cn: David Schrag
mail: david@schrag.net
Proxy Addresses
smtp:David@schrag.local
smtp:dschrag@schrag.net
SMTP:david@schrag.net
smtp:dave@schrag.net

(I really should have replaced the @ symbol with some other symbol above to cut down on incoming spam, but my actual e-mail address is all over the Internet and my spam filter does an excellent job of blocking the junk.)

The script is available at Bharat Suneja’s blog. It separates out regular users from external contacts and disabled users. After extracting it, run the script from a command prompt on your Exchange server.

Other ways to accomplish the same goal are suggested in this reprint of a thread in a Microsoft newsgroup.

There are probably more elegant tools out there. What I’d really like to see as output is an expanded but simplified version of the above, like this:

User: David Schrag

• david@schrag.net
• dschrag@schrag.net
• dave@schrag.net

Public Folder: Info

• info@schrag.net
• information@schrag.net

Distribution Group: Management

• management@schrag.net
• sr-management@schrag.net

Some numbering would be cool, too, but not necessary. Anyone know of a tool that can give me the user-friendly output I seek?

I get asked this question at least once a month, so I figured it was worth writing up here.

If Outlook loses its connection to the Exchange server for a while, it may go into Offline mode. As long as Outlook is set to work offline, you will not be able to send and receive messages in the background – you will have to hit the Send/Receive button.

To see whether Outlook is working online or offline, look in the lower right corner of the screen. If you are connected to Exchange, it will look like one of these two pictures:

(Outlook 2007)

(Outlook 2003)

If you are working offline, it will look like this:

(Outlook 2007)

(Outlook 2003)

To remedy the problem, click the arrow to the right of “Offline” and uncheck the Work Offline option:

If you are still unable to connect to the Exchange server after unchecking Work Offline, it may look like this:

If that’s the case, then the problem is more serious and you need to figure out why your computer is not communicating with the Exchange server at all.

A client asked me this question today:

In Outlook, is there a way to change the subject line when using the out
of office assistant? For instance, we have a former employee’s email
account that says she is no longer with our company but the subject line of
the emails says out of office.

The answer is yes. When you run the Out of Office Assistant (OoOA), you get this screen:

Most folks put in some text in the upper box, click OK, and are done with it. But if you are using the OoOA for some special purpose, such as announcing the permanent departure of an employee, you might want a more sophisticated response. Or you might want to let some people know you’re out of the office but not everyone. In that case, you need to create one or more rules by clicking the Add Rule button. When you click the button, you’ll get lots of choices:

In this case, we want to check the “Reply with” button and then click the Template button to create a customized reply message. Enter the desired subject line and text, but leave the To field blank:

When you’re done composing, close the window and you’ll be prompted to save your message. Click Save and/or OK enough times and you’ll be back at the OoOA screen, with your new rule in place, and you can enable the rule when ready:

Note that for your auto-replies to actually get delivered to anyone via the Internet, your Exchange administrator has to allow it. In many cases this behavior is turned off to prevent an endless loop of messages getting bounced back and forth between auto-responding servers. The settings to enable/disable out-of-office and other automated replies are set in the properties of the Exchange Global Settings / Internet Message Formats / Default:

As I mentioned at the beginning of this post, you need to think very carefully about how you want your auto-responses to work. Having an out-of-office message sent to a mass mailing list is usually a big no-no. If you are thinking about using the OoOA for a departed employee, make sure that you have unsubscribed him or her from all mailing lists first.

