Box24 casino Forum

Box24 casino.

You are not logged in.

#1 2020-09-14 08:19:36

CorineBayl
Member
From: Iceland, Bolungarvik
Registered: 2020-09-14
Posts: 1

you are not using Exchange Server 2016 CU3 or later

exchange  online .
Exchange Server mailbox migration move  power shell.
By.
April 23, 2020.
No Comments on Force Mailbox Migration With Bad Items To Complete (2020).
It used to be easy to complete an  Exchange Server  > Exchange Online move request that had bad items, but this has changed recently.
In the last short while Move Requests (and Migration Batches) have begun to include a property called Data Consistency Score    Get-MoveRequestStatistics "Bill Gates" | fl DataConsistencyScore    If the result from the above is “Investigate” then you will not be able to complete the move even if you set the usual properties of -PreventCompletion $false and -CompleteAfter 1, that is – the following will not work:    Set-MoveRequest "Bill Gates "-SuspendWhenReadyToComplete $false -PreventCompletion $false -CompleteAfter 1    You will also need to set the following:    Set-MoveRequest "Bill Gates" -SkippedItemApprovalTime  $(Get-Date).
ToUniversalTime()    Upon running the above (the move re quest  will auto resume in my tests), the move will start to complete if completion is allowed (the cmdlets at the top of the post).
Obviously you will want to check why there are a number of bad items in the move and what you are going to try and do to fix them.
The SkippedItemApprovalTime property approves all bad items detected before the specified time.
So in the above example we are approving all bad items to be discarded that were found before “now”.
You could set an earlier specific time as well.
You now do not need to set a bad item limit (BadItemLimit) value as you are approving items by time instead.
booking calendar  Outlook places room           Making Your Office 365  Meeting Room s Accessible.
By.
August 8, 2019.
2 Comments on Making Your Office 365  Meeting Room s Accessible.
Or How to Use Set-Place to Configure Your Meeting Rooms or How  Wheelchair Users  Can Find The Best Meeting Rooms In Your Organization etc.
– there are many different titles I can think of for this blog post.
They are all to do with setting useful properties against your  meeting room s so that your users can find the best rooms.
As of the time of writing ( update d July 2020), “Outlook Places” service exposes a client-side UX only in Outlook on the web (OWA) with Outlook for Windows and Mac due by end of August 2020.
Given Microsoft’s previous behaviour of flighting Exchange Online features for one client initially before rolling them out to other clients, this is likely to hit Outlook mobile etc.
at some point after that.
Therefore I recommend that you update all your room properties now using the PowerShell cmdlet Set-Place so that your users are able to find meeting rooms and other resources upon the functionality appearing in their client.
The Exchange Online Management Shell cmdlet Set-Place allows you to configure properties such as if the room is accessible for wheelchair users (hence the title of this blog post), or what AV equipment it holds or indeed how many people the room can hold (comfortably!).
As this information, especially in a large organization, is probably known by many different people and requires the input of these different users to maintain a master list, this blog post will look at the process of creating this list and then importing it back into Exchange Online when updated.
Creating A Master Room Metadata List.
From Exchange Online Management Shell run the following:    Get-Mailbox -RecipientTypeDetails RoomMailbox -ResultSize Unlimited | Get-Place | Export-CSV OrganizationRooms.csv -NoClobber -NoTypeInformation    Open the file, here called OrganizationRooms.csv in Excel.
I removed the first three columns (PSComputerName,RunspaceId,PSShowComputerName) as well as Type, ResourceDelegates, IsManaged, BookingType and Localities  and the last two columns (IsValid and ObjectState) from this file and then save it as an Excel file to OneDrive for Business or SharePoint Online and shared it with the relevant facilities management and other interested parties (don’t share it as a CSV file, as multiple users cannot edit a csv file in real time).
We wait for this information to be updated.
If you wish you could lock out cells from being edited such as Identity and maybe DisplayName so that future updating of existing rooms is easy to do.
Specifically we are looking at information such as location (physical street/city address, building name [for campus type organizations], floor number and GeoCoordinates), AV equipment (such as audio, video, display devices and room phone number), accessibility for wheelchair users, and miscellaneous tags (in the form of a comma separated list such as “Conference Room”,Lecture,“Tiered Seating”) that users could use in their room search.
There are tools to generate geo-coordinates from addresses that you can find online and they are required as latitude;longitude;altitude (where altitude is optional)    Updating Room Metadata in Exchange Online.
To upload the new data, save the shared Excel spreadsheet as a CSV file again and run the following Exchange Online Management Shell script:    $OrganizationRooms = Import-Csv .OrganizationRooms.csv ForEach ($Room in $OrganizationRooms) {     [Boolean]$IsWheelChairAccessible = [System.
Convert]::ToBoolean($Room.
IsWheelChairAccessible)      Set-Place -Identity $Room.
Identity -Street $Room.
Street -City $Room.
City -State $Room.
State -PostalCode $Room.
PostalCode -CountryOrRegion $Room.
CountryOrRegion -GeoCoordinates $Room.
GeoCoordinates -Phone $Room.
Phone -Capacity $Room.
Capacity -Building $Room.
Building -Label $Room.
Label -AudioDeviceName $Room.
AudioDeviceName -VideoDeviceName $Room.
VideoDeviceName -DisplayDeviceName $Room.
DisplayDeviceName -IsWheelChairAccessible $IsWheelChairAccessible -Floor $Room.
Floor -Tags $Room.
Tags      Set-Mailbox $Room.
Identity -DisplayName $Room.
DisplayName }    In the above code I have not included attributes from Get-Place that I cannot write back such as IsManaged, BookingType and Localities – I am interested though in knowing what they are used for as they are undocumented.
The above code just replaces the current values in Exchange Online with the values in the spreadsheet, so the spreadsheet becomes your master.
Note that values with spaces need to be quoted in the CSV – such as tags and various display names.
Also it is worth being aware that with conference bridges and Teams meetings, room “capacity” is not always as important as it might sound – a room with a capacity of 3 people will work fine if everyone is remote.
Booking multiple rooms for a single meeting is also planned.
If the room object is synced from on-premises Active Directory then you can still use Set-Place to update the object in the cloud.
The previous way of setting some of these properties (i.e.
City) used Set-User and that needed to be run against the source of the object (that is, if synced you needed to run Set-User on-premises against Active Directory).
Set-Place can be viewed at https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/set-place?view=exchange-ps    Exchange Server.
All rooms and resources that you manage via the steps in the blog post need to be Exchange Online resources.
If the mailbox is still on Exchange Server and not moved to Exchange Online in a hybrid scenario, you are not able query and set the information in Get-Place or Set-Place    But that does not mean you cannot get ready for the day that you move those resources (rooms) to Exchange Online.
On Exchange Server you can run the following Exchange Management Shell PowerShell and get a csv file with exactly the same columns as above.
