Finally, I decided that I just needed to do the scans myself and give them a quick report of what was responding properly and what was not.

1. Download the portqry.exe and copy it to each server.
2. Put together a list of the Lync servers in a file named LyncServers.txt that contains the server names.
3. Put together a list of the ports and protocols for the ports in a file named LyncServerPortNumbers.txt.
4. Write a quick script to run on each server.

After that, it is just a matter of running the script on each server and collecting the data. Of course, the best feeling was sending the list of results with a From ServerX test for each server to the firewall team so they could see what they missed.

Here is a link to the files: Test-LyncPorts.zip.

1. Moved user from OCS 2007 R2 pool to a Lync 2010 pool. If they continued to use Communicator 2007 R2, their audio and video devices worked fine.

2. Upgraded user from Communicator 2007 R2 to Lync 2010 client.

After upgrading the client, users complained that they Video option was not available and they could not make video calls. When you go into the Lync Options, there is no choice for Video Device like their should be. The video device is still working in other applications, though.

The really odd thing about this was that if you opened up the Lync Options before the users signed in, you can easily see the Video Device option and set it. Once the user signed in, though, it would disappear.

I was confused as to why video worked when still using the Communicator client, but stopped when their client was upgraded. I took a wild guess and tried these two steps:

1. Set-ConferencingPolicy –AllowIPVideo $True –AllowIPVideo $True –EnableP2PVideo $True
2. Exited and restarted the Lync 2010 client

Ta Da! It works again.

As a side note, it may not require completely exiting the Lync 2010 client. Signing off and signing back in again may be enough.

Part 2 – We found some more unusual behavior in the build numbers.

• 4.0.75577.0 worked fine on most of the Windows 8 client computers
• 4.0.75577.0 did not work on most of the Windows 7 client computers
• Adding the April 2013 rollup seems to have fixed the issues we were seeing with the Windows 7 clients, though.

Now, I suppose you could just go and visit each room configurati0n, and see what security groups have been set up for the room permissions and then translate those security groups to individual accounts.

Or, you could just run a query against the Group Chat database:

SELECT *
  FROM [tblPrincipal]
  WHERE prinTypeID = 5 AND prinDisabled = 0

• Exchange User Monitor (ExMon) which will identify the mailbox that is causing the problem. You will see a single mailbox or just a couple that consumes a huge percentage of resources.
• Calendar Check (CalCheck) can then be used against the mailboxes to identify calendar items that have been modified way too many times and have become extremely large. It is usually one or more of these items that have become corrupted and are causing this issue.
• Scot O, one of my favorite bloggers, also has a great blog to help identify issues by viewing the transaction logs and using strings.exe to identify repeating patterns which usually indicate a problem. http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx

Recently, I have been trying to find a more proactive measure to identify these calendar items that tend to break when users just refuse to follow best practices.

I have combined PowerShell and CalCheck to look for bad items. Here is my latest version of the script. Please keep in mind that the formatting of this blog does not always work perfectly for scripts, and many of the lines that appear here are really a single line. You can download the latest version of this script here.

# This script is broken into three steps. In the first step, we identify users that have large calendar folders # In this step, we use get the databases first to try to minimize the memory requirements of processing all mailboxes # as PowerShell fails when you start getting into the tens of thousands of mailboxes.

$Date = Get-Date

Write-Host Start processing script at $Date # I always to keep track of how much time scripts take

$mbdb = Get-MailboxDatabase | Where {$_.name -ilike ‘*vpc*’} Write-Host $Null | Out-File List.txt foreach ($db in $mbdb){

Write-Host Processing $db

$Mailboxes = Get-Mailbox -database $db

foreach ($i in $Mailboxes){

$CalendarSize = (Get-Mailbox $i | Get-MailboxFolderStatistics -folderscope ‘calendar’).FolderandSubFolderSize

# Write-Host $i – Calendar size is $CalendarSize

$CalSplit = $CalendarSize -split ‘ ‘

$CalSize = $CalSplit[2]

$CalSize = $CalSize -replace “\(|\)|,| bytes”

$CalSize = [int]$CalSize

if ($CalSize -gt 100000000){

Get-Mailbox $i | Select Name,LegacyExchangeDN | FL | Out-File -append list.txt

}

}

}

$Date = Get-Date

Write-Host Completed identification of mailboxes that have large calendar folders at $Date

# In this step, we simply run CalCheck against all of the mailboxes that have calendar folders over 100MB as found in the first step. This requires version 2.0 or higher which supports the -l and –a arguments.

