1. Give yourself access to them all

Before you can do an inventory you have to get access to all folders. I suggest creating a domain group and add yourself to it and give that group access to all folders. In Exchange 2003, use System Manager -> Administrative Groups -> First Administrative Group -> Folders -> Public Folders. Right-click a folder and choose Manage Settings... Next -> Modify Client Permissions -> Add users. Add the group and choose Owner in the dropdown:

In Exchange 2010, it's not possible to use GUI to add permission to a folder and all subfolders on Public Folders (I told you Microsoft doesn't spend much time on Public Folders anymore). You have to user Powershell and the script AddUsersToPFRecursive.ps1. Example:AddUsersToPFRecursive.ps1 -TopPublicFolder "\Sales" -User "David" -Permission Reviewer

AddUsersToPFRecursive.ps1 -TopPublicFolder "\Sales" -User "David" -Permission Reviewer

2. Inventory

Use Outlook to read the content of the folders. I suspect you'll find plenty of empty and unused ones that you probably could archive (see later) and delete straight away. But there are different folder types, how do you know if it's in use or not?

• Mail and Post folder: By default, these folders are sorted by date
• Calendar folder: By default, you see the Calendar view but if you choose  View -> Change View -> List you will get a list view and can easily sort by date and see when the last object is from:
• Contacts folder: Again, switch to List view, right-click the header and choose Field Chooser and drag the Modified column to the view and sort by it. Maybe most contact hasn't been modified since some time? Then maybe it isn't used any more.
  

...just keep doing this until you're done.

3. Stop access to it

So hopefully you've gathered a bunch of Public Folders you think is not in use. Well, maybe you're unsure so before you go ahead and Archive and Delete them (see below), you might want to deny access and wait for some time to see if someone comes screaming. Just change the permissions on the folder and set Default to None and uncheck Folder Visible. But remember, there might be other users and/or groups in the list that allows them access so make sure to remove them too.

If you have found a tree of Public Folders with hundreds of subfolders, you can remove the permissions just on the top folder. This will make sure the whole tree is no longer visible and very easy to roll back. Just a word of warning using this method. A user can right-click any Public Folder in the tree and Add to Favorites... If you just remove the permissions on the "top folder" they will still see their folder in their Favorites tree. To stop this, you must remove the permissions on all subfolders. This will not remove the folder from their Outlook's Favorite view but it will be empty and that will probably cause the user to call the Servicedesk.

4. Archive and Delete

After some time waiting for someone to complain it's time to Delete them. Well, maybe first you should Archive them and the easiest way is to simply use Outlook to export to PST. Sure you could (also) use your normal backup routines but it will be a pain to get just some individual items so I would prefer PST since it's easier to just open it with Outlook if someone miss an item.

Good luck! I promise you that your life as an Exchange admin will be much easier without Public Folders. Especially at your next migration!

What are your experiences on Public Folder removal?

Download CompRename.txt and rename it to .vbs

First, connect to port 143:

telnet IMAPserver.domain.com 143

Then run the following to authenticate, list mails and quit. Just change whatever you need in red, domain is not always needed if you have one domain.

* OK The Microsoft Exchange IMAP4 service is ready.
. LOGIN DOMAIN\username password
. OK LOGIN completed.
. SELECT Inbox
* 2 EXISTS
* 2 RECENT
* FLAGS (\Seen \Answered \Flagged \Deleted \Draft $MDNSent)
* OK [PERMANENTFLAGS (\Seen \Answered \Flagged \Deleted \Draft $MDNSent)] Permanent flags
* OK [UNSEEN 2] Is the first unseen message
* OK [UIDVALIDITY 10638] UIDVALIDITY value
* OK [UIDNEXT 220] The next unique identifier value
. OK [READ-WRITE] SELECT completed.

.
. LOGOUT

More info.

Make sure you have the Active Directory module for Windows PowerShell installed and run it from  Start -> Administrative Tools -> Active Directory PowerShell.