Get the spreadsheet filled in as mentioned above and then when you move the room to Exchange Online and update Set-Place, the room will be found and updated.
Set-ADServerSettings -ViewEntireForest $true Get-Mailbox -RecipientTypeDetails RoomMailbox -ResultSize Unlimited | Select Identity,DisplayName,Street,City,State,PostalCode,CountryOrRegion,GeoCoordinates,IsManaged,BookingType,ResourceDelegates,Phone,Capacity,Building,Label,AudioDeviceName,VideoDeviceName,DisplayDeviceName,IsWheelChairAccessible,Floor,FloorLabel,Tags,Localities,SpaceType,CustomSpaceType,IsValid,ObjectState | Export-CSV OrganizationRooms-OnPremises.csv -NoClobber -NoTypeInformation    User Room Search Experience.
At the time of writing (July 2020) this experience is rolling out to Outlook, having been in OWA for about a year.
The new experience will use the “Outlook Places” backend service, which Set-Place we used above populates.
To view and search for rooms based on these settings you need (for now) to wait 24 hours from using Set-Place before the property can be searched.
You then create a new event in OWA calendar and click “Search for a room or location” and then click “+ Browse more rooms”.
The suggested rooms listed are those you have used or attended meetings at recently, but if you click in the “Search for a city or room list” box you can either enter a city or room list name (suggest naming your room lists after buildings) and click “Show all rooms” or click the City or Room List name:                This allows the “Filters” option to become available, where you can filter for capacity (rooms larger than) or properties such as audio/video or accessible rooms.
Once you have set the features you need, click Apply and select the room you need for the meeting.
Being able to book multiple rooms for a single meeting is coming to Office 365 in the next few weeks from writing this article as well – imagine booking a meeting where people attend remotely but the remote location is another office.
Call To Action.
Even though this “places” functionality does not reach all the Office email/calendaring clients (yet), this should not be a reason not to do this categorization work.
Its quite easy to generate a list of all the rooms and their current settings (see above) as a spreadsheet.
Its more work to update that list, but if you have a list then you can start.
Rooms don’t often change their status regarding accessibility etc.
but if you start cataloguing your rooms now or add this work to an Exchange Server migration project, then your users will benefit as the functionality reaches the client they use.
If you don’t update your places metadata, then clients will be unable to successfully find meeting rooms.
cyber bullying   Exchange Server offensive  supervision           Review and Audit Offensive Language in Office 365 Communications.
By.
May 7, 2019.
No Comments on Review and Audit Offensive Language in Office 365 Communications.
A new feature as of May 2018 in Office 365 is to filter communications based upon the offensive language machine learning filter.
This is part of the Supervision settings that have been available for a number of years.
The Offensive Language model uses a combination of machine learning, artificial intelligence, and keywords to identify inappropriate email messages as part of anti-harassment and cyber bullying monitoring requirements.
Here we will walk through the process of setting up the offensive language filter and testing it out (without offending anyone).
Setting Up Offensive Language Supervision.
Open the Compliance Center at https://compliance.microsoft.com and select Supervision on the left as shown:  At the time of writing, the Compliance Center is new and not everything is visible here.
By the time you read this article it might be possible to create your supervision reviews from this portal, but for now we need to go to the Security and Compliance Center – so click the link at the top of the page.
You will see this:  If you cannot see this then you do not have the right permissions.
Add yourself to the Supervisory Review role group so you can set up policies.
Anyone who has this role assigned can access the Supervision page in the Compliance Center.
Click Create to create a supervision review.
Enter a name and a description.
You cannot change the name later on.
In the next page, select the users to supervise.
Start with a test group before editing this policy to add a group that contains everyone.
You can also select users who are in the group and specifically exclude them if needed.
Communications via Exchange and Teams are included by default.
Third party sources can be added as well.
Click Next and move to the Choose communications to review tab.
Here select Internal communications (which is not selected by default) and choose Use match data model condition.
There is only one model, and that is the Offensive Language model – so that gets selected by default.
If you want to scope the filter a bit more then you can select Add a condition and set up rules – for example you could exclude a specific domain inbound.
Click Next and get to the Specify percentage to review tab  Here you get to set the percentage of communications to review.
The default is 10%.
This means that only 10% of all communications are reviewed, and the results you see are based on what was found in that 10%.
In large organizations, 10% could be a lot of communications, and therefore could be a fair amount of offensive content.
Therefore ensure both your reviewers are able to manage the review process without undue impact and understand that whatever you find – there is 10 times more of it happening.
Smaller organizations might want to increase the percentage to review, or at least consider increasing the percentage to review.
Click Next and enter the email addresses of the reviewers.
They need to have an Exchange Online mailbox to be able to do this, but the content for review does not go into the reviewers mailbox.
Click Next and get to the Review your settings tab.
Check everything is okay and click Finish.
Your policy will be listed so that you can update it, apart from the name, in the future.
The policy is also displayed in a pop-out as shown:  In this pop-out you can see the name of the mailbox that the content for review will go into – therefore those users who are reviewers will need to have access to this mailbox if they want to use Outlook to do their review process.
If the reviewers have access to the Compliance Center then review can be done there instead of in Outlook/OWA.
Permissions need to be granted to the mailbox using PowerShell.
The two cmdlets are, using your supervisory review mailbox as listed in the policy results.
Add-MailboxPermission "SupervisoryReview{GUID}@domain.onmicrosoft.com" -User "alias or email address of the account that has reviewer permissions to the supervision mailbox" -AccessRights FullAccess Set-Mailbox "SupervisoryReview{GUID}@domain.onmicrosoft.com" -HiddenFromAddressListsEnabled: $false You can add “-AutoMapping $false” to the Add-MailboxPermission if you want the review mailbox not always to appear as an additional mailbox in Outlook.
To Review Your Supervision Policy.
In the Supervision Review pop-out (which you can get back by clicking on the policy name), click Open at the top.
This takes you to:  Here I can see I have nothing to review or pending items to look at.
If you want to test this, think of something offensive and send it to yourself.
It might turn up in the review portal, or it might not – remember only 10% of communications are subject to review.
Note: Emails subject to defined policies are processed in near real-time and can be tested immediately after the policy is configured.
Chats in Microsoft Teams can take up to 24 hours to fully process in a policy.
I’m not going to send anything, but I will take a look back here later and I might update this blog if I ever get any hits.