# It is vital that the account running this script have proper access to the individual mailboxes to scan them.

# The output will be a large number of log and csv files. I use the csv files for simpler processing.

# Note: Currently, CalCheck is not able to process more than around 100 mailboxes at a time. YMMV. You should also note that I pause the PowerShell script so that CalCheck can run.

Start-Process -FilePath c:\calcheck\calcheck.exe -ArgumentList “-a -l list.txt”

Write-Host “Once CalCheck has finished running, press any key to continue …”

$x = $host.UI.RawUI.ReadKey(“NoEcho,IncludeKeyDown”)

$Date = Get-Date

Write-Host Completed running CalCheck against mailboxes that have large calendar folders at $Date

# In this step, we create an output file for our results.

Write-Host $Null | Out-File Results.csv

$Header = “Subject,Organizer,Email,Modifications,Size”

$Header | Out-File Results.csv

$UserFiles = Dir C:\calcheck\calcheck_*.csv

foreach ($File in $UserFiles){

Write-Host ” “

Write-Host PROCESSING $file

Write-Host ” “

Copy $File CalItems.csv

(Get-Content calitems.csv) | where {$_ -notmatch ‘Processing*’} | Set-Content calitems.csv

$CalItems = Import-CSV calitems.csv

foreach ($item in $CalItems){

$Subject = $Item.Subject

$Size = $Item.Size

#This section is used to identify the organizer of the meeting and to put their info into first name, middle initial, last name format and also the same for their email address which I can use in other scripts to send automated email if I want. Your email address format may differ.

$Organizer = $Item.”Organizer Name”

$Organizer = $Organizer -split “_ “

$OrganizerFN = $Organizer[1]

$OrganizerLN = $Organizer[0]

$OrganizerFN1 = $OrganizerFN -split ” “

$OrganizerFN2 = $OrganizerFN1[0]

$OrganizerMI = $OrganizerFN1[1]

$Organizer = $OrganizerFN + ” ” + $OrganizerLN

if ($OrganizerMI){

$Email = $OrganizerFN2 + “.” + $OrganizerMI + “.” + $OrganizerLN + “@company.com”

}

if (!$OrganizerMI){

$Email = $OrganizerFN2 + “.” + $OrganizerLN + “@company.com”

}

if ($Modified = !$Null){

[int]$Modified = $Item.”Modified Instances”

if($Modified -ge “20″){

$Result = “$Subject,$Organizer,$Email,$Modified,$Size”

Write-Host $Result

$Result | Out-File -append Results.csv

}

}

}

Del CalItems.csv

}

$Date = Get-Date

Write-Host Completed script at $Date

What you will end up with is a csv file named results.csv that can then be loaded into Excel and sorted as needed to identify the items that may be causing the most pain.

It really is a simple fix:

1. Open up Active Directory Users and Computers and select the user account.
2. Select the Security tab
3. Click advanced
4. Select “Include inheritable permissions from this object’s parent”
5. Click Apply

It should work now.

Hmmm, who knew that ten phones was too many?

From: Microsoft Outlook
Sent: Thursday, August 16, 2012 4:28 PM
To: Kaufmann, Russ
Subject: Error with your new mobile phone partnership
Importance: High

You have 10 phone partnerships out of the maximum allowed 10 partnerships. After you reach the maximum, you can’t create additional partnerships until you delete existing ones from your account. To do so, sign in to Outlook Web App, click Options > Phone > Mobile Phones, and delete any unused partnerships.

Basically, when somebody tries to send a file, the file transfer will fail with a message that includes the following:

Could not establish trust relationship for the SSL/TLS secure channel.

There are two places where a certificate needs to be configured in Group Chat. First, the Group Chat Server Configuration tool, and second, the certificate needs to be updated in IIS. In this case, though, the cause of the issue is the certificate in IIS. If the certificate was expired in the Group Chat Server Configuration, then users would not be able to access Group Chat at all.

The easiest way to test if the certificate is misconfigured in IIS is to use the GCWebService.asmx page to test it. You can find the URL for this page pretty easily by using the Group Chat Server Configuration tool. Once in the tool, click on the System Wide icon on the left pane, and then click on the File Repository tab.