$oucsv = 'c:\export\OUexport.csv'
Get-ADOrganizationalUnit -Filter * | export-csv $oucsv

You might want to get only from a certain base OU?

Get-ADOrganizationalUnit -Filter * -SearchBase 'OU=test-OU,DC=ad,DC=local' | export-csv $oucsv

Nice, so now you have a CSV-file with the structure. Here's how to re-create them in the other domain:

$OldDom = 'DC=ad,DC=local'
$NewDom = 'DC=newdomain,DC=local'
$oucsv = 'c:\export\OUexport.csv'

$success = 0
$failed = 0

$oulist = Import-Csv $oucsv
$oulist | foreach {
$outemp = $_.Distinguishedname -replace $OldDom,$NewDom
#need to split ouTemp and lose the first item
$ousplit = $outemp -split ',',2
$outemp
Try {
$newOU = New-ADOrganizationalUnit -name $_.Name -path $ousplit[1] -EA stop
Write-Host "Successfully created OU: $_.Name"
$success++
}
Catch {
Write-host "ERROR creating OU: $outemp" #$error[0].exception.message"
$failed++
}
Finally {
echo ""
}

}
Write-host "Created $success OUs with $failed errors"

Thanks to uSlackr for the details.

But here's a short recap how to do it if you have two separate domains which are not trusted using the Backup method.

Export:

1. In the source domain, right-click the GPO you want to migrate and choose Backup...
2. Backup to a directory of your choice and Comment.
3. You can continue backing up several GPOs to the same directory.

Import:

1. Copy the directory to the destination domain. Then you can either import the GPOs one-by-one or all of them with the same name as they had in the source:
2. Import one-by-one:
• Create a new GPO.
• Right-click the GPO and choose Import Settings...
• Choose the backup folder you copied.
• Choose which GPO you want to import.
• Done.
3. Import all GPOs:
• Download ImportAllGPOs.wsf script found in Group Policy Management Console Sample Scripts which you can download here.
• Open an elevated cmd.exe and cd to "C:\Program Files (x86)\Microsoft Group Policy\GPMC Sample Scripts" and run:
• cscript.exe ImportAllGPOs.wsf "<Location of extracted GPO Backup folder>"
• Done.

This is quite basic, but what if you have groups or UNC paths referenced in your GPOs which are different in source and target domain? Instead of editing them manually once they are imported you can use the Migration Table Editor to create a file that will change the values for you.

This is for another post, but in the meantime, read the Migrating GPOs Across Domains with GPMC document.

But what do you need to install on it? Here's what I usually install on a clean 2008 R2. Feel free to comment or add your favorite tools!

And to make it really user-friendly, you could consider publish the EMC as a RemoteApp - but that's another post.

1. Preparing the managementserver and the features

Enable RDP, create a group in AD, add the admins to this group and add this group to Remote Desktop Users. If the default 2 simultaneously users on RDP is not enough, you might need to enable it as a Remote Desktop Session Host server instead. Install Powershell and .NET Framework 3.5 SP1 (but if you have run Windows Update, you should be all good).

Using PowerShell, install features that I find useful:

Import-Module Servermanager
Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Lgcy-Mgmt-Console,RSAT-Web-Server,GPMC,Telnet-Client,PowerShell-ISE

BTW, check out my post on how to add the PSSnapin to Powershell ISE.

2. EMC and EMS

Install the Exchange 2010 Management Tools via commandline. Make sure you have the same Service Pack DVD and the same Rollup package in the Updates\ folder so you don't need to update it afterwards.

Setup.com /R:MT

3. Notepad++

For scripts/CSV editing, I often use Notepad++.

4. PowerGUI

Depending on taste and how much Powershell:ing you'll be doing, PowerGUI is a nice Powershell editor.

5. WFetch

I use WFetch sometimes to setup/troubleshoot loadbalancers and OWA.