To review the content, the menu across the top for Review and Resolved Items will show you the items and those that have been resolved.
The actual HR and discipline process is obviously not covered by anything in this review process.
Once resolved in the company, mark it as resolved here.
In OWA, you can open an additional mailbox and enter “super” and the supervisoryreview{GUID} mailbox appears:  Inside the supervisory review mailbox, there is a folder for the policy you just created and inside that are subfolders that indicate review (Non-Compliant and Questionable) and Resolved:  Blocking Offensive Language.
This is just a review process.
If you want to block content, then create a DLP policy that uses a dictionary of words to block.
For more on the dictionary creation see https://docs.microsoft.com/en-us/office365/securitycompliance/create-a-keyword-dictionary                                        2016 2019 autodiscover autodiscover v2 calendar   Exchange Server Microsoft Teams Teams           Teams Calendar Fails To On-Premises Mailbox.
By.
May 6, 2019.
10 Comments on Teams Calendar Fails To On-Premises Mailbox.
In Microsoft Teams, you have a calendar  (previously called meetings) icon in the main display that shows your diary and meetings etc.
– except it does not work if your mailbox is not either in Exchange Online or, if if your mailbox is on-premises, you are not using Exchange Server 2016 CU3 or later.
The reason for this is that the Teams calendar uses AutoDiscover v2, which is only supported by Exchange Server 2016 CU3 and Exchange Online (note that CU3 is not the current version of Exchange Server 2016 and versions later than CU3 also support AutoDiscover v2).
This means that if you have an earlier version of Exchange Server on-premises then the calendar in Teams is not functional.
This raises IT support calls as users expect it to be available, and this impacts your deployment of Teams as it appears broken.
So how can we fix this.
Well clearly migrating to Exchange Online or installing the 2016 or later version of Exchange Server is the obvious option from the above, but there is another option to work around this issue.
The “fix” is to remove the calendar icon from Teams.
This does not stop you booking meetings, as you can still do that in Outlook with the Teams add-in or in the Outlook mobile client, where Teams meeting support is rolling out as I write this blog.
If I remove the calendar icon, then the source of the errors disappears, but Teams is not really adversely impacted.
So this is what we start with:        And we remove the icon by creating a new App Setup Policy in the Teams Admin centre and then deploying that policy to all your users (with on-premises mailboxes on older versions of Exchange, or those not using Exchange for calendaring).
You can easily roll this out as a test, though its about 24 hours for the effect to be seen, and then roll it out in bulk for all your impacted users.
We will cover all this below:.
1.
Creating App Setup Policy.
In the Teams Admin centre (https://admin.teams.microsoft.com) expand Teams Apps > Setup Policies and create a new policy.
This policy is based on your current Global policy.
Select the Calendar app and remove it from this new policy.
You should see something like this:        Here I have created an app policy called “With OnPrem Mailboxes” and removed the Calendar app from it.
2.
Applying App Setup Policy To A Test User.
Once you have the policy ready, its time to test it.
Policy changes will take 24 hours to apply (so say the docs) and I found on my testing it was 18 hours when I ran through these steps – so this is not quick.
To make sure your changes work, the plan here is to deploy this new policy to a few selected individuals in the Teams admin centre.
Find the first user and click on their name.
In the details page you will see the policies applied to the lower left:        Click Edit at the top right of this section and change the App setup policy to your new policy:        And click Save:        You will see your new policy in the list.
Repeat for the rest of your test pool of users using the portal.
We will not use the portal for deploying it to all users though, that will take too long.
Next day, these users should see something like this – no calendar:        3.
Applying App Setup Policy To All Users.
To apply this change to all users once your test users are happy we will use PowerShell, and we will use the Skype for Business Online PowerShell cmdlets (not the Teams PowerShell!).
The following one-line PowerShell, once you have connected to your tenant, is:    Get-CSOnlineUser | ForEach-Object { Grant-CsTeamsAppSetupPolicy -PolicyName "With OnPrem Mailboxes" -Identity $_.
WindowsEmailAddress }    This gets all your users and applies a new Teams App Setup Policy to each of them.
This works initially with this problem, as we assume all users are affected.
If only a subset of your users are on-premises, then do not use this cmdlet to apply the initial change, but use the below to be more selective.
Within 24 hours the Calendar app will disappear from Teams for your users and they will not be phoning the help desk with issues that none of you can easily fix.
4.
Applying App Setup Policy To Selected Users.
The above cmdlet is a single run – it does not affect later and new users, nor is there a concept of a default policy that you can set as the one each new users gets.
So every so often depending upon how often new users start employment you will want to run the below:    Get-CsOnlineUser -Filter { TeamsAppSetupPolicy -ne "With OnPrem Mailboxes" } | Grant-CsTeamsAppSetupPolicy -PolicyName "With OnPrem Mailboxes"    This gets all users where they do not have the selected App Policy already set and sets this just for these users.
This is quicker than setting it for all users regardless.
You can use other filters to select users – for example, you could look for users without an on-premises mailbox and then run the ForEach against each of these users instead – this would work in a hybrid deployment.
When you are in a hybrid deployment and you move mailboxes to Exchange Online from on-premises, you will want to set those users just moved back to a policy that includes the calendar app.
The same would go for organizations migrating to Exchange Server 2016 with inbound AutoDiscover from Office 365.
Here you could use something like importing a CSV file of mailboxes being migrated (the same list you used to build the migration batches in the first place would do) and then run the ForEach for each item on the CSV file.
AADConnect AADSync active directory Azure Active Directory Azure AD compliance conditional access device download enterprise mobility + security    OneDrive OneDrive For Business sharepoint Uncategorized           Read Only And Document Download Restrictions in SharePoint Online.
By.
April 24, 2019.
No Comments on Read Only And Document Download Restrictions in SharePoint Online.
Both SharePoint Online (including OneDrive for Business) and Exchange Online allow a read only mode to be implemented based on certain user or device or network conditions.
For these settings in Exchange Online see my other post at https://c7solutions.com/2018/12/read-only-and-attachment-download-restrictions-in-exchange-online.
When this is enabled documents can be viewed in the browser only and not downloaded.
So how to do this.
Step 1: Create a Conditional Access Policy in Azure AD    You need an Azure AD Premium P1 licence for this feature.
Here I created a policy that applied to one user and no other policy settings.
This would mean this user is always in ReadOnly mode.
In real world scenarios you would more likely create a policy that applied to a group and not individual users and forced ReadOnly only when other conditions such as non-compliant device (i.e.
home computer) where in use.
