Expert Reference Series of White Papers Optimizing Microsoft Exchange in the Enterprise Part II: Hub Transport Server and Lync-SharePoint Integration 1-800-COURSES www.globalknowledge.com
Optimizing Microsoft Exchange in the Enterprise: Hub Transport Server and Lync-SharePoint Integration Boris Gigovic, MCTS, MCITP, CCNA Introduction In Part 1 of our white paper, Optimizing Microsoft Exchange in the Enterprise, we reviewed two core Microsoft Exchange Server roles: Exchange Mailbox Server and Client Access Server. In the second part of this paper, we ll examine optimization of Exchange as a Hub Transport Server, ongoing administration and integration with Microsoft SharePoint and Lync Server. As in most enterprise deployments of Microsoft technology, there are always ways to maximize performance and security while minimizing administration over the lifecycle of the platform. Optimizing the Hub Transport Server The Hub Transport Server, which is responsible for the mail flow in the organization, features very specific settings that allow Exchange administrators to define how e-mail is routed, and also applies on-the-fly policies to that e-mail. This not only allows the sending and receiving of e-mail from the internal world, but also to and from the Internet. Transport rules Transport rules are the mechanism that allows e-mail to be modified while in transit. This can be applied to a message that is going through the Hub Transport Server role. Transport rules can be applied based on filters and conditions, and can be used for multiple purposes. Apply disclaimers to messages Prevent certain types of viruses by patterns Filter confidential information and apply Rights Management Services templates Track and archive messages that are sent or received from specific users Redirect inbound or outbound messages for inspection Prevent communication between specific groups or users A transport rule is configured through the Exchange Management Console (Organization Configuration-> Hub Transport-> New Transport Rule) or Exchange Management Shell, using the following sample cmdlet and parameters. New-TransportRule Name Rule1 Priority 0 Enabled $true from user1@contoso.com SentTo user2@contoso.com BlindCopyTo executives@contoso.com Copyright 2012 Global Knowledge Training LLC. All rights reserved. 2
In this instance, e-mail is copied to specific users when user1 sends an e-mail to user2. More complex settings with appropriate rule priorities can also be set up. Address lists and address book policies Address lists are a collection of mail objects that can be seen through Outlook clients or OWA when an end-user selects a recipient. Address lists are populated to end devices through address book policies that are essentially a collection of address lists. This feature makes it possible to apply filters to generate custom address lists, and then create address book policies to different user groups in the organization. While it is possible to use the default settings, an organization would probably need to create different policies, depending on the way the organization is logically segmented. For instance, an acquisition or merger can occur and, by default, users will see mail objects from both organizations, even if they are legally independent, and they don t communicate. By creating custom address lists, these lists will be smaller and will contain only mail objects that end-users are sending mail to. It is possible to configure these settings through the Exchange Management Console (Organization Configuration-> Mailbox-> Address Lists tab. Once the Address lists are configured, you can create a policy through the Address Book Policies tab. SMTP Connectors and relay agents SMTP connectors need to be configured when mail flows to other organizations or the Internet. They allow the e-mail to be received from the outside world as well. Internal e-mail is also routed through SMTP connectors; however, these are stored in Active Directory (AD) and cannot be seen from the management console. Receive connectors By default, Exchange can receive e-mails from authenticated senders only through default and client connectors. If an organization needs to receive e-mail from the Internet, it must allow anonymous types of connections to the Exchange servers. It is beneficial to create multiple receive connectors and then define more granular authentication methods, depending on who is sending e-mail to Exchange. For example, since e-mail coming from the Internet comes from unauthenticated servers, you can define a smart host or relay agent that receives the e-mail directly from the Internet, and then configure authentication between that relay agent and your Exchange hub servers. All e-mail from the relay would be redirected to your Exchange servers, allowing for greater security on internal servers, as no unauthenticated connection is accepted on Hub servers. Another reason we can create multiple SMTP receive connectors is because internal devices, such as printers and faxes, access Exchange often. These devices all have different authentication settings; thus, you can be more Copyright 2012 Global Knowledge Training LLC. All rights reserved. 3