Here was the scenario:

• Server: SBS 2003 Standard SP1, Exchange 2003 SP2
• Don and Jorge have WM5 phones
• Don had absolutely no problem synchronizing his phone with Exchange.
• Jorge cannot sync either over the air or while cabled to a laptop. We had tried with three different WM5 devices (Treo 700w, Motorola Q, XV6700) over the air and while cradled from two completely separate remote locations. We had tried using both ActiveSync 4.5 on XP and the Mobile Device Center on Vista.
• Server is using a GoDaddy SSL certificate. SSL settings on the server had been triple-checked, and as noted above Don could sync without difficulty (on two different devices, no less).
• Jorge was able to get to log into OWA and see his mail from the WM5 device.
• David – a domain admin account being used for test purposes – was unable to sync from one of the same devices successfully synched for Don.
• Mabel – another (non-domain-admin) account also used for test purposes  – was also unable to sync from that device.

The error on the server when trying to sync was:

Log: Application
Type: Error
Event: 3005
Time: Oct 2 2007 5:44PM
Source: Server ActiveSync
Category: None
Username: jorge
Computer: SERVER
Description: Unexpected Exchange mailbox Server error: Server: [server.internaldomain.com] User: [jorge@externaldomain.com] HTTP status code: [409]. Verify that the Exchange mailbox Server is working correctly.

The error on the device when trying to sync was:

Your account in Microsoft Exchange Server does not have permission to synchronize with your current settings. Contact your Exchange Server administrator. Support code: 0×85010004.

I checked Jorge’s Exchange Features in Active Directory and all are enabled. Jorge is in the same AD OU and same security groups as Don.

Unfortunately, these error messages are rather non-specific. I went through dozens of pages found via Google searches. Most suggested that the problem was related to SSL certificates, host headers, firewall settings, and other issues that turned out not to be the cause.

Fortunately, I am a Microsoft Small Business Specialist, and that entitles me to free support from Microsoft engineers in Shanghai through a managed newsgroup. I posted my problem there, and got this thorough troubleshooting checklist:

Step one:
Please install the hotfix below to see if it helps:
Error message when you try to synchronize a Windows Mobile 5.0-based device in Exchange Server 2003: “0×85010004″
http://support.microsoft.com/kb/919864/en-us
 
Step two:
This issue can be caused if you have a Firewall and not allowed a rule on the Firewall for Microsoft-Server-ActiveSync. So I would like to check if you have run the CEICW Wizard. Please open Server Management console, navigate to ‘To Do List’ and click ‘Connect to the internet’ in the right panel. The wizard can help us configure the networking settings for a SBS server. It automatically creates the ISA rules for internet access and site publishing. It’s strongly recommended to use the wizard to configure the SBS server. More info:
825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763
XCSI/PRE/E2K3/Unable to synchronize with Exchange server using Active Sync
http://support.microsoft.com/default.aspx?scid=kb;EN-US;924216

Step three:
Please checked the properties of Microsoft-Server-ActiveSync, is the
Directory Security properties for IP Address and Domain Name Restrictions
configured as ” DENIED ACCESS”? To check it:
1. Open IIS.
2. Expand Web Sites -> Default Web Site.
3. Open the Properties page of Microsoft-Server-ActiveSync.
4. In Directory Security tab, click Edit under “IP address and domain name
restrictions”.
5. Make sure that you configured as Granted access.

Step four:
Please check the following IIS settings:

For Exchange/Exchange-oma virtual directory:
1. Open IIS Manager
2. Open properties of virtual directory Exchange/Exchange-oma
3. Select Directory Security tab
4. Select Edit in Authentication and access control box. Make sure the authentication setting as below:
Authentication Methods
Enabled Basic authentication
Enabled Integrated Windows authentication
Disabled anonymous access

For OMA virtual directory and Microsoft-Server-ActiveSync virtual directory:
1. Open IIS Manager
2. Open properties of OMA virtual directory and Microsoft-Server-ActiveSync virtual directory respectively.
3. Select Directory Security tab
4. Select Edit in Authentication and access control box. Make sure the
authentication setting as below:
Authentication Methods
Uncheck Enable anonymous access
Uncheck Integrated Windows authentication
Check Basic authentication

Of all the items that were listed here, the only ones that were off on my server were that the hotfix had not been installed and that anonymous access on Exchange-oma was not disabled. I made both of these changes, and I am 99% sure that it was the Exchange-oma change that finally solved the problem.