The steps for this are:                        The pictures, as you cannot create the policies in the cmdline, are as follows:    New policy with a name.
Here it is “Limited View for ZacharyP”.
Under “Users and Groups” I selected my one test user.
Here you are more likely to pick the users for whom data leakage is an issue.
Under “Cloud apps” select Office 365 SharePoint Online.
I have also selected Exchange Online, as the same idea exists in that service as well.
Under Session, and this is the important one, select “Use app enforced restrictions”.
SharePoint Online will then implement read only viewing for all users that fall into this policy you have just created.
Step 3: View the results    Ensure the user is licensed for SharePoint Online (and a mailbox if you are testing Exchange Online) and an Azure AD Premium P1 licence and ensure there is a document library with documents in it for testing.
Login as the user under the conditions you have set in the policy (in my example, the conditions where for the specific user only, but you could do network or device conditions as well.
SharePoint and OneDrive Wizard Driven Setup    For reference, in the SharePoint Admin Centre and Policies > Access Control > Unmanaged Devices, here you turn on “Allow limited web-only access” or “Block access” to do the above process of creating the conditional access rule for you, but with pre-canned conditions:        In the classic SharePoint Admin Center it is found under that Access Control menu, and in SharePoint PowerShell use Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess    Turning the settings on in SharePoint creates the Conditional Access policies for you, so for my demo I disabled those as the one I made for had different conditions and included SharePoint as well as a service.
This is as shown for SharePoint – the banner is across the top and the Download link on the ribbon is missing:        And for OneDrive, which is automatic when you turn it on for SharePoint:                                            calendar  Exchange Server monthly channel  Office 365 ProPlus Outlook semi-annual channel           Save Time.
Have All Your Meetings End Early.
By.
April 3, 2019.
6 Comments on Save Time.
Have All Your Meetings End Early.
I am sure you have been in a meeting, where the meeting end time rolls around and there is a knock at the door from the people who want the meeting room now, as their meeting time has started and yours has finished.
What if you could recover five, eight, ten or more minutes per meeting so that the next meeting party can get into the room on time, and you have time to get out and get to your next meeting, and be on time.
Well since the beginning of 2019, Microsoft have come to your rescue.
The above are the new calendar “End appointments and meetings early” option.
It is available in Outlook for Windows that is part of Office 365 ProPlus and you need to have a version of the software released new in 2019 for the feature to be available – more on the version and what to do in the technical section below.
The above option is found from File > Options > Calendar and then looking under Calendar Options as shown.
Check the option ”End appointments and meetings early” and then choose the time that a meeting under 1 hour will end early, and you can choose 5, 8 or 10 minutes, and then a second option for meetings over 1 hour – these can end 5, 10 or 15 minutes early.
You can also enter your own preferred end early time.
Click OK and go create a new meeting.
It should not matter how you create the meeting.
As you can see from my options above, my default meeting is 30 minutes – so on creating a new meeting I see the following:   I’ve highlighted the new end time – its 25 minutes after the meeting starts.
The adjustment applies to the default meeting length and shortens it for me.
If for this meeting I want it to be the full 30 minutes, I can just write in the new time – all Outlook is doing is setting a new adjustable default for me.
For meetings where you drag out a custom duration in your calendar – it works here as well:  As you can see I have dragged out 1pm to 4pm on Thursday.
Look what happens when I enter some text for the meeting subject:  The meeting is created with an end time ten minutes early (my preferred time saving duration for meetings over one hour).
As with the above, I can adjust the time of this meeting to the full hour if I want to very easily – just drag the meeting block to the full hour and it is kept.
Its just the default time when I first create the meeting that is adjusted.
Note that existing meetings are not changed – but if you go into an existing meeting and look at the end time drop down, you will see suggestions for the duration that take the early end time into consideration:  So, that’s how you can save time on your meetings (or at least one way, being prepared for them is another and technology cannot help there – yet!).
Changing The Defaults For Everyone.
But what if you are the HR department or the representative of the department for digital change – what if you want to try and improve company culture and change these defaults across the board – well this is a job for IT, but they can easily roll out a setting to all your computers that set a end early time for both short and longer meeting durations.
They need to deploy a group policy setting that changes the registry at HKEY_CURRENT_USERSoftwareMicrosoftOffice16.0OutlookOptionsCalendar and updates both EndEarlyShort and EndEarlyLong values as well as the EndEventsEarly key.
EndEarlyShort is of course the value that affects meetings under one hour – and you do not need to accept the Microsoft suggested durations of 5, 8 and 10 minutes.
For example if I edit this DWORD registry key and set the value to 3, upon restarting Outlook my new meetings under one hour end three minutes early:  The EndEventsEarly value is the setting that turns the feature on.
So as well as setting the end early times, you need to set this value to 1 as well.
If you want to roll out this change centrally and ensure that the end user cannot set their own custom end early time then you can change the registry key policy settings via HKEY_CURRENT_USERSoftwarePoliciesMicrosoftOffice16.0OutlookOptionsCalendar.
Changes in this registry location mean the user cannot adjust the end early times.
You can disable this option centrally as well by setting EndEventsEarly DWORD value to 0 – this has the effect of disabling the check box and so users cannot turn the option on.
All these three settings are included in the latest update to the Office365 Administrative Templates, available on Microsoft Download Center: https://www.microsoft.com/en-us/download/details.aspx?id=49030 as well.
Checking Your Outlook Version.
Version 1812 or later in use on the Monthly Channel is required before you can use this feature.
In most businesses you are probably using the Semi-Annual channel, and this has features deferred by at least six months.
So to check, click File > Office Account in any Office application (shown below).
To the right hand side you will see the below.
You need to check you are running the Subscription Product and that under About Outlook (or whatever Office app you are checking), it reads Version 1812 or later and Monthly Channel.
The Semi-Annual Channel is released in January and July each year and is deferred by at least six months, so as this feature was released in Dec 2018, this feature will not appear in the Semi-Annual Channel until at least July 2019 – build 1812 of the Semi-Annual Channel (and possibly not until build 1907).
More on this release cycle can be found at https://docs.microsoft.com/en-us/deployoffice/overview-of-update-channels-for-office-365-proplus                                         activesync android email   Exchange Server iPad iPhone           Too Many Folders To Successfully Migrate To Exchange Online.
By.
April 2, 2019.

