• Open EMC
• Go to Server Configuration, right-click each server and choose Properties and go to System Settings tab.
  

You can also look for Event ID Event ID 2080 in the Application logfile and KB316300 gives you an idea what this means.

To force it to use a specific GC:

• Open EMC
• Right-click Organization Configuration and choose Modify Configuration Domain Controller:
  
• Choose the default (Exchange will select for you) or select a domain and GC manually:
  

Now hoes does Exchange select which server to use? Quote from Microsoft Exchange 2010 Best Practices book:

All Exchange 2010 servers use DNS to locate a valid domain controller or global catalog. By default, each time a domain controller starts the Netlogon service, it updates DNS with service (SRV) records that describe it as a domain controller and global catalog server, if applicable.

SRV resource records are DNS records. These records identify servers that provide specific services on the network. For example, an SRV resource record can contain information to help clients locate a domain controller in a specific domain or site. For that reason, the SRV records for domain controllers and global catalog servers are registered with several different variations to allow Exchange servers locating a suitable domain controller or global catalog during the Active Directory discovery process.

One option is to register DNS records by site name, which enables computers running Exchange Server to find domain controllers and global catalog servers in the local Active Directory site. Exchange Server always favors the selection of a domain controller and/or global catalog from the same site that Exchange is installed into.

Here is an example of an SRV record:

_ldap._tcp.litware.com. IN SRV 0 100 389 berlin-DC01.litware.com.

There are plenty of user guides available, other reviews available and a YouTube demo where I book an instant meeting and end it:

Since this is a Sysadmin blog I will focus on the technical stuff and how to manage it rather then the nice design.

The good thing about this device is that it behaves as a client device, so you don’t have to setup a server. The Evoko connects directly to your Exchange 2003, 2007 or 2010 server. It also supports Microsoft Online (Office 365) but not Google Apps nor Lotus Notes at the moment. It’s connected to your network via wired Ethernet and for power you can either use PoE or the supplied power adapter.

On your computer, download the Evoko Configurator. In this example I will configure it to show a room that I have on my Microsoft Online account. First you select which Exchange version you’re using:

Then you select the server and account and while you do that you can press “Test” to make sure it’s correct.

You configure some details and PIN for admin menus:

Then you add all your rooms with username/password. There are some details in the admin guide how you should create and configure these users. You also configure details such as number of seats and what kind of equipment each room has, if it should show the subject of the meeting and who the organizer is. In Exchange 2010 there are ways to add room capacity but the Evoko can’t read that.

Then you Finish and export this config to a USB stick:

Then you boot up the Evoko, insert the USB and press Upgrade:

And then choose the room you configured:

It should boot up and show if it’s busy…

…or free:

And of course, this meeting is also added in the actual Calendar of the mailbox:

There’s also a zip you can download and extract to a USB stick and reboot the device and you will be able to update OS, factory reset and collect logs. BTW, this little device actually seem to be running Windows CE:

Luckily – no.

There are more attributes it will match on and that is:

1. source legacyExchangeDN will match an destination x500: value in proxyAddresses
2. source SMTP: or smtp: in proxyAddresses will match destination smtp: or SMTP: in proxyAddresses
3. …and of course source objectSID will match destination SIDHistory.

To make it more clear, check out this example. In the source (this case Windows 2003 AD/Exchange 2003), the account looked like this when using adsiedit.msc:

For example 1 above, you simply take the legacyExchangeDN from the user in the source domain:

/o=Org/ou=First Administrative Group/cn=Recipients/cn=miguser6

Go to the user in the destination domain and use for example ADUC (with View -> Advanced Features) and Attribute Editor tab. Go to proxyAddresses and add a value starting with x500:<legacyExchangeDN>:

For example 2, just add the smtp: or SMTP: to the proxyAddress.

For E2007, this cross org mailbox migration article gave me some hints and if you’re doing E2010 cross forest mailbox moves, check this article out.

Tip: If you’re just testing away, add the -ValidateOnly (-WhatIf for E2010) parameter to check if it can match. Example results when running E2007:

StatusMessage: This mailbox can be moved to the target database.

If it can’t find a match:

Error occurred in the step: Approving object. No matched target NT account is found. To create an NT account in target forest, parameter NTAccountOU is required.

So instead of manually running nslookup.exe for each domain, I created this script to automate it for me. The plan is to automate it even further so it runs once a day and e-mails me any misconfigured domain. In that way, I’m sure that all domains in Accepted Domains always are correctly configured.