flexible with authentication in connectors and IP filtering. This way, you are preventing unauthenticated users connecting to your SMTP servers and anonymously sending e-mail. Send connectors It is necessary to create send connectors manually, and preferable to choose to send to a smart host in a DMZ (such as an Edge server or any other SMTP server solution) rather than sending e-mail directly on the Internet from the Hub server (through DNS). Connectors and security Since SMTP traffic is natively passed in clear text and no authentication is necessary, Exchange allows the creation of secure connections through TLS. If two organizations require the use of an encrypted tunnel for e-mail transfer, they can configure mutual authentication as well as data encryption using the TLS mechanism, thereby implementing domain security. These processes work not only by exchanging different certificates between the organizations, but also by creating appropriate send and receive connectors that support TLS using the Partner template. Edge Servers Although it is an optional role, it is certainly a benefit to have Edge Transport servers dealing with external e-mail. While a traditional SMTP relay is configured to route e-mail to and from the Internet, an Edge Transport server has the ability to integrate with your infrastructure and apply security features (anti-spam, transport rules, etc.) before the e-mail even gets into the internal portion of the network. Through Edge Subscriptions and EdgeSync, Edge servers can be informed on the type of infrastructure through Hub servers. Edge servers perform additional steps to ensure the e-mail is delivered to the appropriate Hub server, as well as stopping multiple forms of attacks coming from the Web. A design example would be to implement an Edge server in a DMZ and connect it through EdgeSync to different sites where Hub servers can be found. In this case, we are centralizing the mail flow and allowing the Edge servers to become the hubs of external e-mail traffic. Anti-spam Hub and Edge servers feature anti-spam agents. While other solutions and third-party products exist, the antispam solution Microsoft offers embedded with Exchange works fine in multiple instances. It is not enabled on Hub servers, but administrators can activate the free feature using the Install-AntiSpamAgents.ps1 script. This step is not necessary on Edge servers. When the agents are enabled, an additional tab in the Exchange Management Console (Organization Configuration-> Hub Transport) appears, allowing you to configure different aspects of the anti-spam functionality. Copyright 2012 Global Knowledge Training LLC. All rights reserved. 4
The anti-spam agents work on different layers to stop most unsolicited e-mail, and they include the ability to blacklist known spam servers, filter by recipient and sender domain and SMTP addresses, and Sender ID, as well as some content filtering features with SCLs. Microsoft offers a premium product integrating anti-virus protection, as well as an anti-spam solution: Forefront Online Protection for Exchange, combining multiple out-of-the-box features of the anti-spam component found on Hub and Edge servers. Miscellaneous Features Permissions assignments through RBAC Role-based access control (RBAC) is a permission model introduced in Exchange Server 2010 that allows very granular control over Exchange resources. While the standard RBAC security model meets requirements of most organizations (over 50 management roles are included), administrators can create more specific roles that dictate what control a user can have over a very specific setting, such as modifying quotas of a user mailbox, managing mailbox databases, and configuring transport. The RBAC model is composed of three components. Management role: Defines a set of cmdlets (management role entries) a delegated user can execute (what) Role assignment: Defines the scope of a management role (where). For instance, the delegated control can be assigned to an organizational unit (OU), a group of servers, the domain, etc. Role group: Defines a security group that can perform specific tasks through a role assignment (who) Exchange Server 2010 SP2 now allows administrators to set these up through the Exchange Control Panel web interface, while creation of new management roles can be done through the Exchange Management Shell exclusively. Administrators with appropriate security permissions can view a list of available management roles and cmdlets within a role using the following commands. 1. get-managementrole - Obtaining a list of available management roles available in the organization 2. get-managementroleentry Mail Recipients\* - Obtaining a list of available commands within a management role (obtained from the previous step) Here is a sample process allowing the creation of a new set of permissions with defined scopes. 1. Typically, an existing management role is copied to a new management role through the parent parameter (what). New-Managementrole Name RecipientAdminsSales Parent Mail Recipients Copyright 2012 Global Knowledge Training LLC. All rights reserved. 5
2. Then, unnecessary entries are removed. In this case, we are removing cmdlets from the management role. Get-Managementroleentry RecipientAdminsSales\* where {$_.name ne get-user } removemanagementroleentry 3. It is possible to add cmdlets (in this case set-user) and parameters within a specific cmdlet through the following sample command. Add-Managementroleentry RecipientAdminsSales\set-user -parameters office,department 4. Now that we have modified the management role, we can create a scope. In this case, we can filter by OU. We will allow the change to be performed exclusively on mailbox objects in that OU (where). New-ManagementScope -Name Sales Mailboxes -RecipientRoot contoso.com/sales -RecipientRestrictionFilter {RecipientType -eq UserMailbox } 5. Next, we create a new role group and associate our custom role and scope to it (who). New-rolegroup RecipientAdminsSales Roles RecipientAdminsSales customrecipientwritescope Sales Mailboxes 6. Finally, it is possible to add members to the newly created role group (visible as a universal group in AD) through the AD console, the Exchange Management Shell or through Exchange Control Panel. RBAC can be used in very complex scenarios in order to comply with least privilege access and tighter control when it comes to administering the Exchange organization. Single