2 Comments on Too Many Folders To Successfully Migrate To Exchange Online

Exchange Online has a limit of 10,000 folders within a mailbox.
If you try and migrate a mailbox with more than this number of folders then it will fail – and that would be expected.
But what happens if you have a mailbox with less than this number of folders and it still fails for this same reason.
This is the problem, with resolution, I outline below.
I was moving some mailboxes to Exchange Online when I came across the following error in the migration batch results: Data migrated: 18.18 MB ‎(19,060,890 bytes)‎ Migration rate: 0 B ‎(0 bytes)‎ Error: MigrationMRSPermanentException: Error: Could not create folder 2288.
–> MapiExceptionFolderHierarchyChildrenCountQuotaExceeded: Unable to create folder.
‎(hr=0x80004005, ec=1253)‎ Diagnostic context: Lid: 55847 EMSMDBPOOL.
EcPoolSessionDoRpc called [length=204] Lid: 43559 EMSMDBPOOL.
EcPoolSessionDoRpc returned [ec=0x0][length=468][latency=1] Lid: 52176 ClientVersion: 15.20.1730.17 Lid: 50032 ServerVersion: 15.20.1730.6019 Lid: 35180 Lid: 23226 — ROP Parse Start — Lid: 27962 ROP: ropCreateFolder [28] Lid: 17082 ROP Error: 0x4E5 Lid: 25953 Lid: 21921 StoreEc: 0x4E5 Lid: 27962 ROP: ropExtendedError [250] Lid: 1494 —- Remote Context Beg —- Lid: 38698 Lid: 29818 dwParam: 0x0 Msg: f28f1e21-62aa-4999-977f-ce310efea309-61f0997f-74d5-4421-9050-64f8272e5ac2[9]-28A06 Lid: 29920 dwParam: 0xB Lid: 29828 qdwParam: 0x2711 Lid: 29832 qdwParam: 0x2710 Lid: 45884 StoreEc: 0x4E5 Lid: 29876 StoreEc: 0x4E5 Lid: 30344 StoreEc: 0x4E5 Lid: 54080 StoreEc: 0x4E5 Lid: 56384 StoreEc: 0x4E5 Lid: 38201 StoreEc: 0x4E5 Lid: 35904 Lid: 45434 Guid: f12f3e45-67aa-89012-345f-ce678efea901 Lid: 10786 dwParam: 0x0 Msg: 15.20.1730.017:VI1PR0502MB2975:145a3769-3902-4e6b-9fe4-6db564e4eb92 Lid: 1750 —- Remote Context End —- Lid: 31418 — ROP Parse Done — Lid: 22417 Lid: 30609 StoreEc: 0x4E5 Lid: 29073 Lid: 20369 StoreEc: 0x4E5 Lid: 64464 Lid: 64624 StoreEc: 0x4E5 In the above I have highlighted some of the errors I was seeing – with the “could not create folder” message, the first indicator is that I have too many folders to migrate or I have a corrupt mailbox.
Running Get-MoveRequestStatistics and including a full report (with -IncludeReport) shows in part the below.
This was run to get more info on the move request.
This was run from Exchange Online: ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​26/03/2019 17:10:09 [VI1PR0502MB3855] ‘MigrationService (on behalf of ‘Brian.
[email protected]’)’ created move request.
26/03/2019 17:10:15 [DB8PR05MB6025] The Microsoft Exchange Mailbox Replication service ‘DB8PR05MB6025.eurprd05.prod.outlook.com’ (15.20.1730.17 ServerCaps:01FFFFFF, ProxyCaps:07FFFFC7FD6DFDBF5FFFFFCB07EFFF, MailboxCaps:, legacyCaps:01FFFFFF) is examining the request.
26/03/2019 17:10:15 [DB8PR05MB6025] Content from the Shard mailbox (Mailbox Guid: f12f3e45-67aa-89012-345f-ce678efea901, Database: cc980daf-4402-4645-b26c-2a83760b161c) will be merged into the target mailbox.
26/03/2019 17:10:15 [DB8PR05MB6025] Connected to target mailbox ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’, database ‘EURPR05DG090-db014’, Mailbox server ‘DB8PR05MB6025.eurprd05.prod.outlook.com’ Version 15.20 (Build 1730.0).
26/03/2019 17:10:20 [DB8PR05MB6025] Connected to source mailbox ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’, database ‘DB’, Mailbox server ‘onprem.server.domain.com’ Version 15.0 (Build 847.0), proxy server ‘onprem.server.domain.com’ 15.0.847.40 ServerCaps:, ProxyCaps:, MailboxCaps:, legacyCaps:1FFFCB07FFFF.
26/03/2019 17:10:21 [DB8PR05MB6025] Request processing started.
26/03/2019 17:10:21 [DB8PR05MB6025] Source mailbox information: Regular Items: 8443, 905.4 MB (949,422,345 bytes) Regular Deleted Items: 1149, 189.9 MB (199,115,692 bytes) FAI Items: 4651, 11.72 MB (12,285,701 bytes) FAI Deleted Items: 9, 19.26 KB (19,721 bytes) 26/03/2019 17:10:21 [DB8PR05MB6025] Cleared sync state for request 2c065e32-3bd5-4524-9aac-03880fa8e961 due to ‘CleanupOrphanedMailbox’.
26/03/2019 17:10:21 [DB8PR05MB6025] Mailbox signature will not be preserved for mailbox ‘tenant.onmicrosoft.comf12f3e45-67aa-89012-345f-ce678efea901 (Primary)’.
Outlook clients will need to restart to access the moved mailbox.
26/03/2019 17:11:20 [DB8PR05MB6025] Stage: CreatingFolderHierarchy.
Percent complete: 10.
26/03/2019 17:12:38 [DB8PR05MB6025] Initializing folder hierarchy from mailbox ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’: 29048 folders total.
26/03/2019 17:21:21 [DB8PR05MB6025] Folder creation progress: 1102 folders created in mailbox  ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’.
26/03/2019 17:31:22 [DB8PR05MB6025] Folder creation progress: 2730 folders created in mailbox  ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’.
26/03/2019 17:41:22 [DB8PR05MB6025] Folder creation progress: 4535 folders created in mailbox  ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’.
26/03/2019 17:51:23 [DB8PR05MB6025] Folder creation progress: 6257 folders created in mailbox  ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’.
26/03/2019 18:01:23 [DB8PR05MB6025] Folder creation progress: 7919 folders created in mailbox  ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’.
26/03/2019 18:11:23 [DB8PR05MB6025] Folder creation progress: 9570 folders created in mailbox  ‘tenant.onmicrosoft.com2c065e32-3bd5-4524-9aac-03880fa8e961 (Primary)’.
26/03/2019 18:14:15 [DB8PR05MB6025] Fatal error StoragePermanentException has occurred  The move request logs show an increasing folder count, and when this exceeds 10,000 a storage error occurs.
So the next thing to do is to check what I have on-premises.
I have generally two options to try and fix a mailbox I am moving to Exchange Online.
One is to move the mailbox elsewhere on-premises (on the basis that I discard errors on-premises and then move a cleaner mailbox to the cloud) or run repairs on the mailbox.
Note that running repairs on-premises is part of the move to the cloud anyway as Exchange Server does this as part of the move.
But this revealed nothing.
The move request logs on-premises showed the same – there was over 10,000 folders (indeed some of my mailboxes had over 20,000 folders) and this was enumerated in the move request logs.
A New-MailboxRepairRequest did nothing either.
But interestingly, Get-MailboxFolderStatistics | Measure showed only 200 folders.
Each of my failing mailboxes had between 150 and 263 folders – nothing like the +10,000 that the move request was finding.
So I opened the mailbox in Outlook having granted myself permissions to it – again nothing.
So I opened MFCMapi and had a look at the folders.
Now MFCMapi shows everything in the mailbox, and not just items under the “top of the information store” folder.
I went about expanding each subfolder I could find and I came across a subfolder that everytime i expanded it, MFCMapi would hang.
I would close and restart MFCMapi and the same thing.
I had found my suspect folder – its a iPhone device that had created the +10,000 folders.
Now that I had a good candidate for my issue, the fix was easy.
I listed the active-sync devices using Get-MobileDevice -Mailbox “Richard Redmond” | FL Identity and then removed the suspect device using Remove-ActiveSyncDevice “domain.co.uk/OU/Richard Redmond/ExchangeActiveSyncDevices/iPhone§A9BCDE7FG57HIJ81KL1M08NOPQ” -Confirm:$false where the device identity was returned in the Get-MobileDevice cmdlet run just before.
This Remove-ActiveSyncDevice (or Remove-MobileDevice) cleans up this mailbox and deletes the partnership with the device.
Once this was done, I moved the mailbox again and it was ~200 folders and moved to Exchange Online without further issue.