Fortunately, there are a few ways to figure out who’s got that address, and this article explains them.

I recently laid hands on an iPhone for the first time a couple weeks ago. It is beautiful and fun to play with. But I said the same thing about my first digital watch about 30 years ago.

David:

Please advise what I should be doing as a result of getting this warning which I have been receiving for about three weeks now…

—–Original Message—–

From: System Administrator

Sent: Wednesday, July 25, 2007 12:00 AM

To: [name withheld]

Subject: Your mailbox is over its size limit

Importance: High

Your mailbox has exceeded one or more size limits set by your administrator.

Your mailbox size is 826468 KB.

Mailbox size limits:

You will receive a warning when your mailbox reaches 750000 KB.You may not be able to send or receive new mail until you reduce your mailbox size.

To make more space available, delete any items that you are no longer using or move them to your personal folder file (.pst).

Items in all of your mailbox folders including the Deleted Items and Sent Items folders count against your size limit.

You must empty the Deleted Items folder after deleting items or the space will not be freed.

See client Help for more information.

The gentleman who sent me this question is an extremely bright and capable guy who is the COO of a successful, multi-million-dollar business. He did not get where he is today because of an inability to read English and follow instructions. But something about this message has got him paralyzed, unable (or more likely afraid) to take the simple steps suggested. And note that he is telling me this now, after getting this warning for three weeks!

It is sad that people have such suspicion and cynicism about computer technology that they feel the need to consult an “expert” before taking simple corrective action to problems they encounter. It is sadder still that in many cases such suspicion and cynicism is warranted because of the prevalence of buggy software, arcane error messages, and malware disguised as helpful hints.

Enable Password Changing through OWA in Exchange 2003

The only deviations I had to make from those instructions were:

1. In the “Create a new REG-DWORD value ….” In SBS03, that value exists by default. You simply need to change it from 1 to 0.

2. You need to edit the IP Address and Domain Name Restrictions of the Iisadmpwd virtual directory that you create. By default, only the server itself has access. Change this so that all computers are granted access.

You wouldn’t think this would be so much of a challenge, but the steps are actually hidden pretty well. The answer was posted at Experts Exchange. Scroll all the way to the very bottom, past the ads and links. (Or pay to join Experts Exchange so you can skip all that stuff in the future.)

Troubleshooting:

• Tried connecting to VPN from my computer. Could not connect. Conclusion: remote user is neither stupid nor crazy.
• Tried to telnet to server over port 1723. Could not connect.
• Checked firewall logs for dropped connections on port 1723. None there.
• Disabled VPN access at firewall. Tried to connect again. Failed again. Checked logs again. Showed dropped connection. Conclusion: firewall is not the problem; when the rule is enabled, it is successfully letting PPTP traffic through.
• Checked status of Routing and Remote Access Service. Looked fine. Restarted service anyway. Still can’t connect to VPN.
• Ran netstat -a on server to see if server was listening for connections on port 1723. It was, but it was in CLOSE_WAIT status. A-ha! Now we’re on to something.
• Ran netstat -b -v -o to see what exactly is using port 1723. Surprise! The executable involved is store.exe, i.e., Microsoft Exchange. What the hell is Exchange doing using port 1723?
• Restarted Exchange Information Store. (Not easy — had to try several times before it successfully stopped.) Ran netstat again after services restarted. Now server not listening on port 1723 at all. Progress, I suppose, but not good enough.
• Restarted RRAS. Still not listening on 1723. Started swearing. Didn’t help.
• Started Blackberry Enterprise Server Dispatcher, Policy, and Synchronization services, which had to be stopped in order to stop Exchange store. Tried VPN again. It works!

Conclusion: I have no idea why Exchange hijacked the VPN port. But I will remember that netstat is my friend.