In the following script I simply check that all domains in “Accepted Domains” are configured on the Internet (I use Google DNS 8.8.8.8 for the query) with the following MX-records:

MX preference = 10, mail exchanger = mailgw01.domain.com
MX preference = 20, mail exchanger = mailgw02.domain.com

If they’re not, you will get an INCORRECT and the current setting output to the screen.

Any suggested changes are welcome so please comment.

The whole script:

if ( (Get-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction SilentlyContinue) -eq $null )
{
   Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
}

$MATCH1=”MX preference = 10, mail exchanger = mailgw01.domain.com”
$MATCH2=”MX preference = 20, mail exchanger = mailgw02.domain.com”

$DNS = “8.8.8.8″
$domains = Get-AcceptedDomain
foreach ($mxdomain in $domains) {
   $NSLOOKUP = C:\Windows\system32\nslookup.exe -q=mx $mxdomain.DomainName $DNS 2>$NULL
   if ($NSLOOKUP -match $MATCH1 -and $NSLOOKUP -match $MATCH2)
   {
   Write-Host Correct: $mxdomain.DomainName
   }
   else {
      Write-Host =========================================
      Write-Host INCORRECT: $mxdomain.DomainName -foregroundcolor “yellow”
      Write-Host Output from nslookup:
      Write-Host $NSLOOKUP
      Write-Host =========================================
   }
}

Hope you find this script useful.

+ Get-Mailbox <<<<
    + CategoryInfo          : ObjectNotFound: (Get-Mailbox:String) [], Command
   NotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Simple solution:

For Exchange 2010, run:

Add-PSSnapIn Microsoft.Exchange.Management.PowerShell.E2010

For Exchange 2007, run:

Add-PSSnapIn Microsoft.Exchange.Management.PowerShell.Admin

More info:

You could also enter the following to get a list of Powershell Snap-Ins that are registered on the system and that you could use:

Get-PSSnapIn -Registered

Also, when the Exchange Management Shell is started from the startmenu, it actually runs a PowerShell script which does a lot more than the above:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command “. ‘C:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1′; Connect-ExchangeServer -auto”

So if you’re missing something when running the simple solution above, try running this ps1 script.

Oh and maybe you’re doing a PowerShell script and need to add the PSSnapIn? Well, if you try to add it several times, you get an annoying errormessage. You could then check if it already has been added or not:

if ( (Get-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction SilentlyContinue) -eq $null )
{
Add-PsSnapin Microsoft.Exchange.Management.PowerShell.E2010
}

If you get tired of adding this SnapIn every time you start Powershell, I suggest you read about_Profiles.

For this to work, I bought myself the Nexa PB-3 package (~$30)which enables you to switch on/off using the remote control they supply in the package:

Nexa uses RF signals rather than IR so it works through walls. Global Cache iTach WF2IR has 3 output ports to where you connect IR-blasters to send IR-signal, but they don’t have any device that can send RF signals but Sydia has the TX-433 which can. So you basically connect the TX-433 to one of the output ports on the WF2IR and supply the TX-433 with power. You can still connect another IR-blaster to the TX-433 so you will have both an IR and RF sender on this port.

In part 1 I showed you have to create a button which sends a “command” to the iTach. But that article showed you have to use iLearn.exe to learn an signal but with the above remote since it’s RF and the iTach only has an IR-learner, there is no way you can send an IR-signal so how do you know which command to send?

The Nexa Self Learning / Learning Code PB-3 works in that way that it select random codes each time they are configured so it automatically select one of of those some 16 million different codes. So it’s not like any other IR-device where the same button sends same command every time.

Luckily, the good guys over at Sydia has solved that for you. You just e-mail their support and they will send you as many RF codes you need. More info here.

So, when I received the codes I created one ON and one OFF button in Building Modeler for each configured the following way:

Then in UI Designer, I created buttons for each and assigned the command to the ON/OFF buttons:

Then I just saved, made sure the OpenRemote Controller on the server was synchronized with the updated version and then downloaded to the iPhone. Excellent – it works:

Let me know if you have any questions in the comments below.

RBAC, Role-based access control simply allows you to delegate object creation and modification. Important to understand is that you no longer need the ACL permissions in AD and it doesn’t matter what AD permissions you need. Everything is authorized through the RBAC and they apply to all Exchange management tools (EMC, EMS, ECP).

There are 11 built-in management role groups available in your root domain’s OU Microsoft Exchange Security Groups. If they are good enough – use them. Otherwise, you will need to create a custom role group. There are many different ways you might want to delegate and I suggest you don’t over-complicate things. I tend to stay with KISS – “Keep it simple stupid”…

Nothing gives you a better understanding than an example… This example shows how to delegate so that an admin has full rights to the objects in the OU they manage, a quite common example.