item recovery When restoring data such as user mailboxes or individual messages, Exchange administrators are used to work with different backup and restore applications. In Exchange Server 2010, Single item recovery allows this operation without the need for third-party software. Single-item recovery is the ability to restore data from a purged location in a user s mailbox. This solution is definitely not the replacement of a standard backup procedure; however, it is useful for faster access to the data to restore without having to deal with backup and restore solutions at all. It works within the same database where the user mailbox is located. Single item recovery must be manually enabled through the Exchange Management Shell. Set-Mailbox User1 -SingleItemRecoveryEnabled $true In order to recover data, a user must be granted a specific set of permissions through the following cmdlet. New-ManagementRoleAssignment -Role Mailbox Import Export -User contoso\administrator Copyright 2012 Global Knowledge Training LLC. All rights reserved. 6
This ensures the user will be able to run specific commands that allow for recovery of items. Also, the user needs to be member of the Discovery Management role group, which allows running a search from the Exchange Control Panel for deleted e-mail, as well as generating a report. Once the report is generated, the delegated user can run the search-mailbox cmdlet to restore a deleted e-mail to the user s mailbox. When enabling this option, it is important to understand that this feature will retain all messages; thus, mailbox databases sizes can significantly increase. It is normally not enabled for all users in the organization. Recovery databases (RDs) Recovery databases are key to the process of restoring information on mailbox servers. An RD can be used as a buffer when restoring information into Exchange. An administrator can restore a mailbox database into a recovery database, and then selectively restore the needed mailboxes into production from the RD. Recovery databases can be used in granular restores, single item recovery scenarios, as well as dial-tone recovery. An RD can be created and mounted using the following sample steps. 1. We restore the database to an alternate location on the mailbox server, such as C:\DBBackup. This location will be populated with the database original path and folders structure (in this case the default location of a DB on the file system). 2. A recovery database is created from the restore location with the following sample cmdlet. New-MailboxDatabase -Name RecoveryDB -Server EX1 -EDBFilePath c:\recoverydb\c_\program Files\Microsoft\Exchange Server\V14\Mailbox\Marketing\Marketing.edb -LogFolderPath c:\ DBBackup\C_\Program Files\Microsoft\Exchange Server\V14\Mailbox\Marketing Recovery 3. It is necessary to clean the shutdown state of the recovered database using the following cmdlet. eseutil /p c:\dbbackup\c_\program Files\Microsoft\Exchange Server\v14\Mailbox\Marketing\Marketing. edb 4. Then, the database is mounted. Mount-Database RecoveryDB 5. Finally, we extract data from the RD using the following cmdlet. Restore-Mailbox -Identity User1 -RecoveryDatabase RecoveryDB Copyright 2012 Global Knowledge Training LLC. All rights reserved. 7
Server recovery In case of a server failure, Exchange 2010 offers a reliable way of restoring configuration quickly. Since a considerable number of settings reside in AD, it is possible to restore the settings. While many Exchange administrators decide to create a completely new member server in the Exchange organization, this process is much simpler and auto-configures major components. After the operating system, updates, drivers, system state and other non-exchange data is reinstalled, we can join the server to the domain and assign it the name of the failed server. At this point, we can run the setup. com /m:recoverserver command. This command will not show the typical installation wizard, but rather connect to the AD configuration partition to retrieve information this server inherits from the organization. After the installation is complete, we find the Exchange Management Tools installed, as well as the roles the failed server had. For mailbox servers, an extra step consists of restoring the databases through a restore solution, if DAG is not used. Journaling Exchange offers ways to comply with legal requirements, for example to keep e-mails received and sent for a longer period of time. The journaling feature is a flexible functionality helping organizations to retain e-mails, but also select through different filtering methods recipients and senders that are enabled for journaling. There are two types of journaling mechanisms in Exchange. Standard journaling: This type of journaling is configured at the mailbox database level and copies messages sent or received to the database. Premium journaling: This feature requires an enterprise CAL and is much more granular when selecting users and groups, as well as the types of e-mails (internal or external recipients). Both options can be configured through the Exchange Management Console or through Exchange Management Shell. Standard journaling is found in Organization Configuration-> Hub Transport-> Journaling tab, while premium journaling is found in Organization Configuration-> Mailbox -> Database Management tab-> Properties of database-> Maintenance tab. When journaling is applied to the message, an e-mail with the message as an attachment is sent to a specific mailbox configured for journaling. Organizations can create a specific mailbox with a specific mailbox database Copyright 2012 Global Knowledge Training LLC. All rights reserved. 8