Here, you will see the URL. Copy it and past it into a Web browser and see if you get a certificate error or warning. The certificate warning is the behavior you can expect for a certificate misconfiguration in IIS. Thankfully, it is very easy to fix.

Setting the Certificate in IIS is not very difficult at all. All you need to do is follow the basic steps here:

1. Open Internet Information Services (IIS) Manager

2. Expand the server name node

3. Expand the Sites node

4. Click on the Default Web Site node

5. Click on the Bindings link in the Actions pane

6. Select https and click Edit

7. Use the SSL certificate drop down box and select the proper certificate, click OK and close any other open windows.

8. Restart the Default Web Site and it should be fine.

Try your Web browser again, and you should see results similar to this page (with more links in it).

At this point, file transfers will again work in Group Chat.

In my case, the new CA is locked down pretty tight with ACLs on the templates, and I am not able to easily request a new certificate.

Use the CA Web Site

What I ended up doing to get the certificates was to use the IIS site, https://NewCaName.CompanyName.com/certsrv.

Click on the Request a certificatelink.

On the next screen, you have a couple of options.

Normally, I would then use the Submit a certificate by using a base-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file. This method is used to submit the CSR that you previously generated. Well, I had issues making this work and the resulting certificate providing the private key when I would then import it back into OCS, so I went the other route. I still have no idea why it wouldn’t provide me the private key.

In this case, I used the Create and submit a request to this CA.

You may get a pop-up that is titled Web Access Confirmation and has the content This Web site is attempting to perform a digital certificate operation on your behalf: https://NewCaName.CompanyName.com/certsrv/certrqma.asp. Just click Yesif you get this message.

Select the Certificate Template. I used Web Server SSL 2 (Server and Client EKU) for my template. You don’t need this particular template, but I use it all the time because it works for pretty much any need. For the Name field, I use the actual SN for the certificate, and I also use the SN for the Friendly Name field. The key is the Attributes field which we use to add the SAN entries. The entry is all on one line and you just copy your information into the Attributes field.

SAN:dns=ocspool.companyname.com&dns=fe1.companyname.com

&dns=fe2.companyname.com&dns=fe3.companyname.com

Make sure the SAN line above is all on one line. I put in a line break for visibility. You should get something that looks like the image to the left, except with your information in it. You do not need the other fields.

This method is a little different than your typical method of generating a CSR and then submitting the CSR to get your certificate. Everything is done pretty much at once and you end up with a certificate that you can export and then import to your OCS servers.

When the CA responds with the certificate, you will get a link to Install this certificate.

When you install the certificate, it will install it on the computer where you ran the Web browser to connect to the CA. You will need to export the certificate. Make sure you select the Yes, export the private key radio button, and I recommend you also enable the Include all certificates in the certification path if possible option. to export the certificate to a pfx file. This pfx file can be imported on your OCS front end servers. You can use the same process for your other certificates for your Edge servers as well as other roles.

Applying the Cert

On the Front-End servers, open the Office Communications Server 2007 R2 console and expand the Forest, the Enterprise pools, the pool, and then select the Front-End server. Off to the far right, you should see a link for the Certificates wizard. You need to run the Office Communications Server 2007 R2 console on each server and select the server you are on at the time in order to access the Certificateswizard.

From here, it is a simple matter of using the wizard to Import a certificate from a .pfx file.

Of course, you can also use the Certificates MMC to import the certificate instead of using the wizard. Once you have imported the certificate and verified the chain, you are ready to assign the certificate.

Once the certificate is imported, you can then use the Certificates wizard and select the Assign an existing certificateoption.

I strongly suggest restarting the server, but the restart of the services is usually sufficient.

Don’t Forget the Web Services!

I forget the Web Services every now and then, and most of the Web sites that talk about renewing or replacing the certificates on an OCS server tend to forget this step, too. If you forget this step, you can expect to have issues with your Address Book service as well as some other odd issues.

Use the dropdown box and select the same certificate that you used for the OCS pool. It has to use the same certificate that your front-end services use or you will have issues.

Once you have updated the certificate, make sure you restart the Default Web Site in the IIS Manager.

