virtual Directory | Authentication Configured | NTFS permissions |
Autodiscover | Anonymous | Authentication Users (read, Read and Execute) |
Basic Auth. | System (Full Control) | |
Windows Auth. | Administrators (Full Control) | |
ECP | Anonymous | Authentication Users (read) |
Basic Auth. | System (Full Control) | |
Administrators (Full Control) | ||
EWS | Anonymous | Authentication Users (read) |
Windows Auth. | System (Full Control) | |
Administrators (Full Control) | ||
EAS | Basic Auth. | Authentication Users (read) |
System (Full Control) | ||
Administrators (Full Control) | ||
OAB | Windows Auth. | System (Full Control) |
Organization Management (Traverse, Read & Execute, Read Attribute, Read Extended Attribute) | ||
View only organizations Managenet (Traverse, Read & Execute , Read Attribute, Read Extended Attribute) | ||
Administrators (Full Control) | ||
IIS_IUSR (Traverse, Read & Execute, Read Attribute, Read Extended Attribute) | ||
OWA | Basic Auth. | Authentication Users (read) |
System (Full Control) | ||
Administrators (Full Control) | ||
PowerShell | Anonymous | Authentication Users (read) |
System (Full Control) | ||
Administrators (Full Control) | ||
RPC | Basic Auth | |
Windows Auth. |
Hi, during my online activities I can see that Exchange 2007/2010 web services are causing a lot of issues to people, and lots are suffering from it.
I decided to put this ultimate guide to spare the hustle and allow smoother and nicer web services experience.
Well, let us first list the directories that are used in the Exchange web service:
- EWS is used for OOF, Scheduling assistance and free+busy Lookup.
- OAB provides offline address book download services for client.
- Autodiscover is used to provide users with autodiscover service.
- EAS provides ActiveSync services to Windows Mobile based devices.
- OWA provides outlook web access for users.
- ECP provides Exchange control panel feature for Exchange 2010 users only.
Issues that might be resolved using the troubleshooting steps here:
- You cannot set the OOF using outlook client, you receive the server not available error.
- You cannot view free/busy information for other users.
- You cannot use scheduling assistance, also you might receive not free/busy information data retrieved.
- You cannot download Offline Address book errors.
- You cannot use autodiscover externally.
- Certificate mismatch error in autodiscover, users prompted to trust certificate in outlook 2007/2010.
I will update this post to include all of the errors that I face and solve in my work or on EE to help experts all over EE to quickly solve their issues.
First let us start by the configuration required post Exchange 2007/2010 installation for the above to work correctly:
- Configure External and Internal URLs for OWS, ref: http://technet.microsoft.com/en-us/library/bb691323(EXCHG.80).aspx
o You have to configure the internal URL to be the server name in case you have multiple servers in NLB.
o External URL will be the URL used by users to access webmail e.g. https://mail.domain.com/owa
o Mail.domain.com in multiple CAS servers will be the NLB FQDN.
- Configure External and Internal URLs for OAB, ref: http://technet.microsoft.com/en-us/library/bb123710.aspx
o This will point if multiple CAS servers are used then this will point to NLB FQDN.
o If single server used this will point to the internal server FQDN in the internal URL, and the mail.domain.com which is used by webmail users.
- Configure the autodiscover internal URL:
o You will use the powershell cmdlet : Set-ClientAccessServer –Identity <CAS Server Name> -AutoDiscoverServiceInternalUri: <Internal URL>, this FQDN must match the URL included in the certificate.
o If you cannot use autodiscover.domain.com internally (you have a domain name of domain.local and you must use it), you will get a certificate miss match error, you will have to include the internal name in the certificate if you purchase an external certificate.
o If you have multiple CAS in NLB this will be the NLB FQDN.
o You cannot set autodiscover external URL since outlook will try to access https://autodiscover.domain.com/autodiscover/autodiscover.xml, this behavior is by design and cannot be changed.
o Autodiscover.domain.com must be included in the certificate that you assign to IIS if you purchasing a certificate externally from 3rd party provider.
- Configure EAS internal and External URLs, ref: http://technet.microsoft.com/en-us/library/bb629533(EXCHG.80).aspx
o This URL will point to the NLB FQDN internally
o This IRL will point to NLB FQDN Externally.
- Configure the EWS (which provides availability, OOF) internal and external URLs
o You can set the internal FQDN and External FQDN using: get-webservicesvirtualdirectory | Set-WebServicesVirtualDirectory –InternalUrl: https://url.domain.local/EWS/Exchange.asmx –ExternalURl: https://url.domain.com/EWS/Exchange.asmx
after all of the above settings you have to take into considerations the following note:
- All of the above uses https connection, so SSL certificate must be configured and assigned to IIS on the CAS servers.
