Renewing the self-signed certificate in Exchange 2010 and Exchange 2007

http://exchangepedia.com/2008/01/exchange-server-2007-renewing-the-self-signed-certificate.html

Exchange 2010 and Exchange 2007 Setup creates a self-signed certificate for the server to protect communication with services like SMTP, IMAP, POP, IIS and UM. In Exchange 2007, the certificate is issued for a period of one year. In Exchange 2010, the certificate validity period is raised to five years.

The self-signed certificate meets an important need – securing communication paths for Exchange services by default. This is a great development – it ensures that data will not be transferred in the clear by default and all communication is encrypted. Nevertheless, one should treat these certificates as temporary. Although self-signed certificates work perfectly well for internal SMTP communication between Hub Transport servers, and between Hub Transport and Edge Transport servers, it’s not recommended to use them for any client communication on an ongoing basis. For most deployments, you will end up purchasng a certificate from a trusted 3rd-party CA (or perhaps an internal CA in organizations with PKIdeployed).

Self-signed certificates are great for securing communication by default and handy for test environments. For client communication in production environments, it’s recommended to use certificate signed by a trusted CA.

Should you decide to leave the self-signed certificate(s) on some servers and continue to use them, these will need to be renewed when they expire — just as you would renew certificates from 3rd-party or in-house CAs.

 This command renews the certificate for server e12postcard.e12labs.com, a server with CAS and HT roles installed:

Get-ExchangeCertificate -domain “e12postcard.e12labs.com” | fl

Note the services the certificate is enabled for (by default: POP, IMAP, IIS, SMTP on CAS + HT servers). Copy the thumbprint of the certificate.

Get a new certificate with a new expiration date:

Get-ExchangeCertificate -thumbprint “C5DD5B60949267AD624618D8492C4C5281FDD10F” | New-ExchangeCertificate

To create a new certificate with an exportable private key, use thePrivateKeyExportable parameter. For example: 
New-ExchangeCertificate -PrivateKeyExportable $true

If the existing certificate is being used as the default SMTP certificate, you will get the following prompt. The default SMTP certificate is used to encrypt SMTP sessions between transport servers in your organization.

Confirm
Overwrite existing default SMTP certificate,
‘C5DD5B60949267AD624618D8492C4C5281FDD10F’ (expires 8/22/2008 7:20:34 AM), with certificate ’3DA55740509DBA19D1A43A9C7161ED2D0B3B9E3E’ (expires 1/28/2009 7:37:31 AM)?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help
(default is “Y”):

Type y to continue. A new certificate is generated.

Thumbprint   Services   Subject
———-   ——–   ——-
3DA55740509DBA19D1A43A9C7161ED2D0B3B9E3E   …..   CN=E12Postcard

The new certificate is generated and enabled. Examine the new certificate:

Get-ExchangeCertificate -thumbprint “3DA55740509DBA19D1A43A9C7161ED2D0B3B9E3E” | fl

 The old certificate is enabled for IIS, POP, IMAP and SMTP. The new certificate generated using the above command is enabled only for POP, IMAP and SMTP – IIS is missing.

You can enable the certificate for IIS (in addition to any other services it may already be enabled for — it adds to existing values of the certificate’s Services property).

Note: Once you enable a certificate for a particular Exchange Server service, there’s no way to disable it (for that service). You must remove the certificate (if the certificate is CA-issued, export the certificate along with its private key before you do so), import it again and enable it for the services you need to. This is generally not a concern with self-signed certificates— you can generate additional self-signed certificates and optionally remove the old one, since there’s no CA interaction or costs involved.

Setting the Services parameter to None does not do anything in this case.