Where I tested the move to Exchange Server rather than Exchange Online

I found that looking in the move request report (I had prestaged the move and then removed the corrupt mobile device), the move report showed information like the following and all I had done was removed one mobile device from the mailbox.
26/03/2019 17:41:22 [servername] Folder hierarchy changes reported in source ‘Primary (a8c13a2f-535b-d996-908e-ff84b1484a7)’: 200 changed folders, 24080 deleted folders.
From the users perspective, if the phone is an active device and is syncing email, then removing the phone causes it to create a new partnership.
If the server allows any device then this is seamless to the user.
If the server requires authorization to add a new device, then the user will be told this and service desk/admin will need to approve the device again.
So if Allow/Block/Quarantine (ABQ) is not enabled on the server, one wonders if deleting all active sync partnerships before migrating any mailbox is an idea worth considering – there could be mailboxes I have moved that are <10,000 folders but not far from that number and therefore storing up issues for the future.
Exchange Server mailbox move            Exchange Move Requests | Large Items | And Setting TCP KeepAliveTime To A Large Value.
By.
March 12, 2019.
No Comments on Exchange Move Requests | Large Items | And Setting TCP KeepAliveTime To A Large Value.
I have seen this situation a number of times.
A large mailbox (or mailbox and archive) wont move to the target because the process of checking what the changes are in the mailbox take too long, the network or Exchange Server times out the users move and then reports the mailbox is locked.
The fix for this is counter though to everything else you read online about this.
Often you will see to reduce the TCP KeepAliveTime and reboot the server.
This is the opposite – increase the value and do not reboot the server.
Here is why:  First make sure no bad items in your failed moves – this is not a fix for bad items, this is a fix where things timeout: Get-MoveRequest -MoveStatus failed | Get-MoveRequestStatistics | fl badite*  View the Move Request Statistics log for one of your failed mailbox moves: Get-MoveRequestStatistics "&lt;name&gt;" -IncludeReport | fl | Out-File movereport.txt  Search the report that you have saved in the above cmdlet and search for “Error” in the text file.
If you get the following then the mailbox is probably too large for a successful move, which means the source server or network has not got the resources.
What can happen is the move is progressing and a check happens for changes to the source mailbox – this takes a long time to complete and something times out.
When target Exchange tries to connect again, the source has lost the TCP port and so a new move is started, but the mailbox is still locked for the old move.
Therefore the move cannot continue.
I have found that by increasing TCP KeepAliveTime (contrary to all the advise online) that this solves the issue.
Now I need to be clear here – all I am doing is changing the registry key for this setting and restarting the MRS service on the source Exchange Server.
I am NOT restarting Windows, and so I am not changing the KeepAliveTime for the entire network stack.
I think MRS checks the registry key to see the KeepAliveTime and sets this to the lock time on the mailbox during the move.
If I can lock the mailbox for longer, moves don’t timeout and fail is the theory behind why this happens The error I get in the MailboxStatistics report (see above for cmdlet) reads:  Message                                : Error: Couldn’t switch the mailbox into Sync Source mode.
This could be because of one of the following reasons:                                             Another administrator is currently moving the mailbox.
The mailbox is locked.
The Microsoft Exchange Mailbox Replication service (MRS) doesn’t have the correct permissions.
Network errors are preventing MRS from cleanly closing its session with the Mailbox server.
If this is the case, MRS may continue to encounter this error for up to 2 hours – this duration is controlled by the TCP KeepAlive settings on the Mailbox server.
Wait for the mailbox to be released before attempting to move this mailbox again.
–> An error occurred while saving the changes on the folder “FolderID/”.
Error details: Failed, Property: [0x66180003]                                           InTransitStatus, PropertyErrorCode: AccessDenied, PropertyErrorDescription:.
–> Property: [0x66180003] InTransitStatus, PropertyErrorCode: AccessDenied,                                           PropertyErrorDescription:.
Of interest in the error is the point that says “MRS may continue to encounter this error for up to 2 hours ”.
This time value matches the default TCP KeepAliveTime value.
Raising this in the registry and restarting the MRS service (not the server) changes the lock timout, which means that when the long job that is happening on the target finishes (and takes longer than two hours), the source server is still waiting for the connection and does not throw the above error.
Once you have your mailboxes moved, delete the registry value (to put it back to the default of two hours) and avoid rebooting the server when this key is set to a different value.
If you started with a different value return to that one instead of deleting the registry value.
The KeepAliveTime setting is found at HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters, and its a DWORD value called KeepAliveTime.
The value is in milliseconds, so 7200000 is two hours and 86400000 is 24 hours (which is the value I tend to use to resolve this issue).
This change is made on the mailbox server and the service restarted on that server (or servers if you have more than one).
crm Dynamics   Exchange Server router           CRM Router and Dynamics CRM V9 Online–No Emails Being Processed.
By.
February 25, 2019.
No Comments on CRM Router and Dynamics CRM V9 Online–No Emails Being Processed.
This one is an interesting one – and it was only resolved by a call to Microsoft Support, who do not document that this setting is required.
The scenario is that you upgrade your CRM Router to v9 (as this is required before you upgrade Dynamics to V9) and you enable TLS 1.2 on the router server as well (also documented as required as part of the upgrade).
Dynamics is updated and all your email that is processed using the Router stops.
Everything was working before and now it is not.
The fix is simple though – and complex as well.
The simple thing is that it is a a single check box you need to set.
The complex thing is that as this is a GDPR setting, each user needs to do it themselves and it cannot be enabled in bulk.
The option each user needs to allow is “Allow other Microsoft Dynamics 365 users to send email on your behalf” and that this was checked.
This option is located in CRM > Options > Email > Select whether other users can send email for you  Once each user does this, the router will start to process emails for this user again.
Azure Active Directory Azure AD download             Read Only And Attachment Download Restrictions in Exchange Online.
By.
December 19, 2018.

No Comments on Read Only And Attachment Download Restrictions in Exchange Online
Microsoft have released a tiny update to Exchange Online that has massive implications

I say tiny in that it take like 30 seconds to implement this (ok, may 60 seconds then).
When this is enabled, and below I will describe a simple configuration for this, your users when using Outlook Web Access on a computer that is not compliant with a conditional access rule in Azure AD, will result in OWA that is read only – attachments can be viewed in the browser only and not downloaded.
There is even a mode to have attachments completely blocked.
So how to do this.
Step 1: Enable the OwaMailboxPolicy New Setting Only users whose OWAMailboxPolicy have the ConditionalAccessPolicy set to ReadOnly or ReadOnlyPlusAttachmentsBlocked are impacted by this feature.
For example if you wanted a subset of users to always have this restriction regardless, but not other users then you would create a new OwaMailboxPolicy and set the ConditionalAccessPolicy setting.
Once that is done you would apply the policy to the selected users.
In my example I am just going to update the default policy, becuase I want read only view for all users who fall out of the conditions of the policy.
So in Exchange Online PowerShell I run the following: Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -ConditionalAccessPolicy ReadOnly This, once the conditional access policy takes effect will restrict downloads in OWA.
The second option is to use ReadOnlyPlusAttachmentsBlocked instead of ReadOnly.
This blocks attachment viewing as well.
I understand other options and therefore values for this property are coming.
The value “Off” turns off the restrictions again.
“Off” is the default value.
Step 2: Create a Conditional Access Policy in Azure AD You need an Azure AD Premium P1 licence for this feature.
Here I created a policy that applied to one user and no other policy settings.
This would mean this user is always in ReadOnly mode.
In real world scenarios you would more likely create a policy that applied to a group and not individual users and forced ReadOnly only when other conditions such as non-compliant device (i.e.
home computer) where in use.
The steps for this are:  The pictures, as you cannot create the policies in the cmdline, are as follows: a) New policy with a name.
Here it is “Limited View for ZacharyP” b) Under “Users and Groups” I selected my one test user.
Here you are more likely to pick the users for whom data leakage is an issue c) Under “Cloud apps” select Office 365 Exchange Online.
I have also selected SharePoint, as the same idea exists in that service as well d) Under Session, and this is the important one, select “Use app enforced restrictions”.
For Exchange Online, app enforced restrictions is the value of ConditionalAccessPolicy for the given user.
Step 3: View the results Ensure the user is licenced to have a mailbox and Azure AD Premium P1 and ensure they have an email with an attachment in it for testing.
In the screenshot you can see circled where the Download link is normally found:  And where the attachment is clicked, there is now a greyed out Download button and a banner is seen in both views telling the user of their limited access.
The new user interface to OWA looks as follows:  With ReadOnlyPlusAttachmentsBlocked set as the ConditionalAccessPolicy value, the attachment cannot be viewed.
This is what this looks like (new OWA UI):  And SharePoint and OneDrive, just because it is very similar.
This is outlined in https://c7solutions.com/2019/04/read-only-and-document-download-restrictions-in-sharepoint-online                                          Exchange Server migration Public Folders           Public Folder Migrations and the Changing Cmdlets.
By.
December 13, 2018.
3 Comments on Public Folder Migrations and the Changing Cmdlets.
To complete a public folder migration from Exchange 2013/2016 to Exchange Online you need to run  Set-OrganizationConfig -PublicFolderMailboxesLockedForNewConnections $true  But if you look at lots of the documentation that is out there with their tips and tricks etc.
you will see that lots of them say:  Set-OrganizationConfig –PublicFoldersLockedForMigration $true  So very near – but its the wrong cmdlet now and it does nothing.
It does not lock out the public folders and in the cloud all you get is:  PS C:UsersBrianReid> Complete-MigrationBatch PublicFolderMigration The public folders in the source environment are not ready for finalizing the migration.
Make sure that public folder access is locked on the source Exchange server, and there are no active public folder mailbox moves or public folder moves in the source.     + FullyQualifiedErrorId : [Server=VI1PR09MB2909,RequestId=ca0ffb4a-cc9f-4195-94fd-e3dd060587e6,TimeStamp=13/12/2018 18:03:00] [FailureCategory=Cmdlet-MigrationBatchCannotBeCompletedException] 2FB8651C,Microsoft.
Exchange.
Management.
Migration.
MigrationService.
Batch.
CompleteMigrationBatch     + PSComputerName        : outlook.office365.com   And there is nothing useful on the web for this error, so I wrote this to help you get out of this hole.
Run the correct cmdlet and migrations will start.