First, if you start EMC/EMS without any roles assigned you will get an error: Processing data from remote server failed with the following error message: The user isn’t assigned to any management roles. Then we’re all good to start.

Step 1. Decide what roles are required by the admin.

You can either use one or more of the default built-in management roles, there are 70 of them and you list them with:

Get-ManagementRole

You might want to know which entries a specific role contains? Example

Get-ManagementRole “User Options” | fl RoleEntries

Hey, not very pretty. Another, maybe better way, would be to get the entries this way instead:

Get-ManagementRoleEntry “User Options\*” | ft –AutoSize -Wrap

Still, a lot of information. Maybe you want to know what the admin can do when it comes to ActiveSync and just filter that out?

Get-ManagementRoleEntry “User Options\*ActiveSync*” | ft –AutoSize -Wrap

By now you probably have identified a built-in role that you can use. In my case, I decided to use roles “Mail Recipients”, “Mail Recipient Creation” and “Distribution Groups” instead of creating custom ones.

Step 2. Decide the management scope

You can define a scope based on a serverlist, by domain, by database. What you decide is up to your environment. I decided to base it on OU.

New-ManagementScope -Name “CUST-Scope” -RecipientRestrictionFilter { RecipientType -like “*” } -RecipientRoot “domain.local/Infrastructure/Users”

You could change the following parameter if you only want them to be able to manage mailboxes:

-RecipientRestrictionFilter { RecipientType -eq “UserMailbox” }

Examples and documentation.

Step 3. Create the new management role group

This will actually create a Universal Group in the root domain’s OU Microsoft Exchange Security Groups. Sure, you could specify -SecurityGroup parameter to create it somewhere else.:

New-RoleGroup -Name “CUST-ROLE-Admins” -Roles “Mail Recipients”,”Mail Recipient Creation”,“Distribution Groups” -CustomRecipientWriteScope “CUST-Scope”

Examples and documentation.

Step 4. Add members to the group

Do it manually via ADUC or use PowerShell:

Add-RoleGroupMember “CUST-ROLE-Admins” -Member <user>

Examples and documentation.

Done! Now the user should be able to start EMC/EMS without errormessage and perform the tasks you assigned to the user.

Tip: I tend to name all custom settings with a prefix, such as CUST-. In this way, I know what I’ve created and what is default and also makes it easier when listing since I can choose to show only the items starting with CUST-*. Examples:

Get-ManagementScope | Where {$_.Name -like “CUST-*”}

Troubleshooting

Error when creating a new user with a mailbox: The term ‘New-Mailbox’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

Solution: The role(s) you have assigned to the admin doesn’t have the permission to run New-Mailbox. Maybe you have just assigned role “Mail Recipients” and not “Mail Recipient Creation”?

Error when enabling a mailbox for an existing user: <user> isn’t within you current write scope. Can’t perform save operation.

Solution: Changed { RecipientType -eq “UserMailbox” } to { RecipientType -like “*” }

Well, I got my hands on a Sony VAIO VGN-Z51WG/B or VGN-Z51WG_B if you used the command wmic csproduct get name.

You might remember my post on the older VGN-Z21WN/B which was awful. The VGN-Z51WG/B model is a little bit better with a description on most downloads and everything is available for x64, but still, Sony hasn’t learned that they need to describe what they ask us to install. They will never reach the corporate market if they keep doing like this. They more or less tell you that you have to use their DVD to install Windows (which has everything Preinstalled) and then you need to install the Updates afterwards. In other words, impossible to create a deployment solution for it. But I don’t care, I will install it and figure out what is actually needed rather than just install everything.

Oh and have you wondered how to get into BIOS on a Sony VAIO? On this model it was F2. But some other states F1 or DEL which might apply to other VAIO models.

So what I did was to install from DVD (Windows 7 x64 with SP1) and took it from there to get everything working… From there I had the following in Device Manager not working:

• Standard VGA Graphics Adapter
• Base System Device
• Fingerprint Sensor
• Unknown device
• SDA Standard Compliant SD Host Controller

Then I ran Windows Update (on 2nd Jan 2012, made it reboot 4-5 times) and from there only the following had warning signs:

Windows Update had some Optional Updates:

I installed the Intel one but it didn’t make much difference in Device Manager nor Windows Experience Index which was at 3,4:

Then, I downloaded the following from their website.