To enable the certificate for IIS:

Enable-ExchangeCertificate -thumbprint “3DA55740509DBA19D1A43A9C7161ED2D0B3B9E3E” -services IIS

 Test services are working with the new certificate. If it works as expected, the old certificate can be removed:

Remove-ExchangeCertificate -thumbprint “C5DD5B60949267AD624618D8492C4C5281FDD10F”

Renew Self Signed Exchange 2007 Certificate Event ID:12014

Event:

Event Type: Error
Event Source: MSExchangeTransport
Event Category: TransportService
Event ID: 12014
Date: 01/01/2013
Time: 8:43:32 AM
User: N/A
Computer: HUBCASSERVER
Description:
Microsoft Exchange couldn't find a certificate that contains the domain name HUBCASSERVER.COM in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector Exchange-Surf Control with a FQDN parameter of HUBCASSERVER.COM. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Solution:

http://exchangepedia.com/2008/01/exchange-server-2007-renewing-the-self-signed-certificate.html

On the HUB\CAS Server where the event is triggering
Get-ExchangeCertificate  | fl 

Note the services the certificate is enabled for (by default: POP, IMAP, IIS, SMTP on CAS + HT servers). Copy the thumbprint of the certificate.

Get-ExchangeCertificate -thumbprint “E2D4E11BC8982D76301CAC7D09E38308BC23AF46” | New-ExchangeCertificate

If the existing certificate is being used as the default SMTP certificate, you will get the following prompt. The default SMTP certificate is used to encrypt SMTP sessions between transport servers in your organization.

The new certificate is generated and enabled. Examine the new certificate:

Get-ExchangeCertificate -thumbprint “thumbpring of new certificate” | fl

Remove-ExchangeCertificate -thumbprint “E2D4E11BC8982D76301CAC7D09E38308BC23AF46”

Outlook Hyper Links not working!!!

http://social.technet.microsoft.com/Forums/en/word/thread/99fea872-9e7b-46c2-8bc1-2ae68b23ae4e

If you received this error after uninstalling any application that takes over the HTML open command (including, but not limited to, Chrome & Firefox browsers) you may also need to change the HTM/HTML association in the registry.

1. Start, click Run, type Regedit in the Open box, and then click OK.
2. Browse to HKEY_CURRENT_USER\Software\Classes\.html
3. Right click the value for the .html key and select Modify…
4. Change the value from "ChromeHTML" to "htmlfile" (or from FireFoxHTML to htmlfile)

Repeat these steps for htm and .shtml keys if they exist. You may also want to check the xhtml and xhtm keys.

I actually had to search my registry and find all ocurences of "ChromeHTML" to fix that manually.

Outlook: Error opening attachments

Error opening attachments / Cleaning out the Temporary Outlook Files folder

When opening an attachment directly from within Outlook you could get an error message saying that it can’t create the file and to that you need check the permissions on the folder you want to save it in. In most cases the permissions on the folder isn’t the issue but the fact that the folder is “full”. When you open an attachment directly from within Outlook it will first save a copy to a subfolder of the Temporary Internet Files folder. Cleaning out the folder will solve the issue.

Outlook Secure Temp folder

Unfortunately this is easier said than done. The subfolder name Outlook creates (on installation of Outlook) in the Temporary Internet Files folder is quite random. In Outlook 2003 and previous, the name starts with OLK and is followed by up to 4 random numbers or letters. In Outlook 2007 and Outlook 2010, this folder is called Content.Outlook and then has a subfolder which is named with with 8 random numbers and letters. In addition, by default, you cannot simply browse to the folder to clean it out. Getting to the Temporary Outlook Folder can still be accomplished in 2 easy steps though.

Step 1: Locate the folder
The folder location is stored in the registry in the following key;

Outlook 97	HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Outlook\Security
Outlook 98	HKEY_CURRENT_USER\Software\Microsoft\Office\8.5\Outlook\Security
Outlook 2000	HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Outlook\Security
Outlook 2002/XP	HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
Outlook 2003	HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security
Outlook 2007	HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security
Outlook 2010	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security

Step 2: Get to the folder

1. Open the OutlookSecureTempFolder registry key from the location provided in Step 1.
2. Copy the path from the key.
3. Open Explorer
4. Paste the address in the Address Bar and press Enter

Use OutlookTools or OutlookTempCleaner

Still not easy enough or just don’t want to go in the Registry to find the folder location? I’ve created two free tools which can do the trick as well.