6. Event Log Collector

If there isn't a centralized log solution, I tend to configure the management server as an event log collector so that it collect all (critical and warning at least) event logs from all Exchange servers. Here's how it's done. In that way I can check the event logs on all Exchangeservers from one centralized log.

...and of couse scripts, Scripts and more scripts!

The real power is in PowerShell and there are many finished scripts out there, many of them made by Microsoft guys themselves. Here are my favorites which I usually place in C:\Scripts directory:

• ActiveSyncReport.ps1 - Generate reports on ActiveSync devices hammering the environment. Anyone complaining about their mobile phone battery runs out much quicker than usual? This is the solution! Make sure to install LogParser 2.2 before.
• Fix-Alias.ps1 - During migration from 2003 you will probably need this to fix up your aliases which contain invalid characters.
• HighItemsFolders.ps1 - A script that can analyze folders and determine if they were over their limit which might cause problems for users.
• CheckDNSMXrecords.ps1  - Made by myself. Will automatically check if all Accepted Domains have the correct public MX records.
• Get-DatabaseStatistics - Nice function to get some stats on your databases.
• Get-ExchangeUpdateRollups.ps1 - To get all server's status, version and rollups
• Get-ADSchemaReport.ps1 - Get status and versions of the Schema. Much quicker than doing it manually and you also get info when they were performed.
• Group Policy Management Console Sample Scripts. Even though not really Exchange, I tend to use the same server for GPO editing.
• ADModify.NET - Bulk edit of AD objects. When I'm too lazy to Powershell :
• ExFolders - To manage those old Public Folders (this is the equivalent to Exchange 2003 PFDAVAdmin)
• Exmon (Microsoft Exchange Server User Monitor) - Are you wondering which Outlook client versions your users are using? This is how!

I call this... path from hell

Problem: Imagine you're browing to this file in Explorer: C:\Temp\Folder1\Testing\very\long\shortcut\hereismyfile.txt. You need to copy the full path to a script or documentation.

Solution: Just shift+right-click and choose Copy as path.

No more right-click, choose Create shortcut, Properties on that and copy'n'paste the Target path. And no more selecting the path in the top, copy'n'paste and then copy'n'paste just the filename.

I call this... cmd from here

Problem: Again, you're in that folder and there you have a .bat file or .exe you want to run from cmd from that folder. It takes a long time to open cmd.exe and manually cd to that path (even with Tab for auto-complete or copy'n'paste the path).

Solution: Just click the path bar, write "cmd" and return:

Done! It opens a cmd in that folder:

I call this... Multiple monitors annoyances

Problem: Many Sysadmins run multiple monitors and often need to change Window sizes and often put two windows side-by side (documentation to the right and the RDP windows to the left anyone?). Windows 7 introduced the possibility to drag a window to the left or right border and it would take up half the screen. Great! But what if you have multiple screens but DON'T want to drag the window to the next screen?

Solution: User Windows button and Left, Right, Up, Down to move it around. It will also move it to other screens if you'd like. No need to use your your mouse!

How it looks:

I call this... too many tabs

Problem: During research as a sysadmin I often end up with MANY tabs in Firefox/IE. When I'm finished it takes a long time just clicking the X to close them.

Solution: Ctrl+w will close tabs. You can close 20 tabs in seconds.

I call this... too much effort to mark in cmd

Problem: If you spend a lot of time in cmd you probably do a lot of right-click Mark, select the content and press Return to copy the content. Takes too much time? Yes.

 Solution: Go to Properties of the cmd window and select QuickEdit mode. Now you can select without right-clicking and choosing Mark.

With Exchange 2003, this was easy to fix by following KB250455 which in short meant using adsiedit.msc to change Configuration Container -> Configuration -> cn=DisplaySpecifiers -> CN=409 and opening properties for CN=user-Display, scrolling down to createDialog and setting the attribute to:
%<sn> %<givenName>

So when you created the users with ADUC you got the expected result.