- Since all of the above uses https, if you have a proxy traffic might be affected.
- Make sure that clients can access the URL internally and externally, you can do that by going to the above URL using IE or Firefox and validate that you can access them.
- For some people after doing the above configuration you still receive some errors so make sure of the following:
o IIS is started.
o OWA application pool, OAB application pool and EWS application pool are running and started with no errors
o If you receive authentication error, error 500 service not available, error 400 login time out, or unspecified error you will need to rebuild your virtual directories. You can do that as following:
§ For OWA:
· Get-owavirtualdirectory | remove-owavirtualdirectory
· New-owavirtualdirectory.
· You can repeat this step for EWS (webservicesdirectory), OAB (OABvirtualdirectory) and autodiscover(autodiscovervirtualdirectory)
· You will have to note that you will need to re-configure any customizations you made to OWA after removing and deleting it, also you will have to redo any internal and external URL configuration you have did in the past
Hope that I helped you in this post, the post will be updated to include all of the issues we solve to give you the smoothest Exchange experience.
Mahmoud
Long time I haven’t blogged, I was so busy in some new projects that burned my time.
I will blog about a topic I wanted to blog about it long time ago, applying the correct QoS for OCS 2007 traffic over the WAN, this has been a hot topic (at least for me) as I believe that all of voice traffic requires over WAN links.
I will introduce some QoS terminology in this post, and later will tell you how to apply QoS for OCS traffic.
Quality of Service Models
There are 3 service models:
· Best Effort · No QoS policies are implemented
· Integrated Services (IntServ) · Resource Reservation Protocol (RSVP) is used to reserve bandwidth per flow across all nodes in a path, uses the Resource Reservation Protocol (RSVP) to reserve network resources in advance of the data actually traveling across the network. Once the end-to-end bandwidth reservation is in place, the data is transmitted.
· Differentiated Services (DiffServ) · Packets are individually classified and marked; policy decisions are made independently at each node in a path, DiffServ doesn't use RSVP, but instead uses hop by hop Behavior or per hop behavior (PHB) to allow each router/hop across the network to examine the packet and decide what service level it should receive.
IP QoS Markings
We currently use 2 QoS marking methods:
· Precedence · The first three bits of the IP TOS field are evaluated; compatible with Ethernet CoS and MPLS EXP values
· DSCP · The first six bits of the IP TOS are evaluated to provide more granular classification; backward-compatible with IP Precedence
The following table contains the Precedence Values
| | Binary | Application |
| 7 | 111 | Reserved |
| 6 | 110 | Routing |
| 5 | 101 | Voice |
| 4 | 100 | Streaming Video |
| 3 | 11 | Call Signaling |
| 2 | 10 | Transactional |
| 1 | 1 | Bulk Data |
The following table lists the DSCP marking values:
| Likely to be dropped | AF Class | Drop Probability | DSCP Value |
| Low | AF Class 1 | AF11 (low) | 001 01 0 |
| AF12 (medium) | 001 10 0 | ||
| AF13 (high) | 001 11 0 | ||
| Medium | AF Class 2 | AF21 (low) | 010 01 0 |
| AF22 (medium) | 010 10 0 | ||
| AF23 (high) | 010 11 0 | ||
| High | AF Class 3 | AF31 (low) | 011 01 0 |
| AF32 (medium) | 011 10 0 | ||
| AF33 (high) | 011 11 0 | ||
| Very High | AF Class 4 | AF41 (low) | 100 01 0 |
| AF42 (medium) | 100 10 0 | ||
| AF43 (high) | 100 11 0 |
How to reserve the Bandwidth:
You can use any of the following methods:
· Policing · Creates an artificial ceiling on the amount of bandwidth that may be consumed; traffic exceeding the cap and be remarked or dropped
· Shaping · Similar to policing but buffers excess traffic for delayed transmission; makes more efficient use of bandwidth but introduces a delay
Mahmoud
| Communicator 2005 |
| 949280 Description of the Communicator 2005 hotfix rollup package: December 19, 2008 |
| 960244 After you install Live Meeting 2007 console or Live Meeting 2007 add-in, two new menu options that do not work are added to Office Communicator 2005 Action menu |
| 960255 After you upgrade Live Meeting Service Conference center to Live Meeting 2007, you can no longer use the Meet Now button in Office Communicator 2005 |
| 960252 Office Communicator 2005 crashes when you try to accept an inbound phone call |
| |
| Communicator 2007 |
| 957465 Description of the Communicator 2007 hotfix rollup package: December 19, 2008 |
| 960423 Office Communicator 2007 cannot display Chinese characters in URLs when the EnableURL registry value is enabled |
| 960424 You cannot prevent Office Communicator 2007 from controlling the call forwarding settings |