OutlookTools offers besides locating, opening and cleaning up the SecureTempFolder also quite a lot of additional features to troubleshoot and tweak Outlook.

OutlookTempCleaner focuses only on dealing with the SecureTempFolder and can also be used in (corporate) login and logoff scripts to clean up the folder without any end-user interaction.

OutlookTempCleaner can detect and empty Outlook’s Secure Temp folder automatically for you.

XP Mode Memory Settings Change

http://blogs.msdn.com/b/ianm/archive/2009/09/20/changing-windows-7-s-xp-mode-memory-size.aspx

It's actually much simpler. Just click Start -> Programs -> Microsoft Virtual PC -> Virtual Machines.

Then right click the VM and click settings.

Note that if the machine is already hibernated, you'll need to shut it down which you can do by clicking (in the running VM) Start -> Windows Security, etc.

More Info on PDC not available!!!

If you're not running any down-level (pre-W2K) clients, the loss of the PDCe won't be as noticeable.  The following operations home on the PDCe and will either fail or be non-deterministic while it is unavailable:

* Password changes
* GPO changes
* Time sync

The other 4 will be negligible during day-to-day operations: schema master will only be noticed if you're extending the schema, domain naming if you're adding/removing a child domain, RID master if you create a large # of objects. (Since you're in a single-domain environment, the infra master is meaningless.)
Active Directory these days, in terms of Server 2003 & 2008, is fully multi-master; any Domain Controller can be queried or have updates written to it, which then replicate to other DCs. The only exception to this is the 5 FSMO roles - these are single-master roles for particular services which can only reside on one DC at a time. The Schema, for example, must only be updated on one DC (the Schema Master) to prevent any conflicts.

The PDC Emulator as Laura already mentioned handles tasks such as account lockouts, password changes and various other roles, but ANY of your DCs in conjunction with GCs can authenticate a user and log them in.


Yes I agree with both of you, but as you both state the PDC emulator deals with account lockouts, password changes, & various other roles.  What I'm trying to find out is what if the PDC emulator is available for a few days?


Oops, that should have been, What if the PDC emulator is NOT available for a few day?


If you don't have pre-Windows 2000 Servers or computers, then those should theoretically be able to login to the network using one of the other DCs. Provided among one of these other DCs there is at least one other Global Catalog Server, logons and general network use should not be a problem.

However, the PDC Emulator is responsible for Time Synchronization between all servers and workstations on the network. Password Changes could also become a problem, since these take place at the PDC Emulator. If the PDC Emulator holds other FSMO roles, this could obviously cause problems too.

In short: The network in general should function, provided you have another GC, but you would want to restore the PDCe to service as soon as possible, anyway.

Recovering Lost Mailboxes

Recovering Lost Mailboxes :

Accidentally deleting a user account from the Active Directory database is never a welcome thing. Performing an authoritative restore for just one account is not really a likely event. At least you can rest easy knowing that you can reconnect the new user account with the orphaned mailbox:see, not everything is all bad. Now, back to that hard earned vacation
Here's the situation: Your organization just hired a brand new fresh out of MCSE boot camp assistant administrator so that you can finally get some time off. You've packed your bags and boarded the plane. You thought you left all forms of office communication in your desk, but it seems the Boss was one step ahead of you and snuck your cell phone into your laptop case. Upon deplaning, you shrug your shoulders and turn your phone on. You've got new voice mail:who'd a thought that would happen? It seems that Skippy, the new assistant administrator, was "playing" around in Active Directory Users and Computers and has deleted the user account for Joe Q. User, who still works at the company, instead of Joe P. User, who left last week. The Boss wants it fixed now and given Skippy's performance already, he's certainly not about to let him perform an authoritative restore again Active Directory. For once, you agree with your boss. Fortunately for you, you've taken steps to help mitigate the fallout in cases just like this one. Finally, something in life that actually works the way it's supposed to!