I was trying to identify the largest calendar item for users. The idea was to find these large calendar items so that junior admins can work with the users to see if the calendar items are large because they have been updated too often. Originally, I was trying to identify all users that have items over 50MB in size. Well, after seeing the output, I couldn’t understand why it wasn’t working as expected. Here is what I ran:

Get-Mailbox –ResultSize Unlimited | Get-MailboxFolderStatistics -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 50000000} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

Well, let’s just say that I got all sorts of odd results. What I wanted was the largest Calendar item from each mailbox if it was 50 MB or larger.

To set the scene. I will used two mailboxes, mine and Jack B. Nimble’s (his name has been changed to protect his innocence). My TopSubjectSize for a calendar object is approx 2.7 MB. Jack’s is approx 880KB. So I start off just to show what the largest item is for each of us with these two commands and the results of the command:

Get-MailboxFolderStatistics russell.kaufmann -FolderScope Calendar -IncludeAnalysis | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

TopSubjectFrom      Identity            TopSubject          TopSubjectSize

Poppins, Mary       russell.kaufmann    Dancing in the S… 2.707 MB (2,838,…

Get-MailboxFolderStatistics jack.b.nimble -FolderScope Calendar -IncludeAnalysis | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

TopSubjectFrom      Identity            TopSubject          TopSubjectSize

Goose, Mother       Jack.B.Nimble       Partying All Nig… 884.5 KB (905,68…

So, if I use the Where filter and try to filter out for anything over 800KB,  I get the following:

Get-MailboxFolderStatistics russell.kaufmann -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 800000} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

Get-MailboxFolderStatistics jack.b.nimble -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 800000} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

TopSubjectFrom      Identity            TopSubject          TopSubjectSize

Goose, Mother       Jack.B.Nimble       Partying All Nig… 884.5 KB (905,68…

Notice, for mine, it didn’t properly identify the item, but it did for Jack’s. Isn’t 2.707 MB greater than 800KB? Shouldn’t I have seen my top subject size?

Now for some fun. If I filter based on –gt 2, here is what I get:

Get-MailboxFolderStatistics russell.kaufmann -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 2} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

TopSubjectFrom      Identity            TopSubject          TopSubjectSize

Poppins, Mary       russell.kaufmann    Dancing in the S… 2.707 MB (2,838,…

Get-MailboxFolderStatistics jack.b.nimble -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 2} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

TopSubjectFrom      Identity            TopSubject          TopSubjectSize

Goose, Mother       Jack.B.Nimble       Partying All Nig… 884.5 KB (905,68…

So, 2.707MB is greater than 2, and 884.5KB is greater than 2. They both worked.

What about if I use 3 instead? Great question, so here is what I get:

Get-MailboxFolderStatistics russell.kaufmann -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 3} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

Get-MailboxFolderStatistics jack.b.nimble -FolderScope Calendar -IncludeAnalysis | where {$_.TopSubjectSize -gt 3} | Select TopSubjectFrom,Identity,TopSubject,TopSubjectSize

TopSubjectFrom      Identity            TopSubject          TopSubjectSize

Goose, Mother       Jack.B.Nimble       Partying All Nig… 884.5 KB (905,68…

2.707MB is not greater than 3, so I don’t get a result for mine, but Jack’s 884.5 KB is greater than 3.

Come on, you have to admit that this is funny stuff.

Actually, finding the offending user isn’t too difficult since you can use ExMon to see that a user is consuming the majority of the resources. Finding the actual item is a bit more difficult.

Anyway, I have requested that Microsoft provide us with a PowerShell script that can be run on a regular basis to help identify Calendar items that have been updated excessively so we can go to the user and help them delete the item and to create a new one to replace it and also take the time to discuss Best Practices. It appears that to get what I want will require some leveraging of the EWS API which is not something that I can do.

James Milford did provide a nice solution that kind of meets my needs. I was not aware of the –IncludeAnalysis option for the Get-MailboxFolderStatistics. The resulting one-liner will identify the largest Calendar item in each person’s mailbox assuming that the item is over 5 mb. While a particular user may have many large items, at least this script will find their largest item.

Get-Mailbox | Get-MailboxFolderStatistics –FolderScope Calendar –IncludeAnalysis | Where {$_.TopSubjectSize –gt 5000000}| Select Identity,ItemsInFolder,TopSubject,TopSubjectSize | Export-Csv LargeCalendarItems.csv –notype

Your mileage may vary when it comes to how long this takes to run as the more mailboxes that you have in your Exchange organization, the longer it will take.