• Graphics Driver (Nvidia) 8.16.11.8735. This removed the Warning on “Standard VGA Graphics Adapter” and replaced it with a “NVIDIA GeForce 9300M GS” and Windows Experience Index went up to 4,3. But beware, when I installed it the screen went black so I had to force it off by holding the power button. Sony – Fail! But after reboot it seemed to work.
• Memory Card Reader Writer Driver SD. You have to manually in the Device Manager update the drive. This changed the name in the Device Manager to “Ricoh SD Host Controller” and it worked. What the driver with the same name but CPRM suffix does? No idea and Sony fail to let us know.
• WWAN Driver. Doesn’t seem to solve anything but I suspect the 3G driver is needed
• WWAN Connection Manager. Sure it installed the OneClick Internet application but when started it said “No device found”. When started I ran Update which announced “Update Sony CM 3.0 to 3.2″ which I installed but no difference.
  It’s quite common that the 3G modem is off by default and you need to install some application to enable it… so I tried:
• VAIO Smart Network. For some reason, it doesn’t autostart at reboot so you have to add a shortcut in the Startup folder. However, when it starts it seems to have the same problem as the VGN-Z21WN/B model and that is that is misses the icons:
  
• Sony Shared Library was installed to get some more sense into the above application. After reboot, give it some time after login to stabilize and and you should see a lot of Qualcomm HS USB getting installed:
  
  And then a new device in Device Manager:
  
  And OneClick Internet can find the device. You should be able to connect but you might need to edit APN Settings before it works:
  
  But still, only a grey screen on above but after another reboot it worked (notice it will minimize to the taskbar after starting by default):
  
  You might not recognize this design of the VAIO Smart Network (this is 3.0.0.09080), but this is because it’s a newer version than the old:
  
• VAIO Event Service enables the Fn + Function keys for shortcuts. By default, the volume and mute works out-of-the-box on Windows 7 but not the others. It will also show you the volume/brightness etc which is not default in Windows:
  
  Notice that you first need to install the Preinstalled version and then the Updates version (5.0.3.05060).
• Memory Card Reader Writer Driver MS is the update to get rid of the last Warning on “Base System Device” and update it to a “Ricoh Memory Stick Host controller”.
  
• VAIO Peripherals Metadata apparently makes sure that the Devices and Printers folder gives a quick and correct view of devices connected to your computer so installed that also.
• When VAIO Update was installed, it recommended to update the following updates so I suggest to install them aswell:
• Bluetooth Enumeration patch – 2009101501.
• Wireless LAN Driver (Intel) – 13.0.0.107.

Then, not yet confirmed (the user is still testing), it seems like the following is needed:

• Pointing Device Touchpad. Driver for the mousepad is said to be needed because it tends to, after a while of usage, completely error out so you better install that driver to.
• Local Administrative Rights might be needed for the 3G card to work.
• The “SDA Standard Compliant SD Host Controller” not longer showed a yellow warning sign but it still didn’t work. I’ve seen Sony VAIO laptops when this problem comes and go so make sure to install the driver.

Some other random notes:

• Setting Utility Series is needed for the S1, S2 buttons to work but since I don’t use them, I didn’t install them.
  
• SPIC Driver (Sony Programmable I/O Controller device driver) but have not yet investigated what it’s for.
• SFEP Driver (Sony Firmware Extension Parser driver) but have not yet investigated what it’s for.
• VAIO Control Center seems to make it possible to configure many different settings, but do far I don’t miss anything out-of-the-box on Windows 7.
• VAIO Gate is the “MAC-lookalike” launcher bar at the top of the screen:
  

Well, I got my hands on a Sony VAIO VGN-Z21WN/B or VGN-Z21WN_B if you used the command wmic csproduct get name.

This Sony VAIO model has to be the worst when it comes to supporting us techies when it comes to drivers. Just look at their download page and they have some 30+ stuff to install but many of them are not explained at all. Once downloaded you might have a Version.txt in the archive but all it says is the version, not explanation at all. One reason why it was hard to get everything to work is because many drivers are for x86 only and I wanted to install x64. I didn’t get everything to work but the most essential worked perfectly. I hope this will be valuable for some…

Oh and have you wondered how to get into BIOS on a Sony Vaio? On this model it was F2. But some other states F1 or DEL which might apply to other Vaio models.

So what I did was to install Windows 7 x64 with SP1 and ran Windows Update and took it from there … From start I had three things in the Device Manager not working:

• Standard VGA Graphics Adapter
• Base System Device
• SDA Standard Compliant SD Host Controller

Then I downloaded some drivers from their website.