The Setup

Before we get any further, let me take a couple of steps back. Up to this point, we have been working with the scenario of a user who has been deleted from Active Directory and subsequently recreated. The problem lies in the fact that since we recreated the user manually, vice performing an authoritative restoration of Active Directory (always a risky choice, no matter what you've been told) and thus the SID of the "new" account does not equal the SID of the "deleted" account. The mailboxes of deleted users are orphaned for a set time, which we will configure shortly. Mailboxes that have been directly deleted from with the Exchange System Manager truly are gone--unless you perform a restoration of your Exchange organization. In this article, we are going to stick with the assumption that the user has been deleted and subsequently recreated from within Active Directory Users and Computers.


In order to ensure that you have the capability to retrieve "orphaned" mailboxes, you will want to take some precautionary steps ahead of time and configure some time limits for mailboxes. You can configure time limits for mailbox stores in one of two ways: either directly on each mailbox store of concern or by creating a mailbox policy (or multiple policies as desired) and applying it to the mailbox stores of concern. I will demonstrate both methods, although since I believe in making life easier, I recommend using the policy-based method and applying it to all of your mailbox stores.

Configuring A Specific Mailbox

In order to configure a mailbox to allow for recovery of mailboxes that belong to users who have been deleted, you need only configure two settings. Configure your mailboxes to support recovery as follows:



1. Open the Exchange System Manager.

2. Expand the nodes until you have found the private store of concern.

3. Right-click the applicable private store and select Properties.

4. Switch to the Limits tab, as shown in Figure 1.

5. Configure the settings as you desire and click OK to accept them. The settings are explained below in some detail.



Figure 1 - Configuring limits on a Mailbox store.


Keep deleted items for (days) - Sets the number of days that that deleted items (such as e-mail messages) remain on the server before they are permanently removed. You can type a number from 0 to 24,855. If you type 0, deleted items are removed from the server immediately.

Keep deleted mailboxes for (days) - Sets the number of days that deleted mailboxes remain on the server before they are permanently removed. You can type a number from 0 to 24,855. If you type 0, deleted mailboxes are removed from the server immediately.

I recommend setting the deleted items setting at something around 14 days (in case the Boss deletes that important internal memo on accident) and setting the deleted mailboxes setting at something between 30 - 45 days to give you a fair shot at fixing an error such as this, should one occur.



That's all there is to configuring an individual mailbox store for recovery, we will next look at creating a policy to apply to all private stores.



Configuring A Mailbox Policy

Should you have more than one mailbox store, you may want to consider creating and applying a mailbox policy to implement a recovery setting across all of your mailboxes equally. Of course, you can create mailbox and public store policies for other reasons as well:so get in there and see what's up!



To create, configure and implement a mailbox policy, follow the steps below:


1. Open the Exchange System Manager.

2. Ensure that viewing of Administrative Groups is on. If not, right-click the organization, and then click Properties. On the General tab, select Display administrative groups. You will have to exit and restart Exchange System Manager.

3. Open the administrative group that contains the mailbox(es) you want to work with. If it does not already contain a System Policies folder, create one by right-clicking on the Administrative Group node and selecting New
System Policy Container.



4. Right-click the System Policies folder and select New
Mailbox store policy, as shown in Figure 2.

Figure 2 - Creating a new mailbox store policy.



5. From the New Policy window, check the boxes of the tabs you want to use in the policy. For this example, we want the Limits box at a minimum.