Certificates  Exchange Server Kemp SSL           Test Connectivity Website and TLS 1.2

By.
November 29, 2018.
No Comments on Test Connectivity Website and TLS 1.2.
An excellent resource for Microsoft Exchange Server and Exchange Online administrators and consultants is the Remote Test Connectivity website at http://exrca.com or https://testconnectivity.microsoft.com/.
Here I am going to document an error that indicated that the Exchange Server (in this case) was not working, but we could see that the phone was connecting fine to the server.
The error we say was:  “The certificate couldn’t be validated because SSL negotiation wasn’t successful.
This could have occurred as a result of a network error or because of a problem with the certificate installation.”  and also  “The Microsoft Connectivity Analyzer wasn’t able to obtain the remote SSL certificate”  The error looked like the following:  This error occurs when TLS 1.0 is disabled either on the end server or on a load balancer in front of the server.
In my case this as the case with the Kemp load balancer we were using – TLS 1.0 was disabled under SSL Properties.
Once we restored TLS 1.0 the Remote Connectivity Test tool, the tool worked instantly:                                         AADConnect   Exchange Server migration  Public Folders           Public Folder Sync–Duplicate Name Error.
By.
September 7, 2018.
No Comments on Public Folder Sync–Duplicate Name Error.
I came across this error with a client today and did not find it documented anywhere – so here it is.
When running the Public Folder sync script Sync-ModernMailPublicFolders.ps1 which is part of the process of preparing your Exchange Online environment for a public folder migration, you see the following error message:  UpdateMailEnabledPublicFolder : Active Directory operation failed on O365SERVERNAME.)365DATACENTER.
PROD.
OUTLOOK.
COM.
The object ‘CN=PublicFolderName,OU=tenant.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=)365DATACENTER,DC=PROD,DC=OUTLOOK,DC=COM’ already exists.
At C:ExchangeScriptspfToO365Sync-ModernMailPublicFolders.ps1:746 char:9 +         UpdateMailEnabledPublicFolder $folderPair.
Local $folderPair.
Remote; +         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException     + FullyQualifiedErrorId : Microsoft.
PowerShell.
Commands.
WriteErrorException,UpdateMailEnabledPublicFolder  This is caused because you have a user or other object in Active Directory that has the same name as the mail enabled public folder object.
In Exchange Online PowerShell if you run Get-User PublicFolderName you should not get anything back, as its a Public Folder and not a user, but where you see the above error you do get a response to Get-User (or maybe Get-Contact or any other object that is not a Public Folder.
This class of object name (common name or cn) means the script can create the public folder in the cloud, but not update it on subsequent runs of the script.
The easiest fix is to rename the common name of the public folder object in Active Directory for all clashing public folders, unless you know you do not need the other object that clashes – as renaming that and letting AADConnect sync process the change is another way to resolve this.
To rename the mail public folder, in Exchange Server management shell run Set-MailPublicFolder PublicFolderName –Name NewPublicFolderName I have changed my names to start with pf, so PublicFolderName becomes pfPublicFolderName and then the script runs without issue.
aadrm Azure Information Protection certificates   IRM Office  rms SSL           Azure Information Protection and SSL Inspection.
By.
July 6, 2018.
No Comments on Azure Information Protection and SSL Inspection.
I came across this issue the other day, so thought I would add it to my blog.
We were trying to get Azure Information Protection operating in a client, and all we could see when checking the download of the templates in File > Info inside an Office application was the following:    The sequence of events was File > Info, click Set Permissions.
You get the “Connect to Rights Management Servers and get templates” menu item.
Clicking this shows a box saying “Retrieving templates from server” (which you might not see as this step takes no real time at all) and then an error that reads “Your machine isn’t set up for Information Rights Management (IRM).
To set up IRM, sign into Office, open and existing IRM protected message or document, or contact your helodesk”.
For each of these recommendations, we tried them and still got the same message.
So what was the issue.
In https://docs.microsoft.com/en-us/azure/information-protection/get-started/requirements#firewalls-and-network-infrastructure Microsoft state the the IRM client in Windows uses Certificate Pinning.
This is where the client application knows what certificate it expects to see at the service it is connecting to.
If it gets a different certificate it will fail to connect.
Within enterprise organizations, firewalls and proxy devices that do SSL Inspection change the certificate in use so that they can see the content being sent to the service in the clear.
For the IRM client in Windows, this means that IRM does not trust the certificate and so will not work.
You can test for SSL Inspection on a URL by browsing the target URL in Chrome.
For example, for IRM go to https://admin.na.aadrm.com/admin/admin.svc and click the Secure banner in the address bar:  You will get a popup – hover over the “Certificate (Valid)” message.
If the certificate is not valid then either your PC is missing some important updates or SSL inspection is happening, but not implemented correctly.
You can use this same test to check for SSL Inspection on any network.
The certificate listed when you hover over the “Certificate (Valid)” message should read (for AIP) a Microsoft CA issued certificate.
It should not list your company or proxy service as the issuer.
Do not terminate the TLS client-to-service connections (for example, to do packet-level inspection) to the Azure Rights Management service.
Doing so breaks the certificate pinning that RMS clients use with Microsoft-managed CAs to help secure their communication with the Azure Rights Management service.
For network performance, Microsoft also have a list of URLs that they recommend you do not inspect for Office 365 services.
This list of endpoints that should not be inspected are those categorised as Optimize or Allowed when you browse  https://endpoints.office.com/endpoints/O365Worldwide?ClientRequestId=GUID.
Interestingly at the time of writing this lists aadrm.com as Default, which means it can be inspected – I have reported this to the team that manages the endpoint service so that this URL can be moved up in its classification.
Once you bypass SSL Inspection for *.aadrm.com you will find that the Office and RMS clients work fine (assuming everything else is enabled correctly of course).
error   Exchange Server migration move           CannotEnterFinalizationTransientException On Exchange Move Request.
By.
June 26, 2018.
No Comments on CannotEnterFinalizationTransientException On Exchange Move Request.
Did not find a lot on the internet on this particular error, so I guess it does not happen very often, but in my case it delayed to move of the mailbox in question by a week or so until I could resolve it.
When a mailbox is moving to a different Exchange organization (cross-forest or to/from Exchange Online) the move process copies the mailbox data to the target database and then right at the end of the move updates Active Directory in both the source and target forest.
In the source it changes the object type from mailbox to mailuser (or remotemailbox if Exchange Online is in play, though this is really a special form of mailuser) and in the target, updates the mailuser to become a mailbox.
This particular error occurs at this stage.
The Get-MoveRequest cmdlet reports Failed as the status, and Get-MoveRequestStatistics reports FailedOther as the status.
If you get the move logs (Get-MoveRequestStatistics <name> -IncludeReport | FL | Out-File <filename.txt>) then in the logs you will see CannotEnterFinalizationTransientException as the error repeated many times until the move fails.
The fix for this issue is as follows: 1.
Check that the Exchange System account has permission to the Active Directory object in question.
In Active Directory Users and Computers choose View > Advanced to enable the Security tab and then view the security tab on the object in question.
Edit > Advanced and then check or click “Enable Inheritance” option or button (depending upon version of AD tools).
If inheritance is already set to enabled there is probably no harm in disabling inheritance, copying permissions and then enabling inheritance again.
2.
Move the mailbox to a different database in the source Exchange Organization (New-MoveRequest <name>) and waiting for that to complete.
3.
Removing and restarting the move in the target forest.
If you do not remove and restart the move in the target you will see both MailboxIsNotInExpectedMDBPermanentException and SourceMailboxAlreadyBeingMovedTransientException.
The first of these is because the mailbox is not where the target move expects it to be, and the second of these is becuase the source is currently being moved and so cannot be moved to the correct target forest at the same time.
This should resolve your ultimate move request – it did for me!                                          Authentication EOP   Exchange Online Protection Exchange Server hybrid smtp spam           Anonymous Emails Between On-Premises and Exchange Online.
By.
May 17, 2018.

