This will push twice server name to Skype.

Remove from topology or if you have several servers, do it in the way that it is popolated without a conflict.

ExMon - a tool to measure Exchange 2016 usage

https://blogs.technet.microsoft.com/exchange/2016/02/16/exchange-2013-and-2016-exmon-tool-is-now-available/

Exchange 2016 Prefered Architecture

Microsoft has designed a Prefered Architecture model (PA) which sounds more like Sci-fi for real world installation - companies want to use Virtualisation, PA talk about physical servers, companies want SAN, PA - DAS, etc.

Get more information here: http://video.ch9.ms/sessions/ignite/2015/decks/BRK3197_Smith.pptx

few more session dedicated to PA: https://blogs.technet.microsoft.com/nawar/2017/10/04/ignite-2017-exchange-sessions/

And the epic one: https://www.youtube.com/watch?v=i5rsxynRI4E    realworld non-PA implementations.

Integration with Exchange Online breaks Skype for Business federation

Hello,

if you follow this article to setup your  integration with Exchange online (for voicemail)
https://blogs.technet.microsoft.com/nexthop/2016/03/29/integrate-on-premise-lync-or-skype-for-business-with-office-365-unified-messaging-um/comment-page-3/#comments


you may kill your sfb federation. If this is a case, please note a following specificity of SFB:

when you set up Edge, you will be confronted with a choice, where to set your DNS. You can set it to external DNS, such as 8.8.8.8  or your internal DNS.

If you select external, you might need to define some hosts file entry like for FrontEnd pool, etc. Not ideal, right?

then you select internal DNS. However once you run

New-CsHostingProvider -Identity UMonline-Enabled $True -EnabledSharedAddressSpace $True -HostsOCSUsers $False -ProxyFQDN "exap.um.outlook.com" -IsLocal $False -VerificationLevel UseSourceVerification


you cut all federation. This is due to the fact that after this powershell , the edge will try to look for it's own SRV _sipfederationtls._tcp   and because it is usually not defined internally, it will fail.

Solution is to check what is defined externally and in internal split DNS zone create exactly the same (SRV pointing to A record of to external public IP of edge access (SIP) interface. 

Polycom VVX debug

I had a case when VVX did not work for hybrid Exchange with Lync onPremises, I spent a lot of time to understand why it is not working until I enabled logging for CURL as DEBIG :)

As always the problem was in SSL Certificates.

Polycom VVX for hybrid Exchange

Polycom FW version 5.5.3 and Exchange hybrid.

From the logs we see that Polycom tries to perform autodiscover, but finally fails and leave EWS not deployed for online users.  I will continue debuging that, but I found a workaround:

login with sip and UPN  as username@domain.com but leaving domain field empty.
Then in settings-applications-exchange server URL you can hardcode:

https://outlook.office365.com/EWS/Exchange.asmx/WSSecurity

and leave autodiscover disabled.

Update: with CURL DEBUG we can see that problem was in SSL certificates of Digicert not being trusted due to limits we left from other tests in Network - TLS - Application profile 6 (select certificates from platform or imported, but we had only one certificte selected). I also imported Digicert root, as for unknown reasons outlook is based on that while rest of MS is Baltimore.

Inside exchutil.ps1

https://flinchbot.com/2013/09/09/exchucutil/

Exchange 2016 UM telephone extension dial plan

If you integrate Avaya or Cisco to Exchange 2016 UM, you may be surpised that a Dial plan with Tel. extension can't be associated with a Exchange 2016 server. Error message "The dial plan can’t be associated with the Client Access server. Only SIP URI dial plans can be associated with Exchange 2013 Client Access servers".  Do not worry, server will still respond and use this dial plan:


https://social.technet.microsoft.com/wiki/contents/articles/23416.exchange-2013-unified-messaging-with-cisco-unified-communication-manager.aspx

https://technet.microsoft.com/en-us/library/bb125151(v=exchg.150).aspx

1y free Office 365

FYI: you can get 1y free Office 365 DEV tenant – including software Office 2016 and  up to 25 x Office 365 Enterprise E3 Developer licenses (Exchange, Skype, Sharepoint…) if you join Office devprogram: https://dev.office.com/devprogram 

Goto the very end of the page and click on JOIN DEVELOPER PROGRAM