6. On the General tab of the Properties window, type a policy name.

7. On the Limits tab (see Figure 3), configure the deletion settings as you desire. Close out the policy by clicking OK.



Figure 3 - Configuring the mailbox store policy



8. To apply the policy to one or more mailbox stores, right-click on it in the System Policy container and select Add Mailbox Store, as shown in Figure 4

9. Select the mailbox stores you want to add the policy to and click OK.



Figure 4 - Associating the policy with a mailbox store.



If click on the Policies tab of the Properties page the mailbox store, you can see that the policy is indeed in effect. Additionally, any settings you configured via a policy will cause those boxes to be made unavailable for configuration from the Properties page.


Now that we've seen how to configure for recovery on one or many mailboxes, let's get down to actually recovering an orphaned mailbox--so we can get our administrator back on his vacation and get Skippy off the hook. After all, we wouldn't want to get him fired on his first day at work, would we?


The Exchange 2000 Server Orphanage


The process to actually recover (reconnect) an orphaned mailbox is pretty simple, once you actually get to that step. To reconnect a mailbox with a user account, proceed as follows:



1. From Active Directory Users and Computers, create a new user object for the user. Ensure that you clear the Create an Exchange Mailbox check box.

2. In the Exchange System Manager, navigate to the mailbox store where the mailbox is located.

3. Verify that the mailbox icon has a red X on it. Only mailboxes that display this icon have been deleted (but will be retained for the time period specified). If the mailbox does not have the red X on it, then you will need to run the mailbox cleanup agent by right clicking on the Mailboxes object and selecting Run Cleanup Agent, as shown in Figure 5.


Figure 5 - Running the Cleanup Agent.


4. Right-click the mailbox and select Reconnect. This will open the New User for this Mailbox window as shown in Figure 6.


Figure 6 - Picking the user to reconnect with.


5. Select the user you wish to associate with this mailbox and click OK.

That's it. You're done. The only thing you really have to watch out for here is possible replication delays you may experience if you are not working on the Exchange Server locally. Since the user account must be replicated throughout Active Directory and be "seen" by the Exchange Server, you may want to force replication if required. Not a big problem, but something to be aware of.

Wrap-Up:

Accidentally deleting a user account from the Active Directory database is never a welcome thing. Performing an authoritative restore for just one account is not really a likely event. At least you can rest easy knowing that you can reconnect the new user account with the orphaned mailbox:see, not everything is all bad. Now, back to that hard earned vacation!

Taken From:

http://blogs.mccombs.utexas.edu/the-most/2011/01/28/email-attachments-in-the-body-of-outlook-messages/

Email Attachments in the Body of Outlook Messages

You may notice that sometimes when you add an attachment to an email, it goes in as an icon into the body of the email, instead of in the Attached line below the subject of the email.
Here’s the secret - it all depends on the format of your email.

Email Format:	Location of Attachment:
Plain Text	Attached line below subject of email
Rich Text	Body of the email
HTML	Attached line below subject of email

To learn more about the differences between the mail formats, read about it on the Microsoft Office web site.

Change the Format of an Individual Email

Outlook 2007

1. Start a new email.
2. Click on the Options tab of the ribbon.
3. In the Format section of the ribbon, click on the format you want for your email (Plain Text, Rich Text, or HTML).

Outlook 2010

1. Start a new email.
2. Click on the Format Text tab of the ribbon.
3. In the Format section of the ribbon, click on the format you want for your email (Plain Text, Rich Text, or HTML).

Change the Default Format For All of Your Email

Outlook 2007

1. In Outlook, go to the Tools menu and select Options.
2. Click on the Mail Format tab.
3. In the Message Format section, click the Compose in this message format: drop down arrow and select the format you want.
4. Click OK.

Outlook 2010

1. In Outlook, click on the File tab.
2. In the left column, click on the Options button.  The Outlook Options window will open.
3. In the left column, click Mail.
4. In the Compose messages section,  click the Compose in this message format: drop down arrow and select the format you want.
5. Click OK.