• VAIO Update. According to the startup it says “VAIO Update helps to keep your VAIO tuned fro optimum performance. It allows you to check for important notices about your VAIO and run the latest updates for your computer.” Sounds good, so I started with this and hoping it would install everything I needed but nope… But I still kept it. When you continue the initial setup wizard it will ask you to enable:
  - Communicate with the update server at regular intervals and notify of updates
  - Enable VAIO Auto Update (VAIO Auto Update is a function to automatically install important VAIO updates)
  - Enable VAIO Software Self Update (VAIO Software Self Update is a function to check for update information and perform updates when running Sony Software)
  At the time of this article VAIO Update was at version 5.1.1.04090 for this model.
• Shared Library seems to be [link]: Video codec Library in order to help the media applications like “VAIO Media”,”VAIO ZONE”,”VAIO Video & Photo Suite”,”SonicStage” and “SonicStage Mastering Studio” to decode special media files from sony itself, like OMA music format, the newest version which added support of AVCHD format.
• Smart Network is the little grey bar where you can enable and disable the different network modules (WWAN, WLAN, Bluetooth etc). WWAN is off by default so this thing is mandatory if you ever want to run the WWAN (3g) module which seems to be a GlobeTrotter model BTW. But when I installed it (you have to reboot to get it automatically to start) I got the buttons “grey” and non-functional like this:
  
  But once I installed either (sorry, can’t remember which one) VAIO Update or Shared Library I got it working:
  
• When I switched on the WWAN (3G, the one to the left) I saw GlobeTrodder HDSPA Modem gettings added to Device Manager (as an Unknown Device). But on Sony’s website, there’s only a 32-bit version available.
• Wireless Connection Manager (at this time, 2.3.0.797) but when starting it, it said Device not found:
  Then I tried to install the WWAN Driver even though it was 32 bit – no luck.
• … so I gave up and went to the Option website, entering my IMEI and got a downloaded the files. There it told me it was model GTM378 E. After installing (only the GlobeTrotter Connect) and a reboot – it worked, but the “Smart Card” still was left uninstalled.
  

I got OpenRemote, the open source remote control software, running on my iPhone (also works on iPad, Android) with my Global Cache WF2IR iTach and wanted to program it to remote control my Mac Mini (this scenario will create a button pressing DOWN on my Apple Remote to control Plex). One, maybe easier, alternative is to use iRule At Home which is a commercial product but since I like Open Source and like playing around myself, I decided to give it a try.

I started out checking the Navigation Tutorial video to figure out the basics to create some buttons. Then I went into Online Designer and Building Modeler and choose New -> New Device and name it whatever you like. Then select it and choose New -> New Command. Choose TCP/IP protocol and set the name to the command, I called it “MAC Mini Down”. IP-address is the IP of your WF2IR and the Port is 4998.

Then the complicated part, Command, which is not very obvious. For some more technical details, check this thread. But for me it turned out to be:

sendir,1:1,1,37425,1,1,342,171,22,22,22,64,22,64,22,64,22,22,22,64,22,64,22,
64,22,64,22,64,22,64,22,22,22,22,22,22,22,22,22,64,22,22,22,22,22,64,22,64,
22,22,22,22,22,22,22,22,22,64,22,22,22,64,22,22,22,64,22,22,22,22,22,22,22,
1498,342,85,22,3742

Red: Is <mod-addr>, and for me that’s always 1.
Green: Is <conn-addr>, the port on the WF2IR which is 1, 2 or 3 (counting from left). I have the IR-blaster for the Receiver connected to 1, the TV to 2 (and this is a combined RF sender aswell which allow me to switch the lights on/off with Nexa – more on that in another post) and MAC to 3.
Yellow: Is <repeatcount>, the number of repeats it should perform.

Now how did I figure out the rest? Well, I used ILearn.exe, choosed iTach Learner in the dropbox, put the IP of the iTach and choosed Connect. Then I pointed my Apple Remote towards the iTach and pressed DOWN. I put “DOWN” in the Button Name and pressed Save Data. Keep on doing that for all your commands. The iTach is pretty picky so make sure to place the remote on a flat surface and keep it still while pressing the button.

Don’t forget to save in Designer, Sync with modeler from your controller and kill the OpenRemote on your iPhone and restart it and it will reload the config.

Then you have to setup OpenRemote in your server and on your iPhone but their website has pretty good documentation for that. Also, check out the OpenRemote Tutorial for iTach.

Also see, Part 2: How to turn lights on/off using an iPhone/Android, OpenRemote, iTach WF2IR and Nexa.

Part 2: How to turn lights on/off using an iPhone/Android, OpenRemote, iTach WF2IR and Nexa