1 Comment on Anonymous Emails Between On-Premises and Exchange Online

When you set up Exchange Hybrid, it should configure your Exchange organizations (both on-premises and cloud) to support the fact that an email from a person in one of the organizations should appear as internal to a recipient in the other organization.
In Outlook that means you will see “Display Name” at the top of the message and not “Display Name” <email address>.
An email from the internet is rightly treated as anonymous and so should appear as “Display Name” <email address> but when it comes from your on-premises environment or your cloud tenant it should be authenticated.
In the email headers you should see a header called AuthAs that reads internal.
The SCL (Spam Confidence Level) should always be –1 and you should not have a header called X-CrossPremisesHeadersFilteredBySendConnector visible on internal emails.
Your hybrid setup can be incorrectly configured and cause this, and depending upon what Exchange Server version you are running and when you last ran the hybrid wizard you can end up with different results.
Lets take a quick view to some of the settings you should see:  Exchange Server 2010 (with or without Edge Server 2010).
Hybrid wizard will use Remote Domains to control internal vs external and authentication state.
You should have a Remote Domain for tenant.mail.onmicrosoft.com that shows TNEFEnabled, TrustedMailOutboundEnabled, TargetDeliverDomain, and IsInternal all set to True on-premises.
TrustedMailnboundEnabled attribute is set to True on Get-RemoteDomain domain.com in the cloud.
The AllowedOOFType, which controls Out Of Office is set to InternalLegacy.
Exchange Server 2013 and later.
Your “Outbound to Office 365” send connector on-premises should have CloudServicesMailEnabled set to True.
The Remote Domains matter for Out of Office and moderated emails/voting buttons, but not for authentication as mentioned in #1 above.
The Inbound Connector for “Inbound from GUID” should have CloudServicesMailEnabled set to True.

Exchange Server 2010 with Exchange Server 2013 or later Edge (no 2013 on-premises

only Edge).
The setting CloudServicesMailEnabled needs to be True, but 2010 does not support this setting, so you need to edit the directory using ADSIEdit and change the msExchSmtpSendFlags on the send connector from 64 to 131136.
All this does is tell the 2013 or later Edge to enable CloudServicesMailEnabled.
See https://support.microsoft.com/en-us/help/3212872/email-sent-from-an-on-premises-exchange-2013-edge-transport-server-to for the steps to do this.
As #3 but with 2010 and 2013 on-premises – run the cmdlets and hybrid wizard from the 2013 server and not connected to the 2010 server!.
Posts navigation.
←  Newer Posts   1  2 …  6 Older Posts   →                                                    Select Category  2003  2004  2007  2008  2008 R2  2010  2012  2012 R2  2013  2016  2019  2FA  64 bit  AADConnect  aadrm  AADSync  access  acdc  active directory  activesync  add-in  ADDS  ADFS  ADFS 2.0  ADFS 3.0  ADFS Connector  AdminSDHolder  adsiedit  Advanced Threat Protection  agent  AIP  android  antivirus  anycast  app password  Application Guard  archive  asterisk  asterisknow  ATP  Authentication  autodiscover  autodiscover v2  az  Azure  Azure Active Directory  Azure AD  Azure Information Protection  AzureAD  backup  baseline  bing  bios  booking  bpos  branding  cafe  calendar  certificates  Chrome  citrix  Click To Run  Click2Run  cloud  Cloud PBX  Clutter  cmak  compliance  conditional access  conversation  crm  cross-forest  cyber bullying  dell  Deployment  device  device registration  dirsync  dkim  DLP  dmarc  DNS  domain  door  download  draytek  DSC  duplicate  dynamic delivery  Dynamics  EAS  ebs 2008  Edge  EM+S  email  encryption  Endpoint Manager  enterprise mobility + security  Entourage  EOP     Exchange Online Protection  error  EWS  exchange  exchange online  Exchange Server  EXO  ExpressRoute  federation  FIDO  firewall  Focused Inbox  FOPE  Free/Busy  GeoDNS  Global Catalog  GPO  Group Policy  groups  hosting  hotfix  https  hybrid  hyper-v  IAmMEC  IFilter  iis  illustration  install  Intune  iOS  ip  iPad  iPhone  ipsec  ipv4  ipv6  iQ.
Suite  IRM  isa  ISA Server 2004  ISA Server 2006  JetNexus  journal  journaling  Kemp  kerberos  lab  licence  Live Event  load balancer  Load Master  loadbalancer  logo  Lync Server  mailbox  malware  management  mcafee  mcas  mcm  mcsm  mdatp  MDM  media player  MFA  microsoft  Microsoft 365  Microsoft Cloud App Security  Microsoft Defender Advanced Threat Protection  Microsoft Teams  migration  Mobile Device Management  mobile phones  modern authentication  monthly channel  move  msExchDelegateListBL  msExchDelegateListLink  MSOL  multi-factor auth  Multi-Factor Authentication  MVP  MX  ndr  Netscaler  networking  NTL  OAuth  OD4B  ODFB  off  offensive  Office  Office 365  Office 365 Advanced Threat Protection  Office 365 Groups  Office 365 ProPlus  oledb  OneDrive  OneDrive For Business  openmanage  orange  organization relationships  osma  Outlook  owa  OWA for Devices  password  paxton  pbx  permissions  PFDAVAdmin  phish  phishing  phone factor  pkcs  pki  places  policy  powershell  pptp  preview  Proof Of Concept  proxy  pst  PSTN  PSTN Conferencing  Public Folders  recovery  remote desktop  remote web workplace  retention  retention policies  rms  room  router  rras  rtp  rules  rww  Safe Attachments  Safe Documents  Safe Links  Salesforce  sbs 2008  SCOM  sdk  search  security  Security and Compliance Center  self-service password reset  semi-annual channel  send-on-behalf  server administrator  server core  shared mailbox  sharepoint  sip  Skype For Business Online  Skype for Business Server  smarthost  smartphone  sms  smtp  spam  spf  spoof  spv  SQL  sql express  SSL  SSO  sspr  sstp  starttls  storage card  Stream  supervision  sync error  sysprep  Teams  TechEd  terminal server  Terminal Services  text message  Threat Management  TLS  tmg  token2  transport  transport agent  ts gateway  Uncategorized  unif  unified messaging  update  upgrade  vc++  vhd  virtual pc  virtual server  virtualisation  vista  visual studio  vm  VNet  Voicemai  voicemail.

Offline

Board footer

Powered by FluxBB