dedicated for journaling, since the data can grow exponentially, and it may be a requirement to have it separate from production databases. Lync and SharePoint Integration Integrating Exchange Server with other Microsoft communication products such as Lync and SharePoint provides users with a consistent experience when communicating with peers. Presence This feature allows users to see the status of a user next to the account whenever you see the name appearing in Exchange Address Lists, body of messages, SharePoint libraries, portals, and searches, as well as within the Lync client. It is applicable to any of the three products and is enabled when Lync is available in the organization. Once you click on the status of the user, you get choices for how you can reach that user, including sending an e-mail, starting an audio or video call, messaging, phone call, etc. Since the Presence shows up anywhere we have contacts defined, it becomes really easy for an end-user to seamlessly reach a colleague. Outlook Web App (OWA) IM Outlook Web App IM can initiate a chat within Outlook or Outlook Web. A user can right-click on an e-mail received and get the option to reach the sender through messaging via the Web! There are other neat features from OWA, such as the ability to control Lync contacts directly from the Web interface. Unified Messaging (UM) and voice access At the infrastructure level, a Lync server can act as an IP gateway for the Exchange server s Unified Messaging component. Lync server works great with UM, allowing voicemail to be redirected to an Exchange mailbox, where other features such as fax can be enabled. Moreover, UM with Lync as gateway enables features such as Outlook Voice Access, Outlook Voice Preview, and the Exchange Auto attendant. Exchange Web Services and Lync Exchange Web Services provides an interface that multiple applications, including Lync, can use to raise the level of integration between components. A Lync client will query an Exchange CAS in order to display and sync information such as contacts, voice mail, free/busy, and calendar information as well. SharePoint and Outlook Content of a library or different types of lists as well as calendars can be synchronized with Outlook, and seen within the e-mail client. Once the user disconnects from the environment, that data stays in the cache for offline use. Once the user reconnects to the network, an automatic bidirectional synchronization between the objects is possible. Copyright 2012 Global Knowledge Training LLC. All rights reserved. 9
SharePoint and SMTP servers A SharePoint server can send different e-mails, including notifications and alerts. It is possible to configure an SMTP server on the SharePoint server, allowing authentication to be performed with an Exchange Hub server when sending e-mail. There are situations when SharePoint needs to be configured to receive e-mail, for example mail-enabling libraries and lists. There is the option of configuring SharePoint and its SMTP server to receive e-mail from specific servers, such as Exchange servers. On Hub servers, appropriate connectors with authentication can be configured to receive and send e-mail to SharePoint servers in the organization. Public folder alternative Public folders are a structure in Outlook that allow users to drop different content in these repositories. Share- Point is an alternative to public folders. Notifications, alerts, better synchronization, tighter security, and more flexibility in terms of storing the data are some advantages of using SharePoint lists (calendars, contacts, etc.) and libraries over public folders. While the transition can take an extensible period, SharePoint is a platform on which people can build applications, and being Web-based, it does not require any special tool such as Outlook to view its content. Conclusion While Exchange Server 2013 is around the corner, 2010 still provides a strong foundation when it comes to messaging solutions in an organization. Once basic functionality is established, the ability to tweak and optimize your enterprise deployment is an ongoing administrator goal to maximize your value from the technology. With all the guidance and recommendations provided in this white paper we are certain that you ll get many more years of efficient production from Microsoft s Exchange Server platform. In this two-part white paper, we have seen some different features Exchange administrators can implement to get the most of their installations and be prepared for the next set of new functionalities we will see in upcoming versions. Part one of this paper addressed Optimizing the Mailbox Server Role, and Optimizing the Client Access Server. Learn More To learn more about how you can improve productivity, enhance efficiency, and sharpen your competitive edge, Global Knowledge suggests the following courses: Configuring, Managing, and Troubleshooting Microsoft Exchange Server 2010 Service Pack 2 (M10135) Designing and Deploying Messaging Solutions with Microsoft Exchange Server 2010 Service Pack 2 (M10233) MCITP: Enterprise Messaging Administrator 2010 Boot Camp Visit www.globalknowledge.com or call 1-800-COURSES (1-800-268-7737) to speak with a Global Knowledge training advisor. Copyright 2012 Global Knowledge Training LLC. All rights reserved. 10
About the Author Boris Gigovic (MCTS, MCITP, CCNA) is a Global Knowledge trainer focused on Microsoft, Citrix, and Windows technologies. With over ten years of experience in the field, Boris is in high demand as an IT consultant conducting corporate security and network audits in the Montreal area. Boris Gigovic (MCTS, MCITP, CCNA) is a Global Knowledge trainer focused on Microsoft, Citrix, and Windows technologies. With over ten years of experience in the field, Boris is in high demand as an IT consultant conducting corporate security and network audits in the Montreal area. Copyright 2012 Global Knowledge Training LLC. All rights reserved. 11