But with Exchange 2007/2010 when creating the Active Directory user with EMC (Exchange Management Console) you don't get the expected result. Why?

Simply put - it doesn't work. Exchange 2007/2010 simply doesn't use the createDialog value and here's proof.

So what solutions do Microsoft offer? Well, there's three:

1. Use ADUC to create the user, and then create the mailbox separately from EMC.
2. Using EMC, make sure you manually put the Display Name correctly when creating the user:
   
3. Using Powershell, make sure you specify the parameters with New-Mailbox cmdlet:

-Name "Lastname Firstname"
-DisplayName "Lastname Firstname"

To be honest, none of these settings are ideal, especially if you have many admins creating mailboxes like I do in this 20.000+ mailbox Exchange environment.

So if you already created many mailboxes with incorrect display name, you can use Amit Tank's nice solution to do it once and he also posted a script that you can schedule every night which only edits the mailboxes created in the last 24 hours.

• Open EMC
• Go to Server Configuration, right-click each server and choose Properties and go to System Settings tab.
  

You can also look for Event ID Event ID 2080 in the Application logfile and KB316300 gives you an idea what this means.

To force it to use a specific GC:

• Open EMC
• Right-click Organization Configuration and choose Modify Configuration Domain Controller:
  
• Choose the default (Exchange will select for you) or select a domain and GC manually:
  

Now hoes does Exchange select which server to use? Quote from Microsoft Exchange 2010 Best Practices book:

All Exchange 2010 servers use DNS to locate a valid domain controller or global catalog. By default, each time a domain controller starts the Netlogon service, it updates DNS with service (SRV) records that describe it as a domain controller and global catalog server, if applicable.

SRV resource records are DNS records. These records identify servers that provide specific services on the network. For example, an SRV resource record can contain information to help clients locate a domain controller in a specific domain or site. For that reason, the SRV records for domain controllers and global catalog servers are registered with several different variations to allow Exchange servers locating a suitable domain controller or global catalog during the Active Directory discovery process.

One option is to register DNS records by site name, which enables computers running Exchange Server to find domain controllers and global catalog servers in the local Active Directory site. Exchange Server always favors the selection of a domain controller and/or global catalog from the same site that Exchange is installed into.

Here is an example of an SRV record:

_ldap._tcp.litware.com. IN SRV 0 100 389 berlin-DC01.litware.com.

There are plenty of user guides available, other reviews available and a YouTube demo where I book an instant meeting and end it:

Since this is a Sysadmin blog I will focus on the technical stuff and how to manage it rather then the nice design.

The good thing about this device is that it behaves as a client device, so you don't have to setup a server. The Evoko connects directly to your Exchange 2003, 2007 or 2010 server. It also supports Microsoft Online (Office 365) but not Google Apps nor Lotus Notes at the moment. It's connected to your network via wired Ethernet and for power you can either use PoE or the supplied power adapter.

On your computer, download the Evoko Configurator. In this example I will configure it to show a room that I have on my Microsoft Online account. First you select which Exchange version you're using:

Then you select the server and account and while you do that you can press "Test" to make sure it's correct.

You configure some details and PIN for admin menus:

Then you add all your rooms with username/password. There are some details in the admin guide how you should create and configure these users. You also configure details such as number of seats and what kind of equipment each room has, if it should show the subject of the meeting and who the organizer is. In Exchange 2010 there are ways to add room capacity but the Evoko can't read that.

Then you Finish and export this config to a USB stick:

Then you boot up the Evoko, insert the USB and press Upgrade:

And then choose the room you configured:

It should boot up and show if it's busy...

...or free:

And of course, this meeting is also added in the actual Calendar of the mailbox:

There's also a zip you can download and extract to a USB stick and reboot the device and you will be able to update OS, factory reset and collect logs. BTW, this little device actually seem to be running Windows CE: