Grant Exchange Calendar Rights

To view Calendar access rights:
Get-MailboxFolderPermission -identity "ManagingUser:\Calendar"

You must remove any user listed as Reviewer before you can add Editor rights.

Remove-MailboxFolderPermission -identity “ManagingUser:\Calendar” -user “PersonalAssitant”

Once Removed Add Editor Access rights:

Add-MailboxFolderPermission -identity “ManagingUser:\Calendar” -user “PersonalAssitant” -AccessRights Editor

Grant Mailbox Permission to single user

 There are many situations in which permissions to another user’s mailbox should be granted on Exchange Server. Sometimes it is for monitoring purposes, sometimes in order to send emails on behalf of someone else. Full access permissions give the highest level of access to a mailbox, and are necessary, for example, during a migration process. If you want to learn how to set full access permissions on Exchange 2007, Exchange 2010, Exchange 2013, Exchange 2016 or Exchange 2019



Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq 'UserMailbox') -and (Alias -ne 'User')} | Add-MailboxPermission -User User@Example.com -AccessRights FullAccess -InheritanceType all -AutoMapping:$false

Full Credit to:

https://www.codetwo.com/admins-blog/how-to-grant-full-access-permissions-to-all-users-mailboxes-exchange/

PowerShell-Bulk Export & Import of X500

One of the most important thing to take care is the X.500 Address when you are doing Direct Cut Over migration from Microsoft Exchange Server to a new Exchange Server in different AD Domain or Office 365

The X.500 Address is used by Microsoft Outlook to identify users (NOT SMTP Address) within Exchange Organization (Refer to the http://www.askme4tech.com/exchange-server-x500-address-amazing-thing-know for more detail information.

Please refer to the steps below on how to export & import X.500 using PowerShell Script
To export the ExchangeLegaceyDN from Source Domain. 

 Get-ADUser -SearchBase “DC=YOUR-DOMAIN,DC=COM” -Filter * -Properties SamAccountName,legacyExchangeDN | Select-Object SamAccountName,legacyExchangeDN | Export-CSV C:\Temp\Exported-LegacyDN.csv -NoTypeInformation

To Import to new Domain Controller. 

Import-Module ActiveDirectory
$Input = Import-CSV C:\Temp\Exported-LegacyDN.csv
ForEach ($ADUser in $Input){
if ($ADUser.legacyExchangeDN){
Set-ADUser -Identity $ADUser.SamAccountName -add @{proxyAddresses=”X500:$($ADUser.legacyExchangeDN)”}
}
}

All credits:

https://aventistech.com/2018/07/powershell-bulk-export-import-of-x500/

Source for the Script.

https://www.petenetlive.com/KB/Article/0001468

This describes my exact issue:
https://www.tipsdotcom.com/recipient-not-found-by-exchange-legacy-encapsulated-email-address-lookup.html

Find MAC Addresses of member NICs in a Native Windows Team

This article describes how to get the MAC addresses of all member Network Interface Cards (NICs ) in Native Windows Network Teams  present in a Windows Server 2012/2012 R2 using PowerShell.

There are lot of instances where the network communications fail when we are teaming up the incorrect network interfaces. Especially when the team members are the partitions of a virtual partition capable Converged Network Adapter (CNA), we need to make sure that we are teaming up correct partitions from different physical ports for redundancy and proper VLAN traffic. In such situations, the primary troubleshooting step related to network team’s connectivity issue  is to validate the network team members.

The easiest way to ensure this is to compare the unique attributes of the partitioned interfaces with the data in the network card BIOS or out-of-band management tools (like iDRAC, ILO etc) or other baseboard management controllers.  Media Access Control (MAC) addresses of the partitioned interfaces seen by the Operating System are the easiest and reliable unique identifiers in this scenario as the names for the interfaces will be different for different network cards.

The default available option to get the member NIC’s MAC address is to use the PowerShell command Get-NetAdapter <member NIC name>. For that we have to manually find the native teams in the server, their member NICs and then the MAC addresses of the member NICs.

The following short  PowerShell script will automate this process and will list down the MAC addresses of the member NICs of all the native windows teams available in the server. The advantage with the below script is that it can be used on any Windows 2012 or Windows 2012 R2 servers without any modifications/inputs.

Script:

foreach ($i in ((Get-NetLbfoTeam).name))
{
Write-Host "`nTeam Name - "$i`n"Team Members: "
Get-NetAdapter (Get-NetLbfoTeamMember -Team $i).Name | Format-Table
}

Source TechNet

Restore from Backup Exec Retired Media

retired media

Media that has been taken out of service, usually because of an excessive number of errors. Media that is retired is available for restore jobs but not for backup jobs. Media must be retired before it can be deleted. If you want to use media that has been deleted, Backup Exec will recognize it as imported media. It must be cataloged before you can restore from it.

Symantec Messaging GatewayPacket capture

Symantec Messaging Gateway version 10.6.x part of the Symantec Endpoint Protection Suite.  
 
Packet capture:
Running the TCPDUMP command
1.    Login to the command line (via SSH “Putty” or locally in the VM console or directly connected with monitor and keyboard) as admin.

2.    Run command “set-support” and create a new password for the support account. (This account will be automatically disabled after 7 days and can be re-enabled without knowing the password by re-running the command)

3.    Logout by typing “exit”  (in a Putty session this will require that you reconnect)

4.    Login with the username “support” and password you created.

5.    Run the “tcpdump” command.

Examples:

Capture only SMTP traffic

    tcpdump -s 0 -w /tmp/capture.cap -i any tcp port 25 -Z support

Gathering the Data to send to a support agent

Any files named *.cap in /tmp/ will be gathered by running a diagnostics.

If you run the diagnostics from the Control Center, you can download the file to your desktop.

OR

You can get the diagnostics by using WinSCP.

1. Download and install WinSCP (Available for free on the internet winscp.net)

2. Connect to the inbound IP of the appliance (The protocol will be SCP and the port 22) with the username support.

3. Browse to /tmp/ to find the diagnostics file. (or the path you directed the diagnostics to)

4. Copy to your workstation.
5. You can use Wireshark to analyze the caputer file. 

Access Based Enumeration (ABE)

To enable "Access Based Enumeration on a Windows 2008 or later server, ensure that the appropriate NTFS and Share permissions are set on the root share directory.  In my case I needed to allow everyone the ability to see the root share but restrict access to the subdirectories.  To avoid giving the users unnecessary access, I removed the "Everyone Group" and added the "Authenticated Users Group" with the Read and Change Share permissions.  I then gave explicit NTFS permissions to those groups who needed access to any of the subdirectories. 

Since I only wanted the "Authenticated Users to see the Root Share but not have access to the sub directories, I  gave the “Authenticated Users” Read NTFS permissions which includes the Travers folder permissions to allow them to drill down past the root share.  I then broke inheritances and made sure the “Authenticated Users” group had the following Special NTFS permissions. I also made sure to select “ Apply only to this folder”. 

List folder / read data

    Read attributes

    Read extended attributes

    Read permissions

I then added my other groups with explicit permissions to their respective directories.  So at this point the root share is visible to all Authenticated Users but the subdirectories are only displayed to those users/groups with explicit NTFS permissions, “Read, Write and Modify” and all of the special permissions that are included.   

Netbackup Policy Reporter

Every few months management asks for a list of backed up clients and over all details of the backup policies.  For a very long time I would reference a spreadsheet that would be manually updated.  Well, that was tedious and not so accurate work, so I started to look for a solution that would export the neatly formatted results of bppllist -allpolicies –U command.  My method was to export the results to a txt file and then use powershell to manipulate the text and format it. 

After a few searches, I found this post on the Symantec Connect site about the “Netbackup Policy Reporter”.  It is a VB utility written to format the results of the bppllist command.  This utility formats the result in a neatly organized spreadsheet that can be used as a report. 

I used the following steps listed on the post to generate the Netbackup Policy Report. 
1.    Download the Policy List Parser.txt file and rename it to Policy_list_parser.exe . This is a VB utility so the exe extension is necessary.  The machine where the Utility is executed will need to have excel installed.

2.    .  Executing the utility may give an error related to “COMDLG32.ocx”. I used a Windows 7 32bit workstation, so I downloaded the COMDLG32.ocx  and placed in System32  and registered the file with Windows by running the following at an elevated  command prompt. regsvr32  %Systemroot%\System32\comdlg32.ocx.

3.    After successful launch of the utility execute the “bppllist -allpolicies –U” command by navigating to AdminCmd directory.  On Windows: C:\program files \veritas\netbackup\bin\admincmd. 

4.    Send the command results to an out-file: C:\program files \veritas\netbackup\bin\admincmd\ bppllist -allpolicies –U>>C:\temp\rpt.txt. 

5.    To process the results of the command, enter the path to the text file in the input file field and enter the name of the new .xls file in the otput filed.

6.    Example Input: C:\temp\RPT.TXT
Ouput: C:\temp\Report.xls
Note: Error 1004" The file could not be accessed may occur if input and output fields are not filled out correctly. 

Make sure that all files are in the same directory to avoid any annoying errors. 


Symantec Connect Netbackup Reporter Post


Download comdlg32.zip

Lync 2010 Client Incorrect DisplayName

A few weeks ago we started having an issue where a users display name in the lync 2010 client would display a username other than the what we expected to see.  We started to notice this issue after a women would change her last name.  So, a a Women who was married and her name was changed other user would still see her old name. It turns out that we needed to make the following change:   EnableContactMergeUsingProxyAddress -Value $False. 

The forum post below is where I got the information to make the modifications  After a service restart the usernames displayed correctly. 

Cod Snipit from Forum Post.
 
$PolicyObject = Get-CsClientPolicy
$PolicyEntry = New-CsClientPolicyEntry -Name EnableContactMergeUsingProxyAddress -Value $False
$PolicyObject.PolicyEntry.Add($PolicyEntry)
Set-CsClientPolicy -Instance $PolicyObject
Get-CsClientPolicy

Thanks to TechNet Forums.

Lync 2010 Client Incorrect DisplayName.

Grand a user permission to send to Everyone

Grant a user permission to send to the everyone group. 

1. Open properties of everyone Group in EMC.
2. Open MailFlow Settings.
3. Open MessageDeliveryRestrictions
4. Add user

Script Resources for IT Professionals

PowerShell Script Repository containing cool scripts to help automate AD/Exchange taks.

Script Resources for IT Professionals

Configure Time Source on PDC Emulator

We recently had an issue with our time source and it caused us a bit a of a head ache.  It turns out that our time source was a router that lost its time and therefore affected the our DCs.  I issued the following command on on the DC holding the PDC Emulator Role and it immediately  solved our issue.  . 

w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update

the m anualpeerlist is where multiple sources are specified but I only included the time.windows.com source and it worked.

Configure The Time Source for the Forest

Upgrading from a vdr 1.x appliance

Upgrading from a vdr 1.x appliance:

    unmount any CIFS shares while the vdr appliance is idle
    shutdown and delete or rename vdr 1.x appliance
    deploy vdr 2.0 appliance
    configure vdr 2.0 appliance and re-add CIFS shares
    manually perform an integrity check

there’s no method to directly upgrade a vdr 1.x appliance to a vdr 2.0 appliance. it simply must be replaced.

VMWare Data Recovery Release Notes

Active Directory FSMOs

Flexibility Schema Operations Master (FSMOs)

Forest Roles:

1. Schema Master- Creation or Changes to AD objects are handled by a Single Domain controller holding the Schema Master role and then replicated to other DCs. 

2. Domain Naming Master- Role responsible for ensuring unique Domain Controller name. 

Domain Roles:

3. Infrastructure Master- Role responsible for checking for changes made to AD objects by comparing against the global catalog.  Changes are then replicated to other DCs. 

-NOTE-

Unless there is only one domain controller in the domain, the infrastructure master role should not be assigned to the domain controller that is hosting the global catalog. If the infrastructure master and global catalog are on the same domain controller, the infrastructure master will not function. The infrastructure master will never find data that is out of date, so it will never replicate any changes to the other domain controllers in the domain.

In the case where all of the domain controllers in a domain are also hosting the global catalog, all of the domain controllers will have the current data and it does not matter which domain controller holds the infrastructure master role.

4. RID Master- Responsible for ensuring Unique SID assignment. 

5. PDC emulator master- processes password changes from client computers and replicates these updates to all domain controllers throughout the domain. At any time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest.

Operations Mastter Roles 

http://www.symantec.com/connect/articles/readyfsmo-roles-active-directory-windows-2008-server 

Use Telnet to Test SMTP Communication
Technet library Article (bb123686)

Topic Last Modified: 2009-12-08

This topic explains how to use Telnet to test Simple Mail Transfer Protocol (SMTP) communication between messaging servers. By default, SMTP listens on port 25. If you use Telnet on port 25, you can enter the SMTP commands that are used to connect to an SMTP server and send a message exactly as if your Telnet session was an SMTP messaging server. You can see the success or failure of each step in the connection and message submission process.
Here are the scenarios where you may want to use Telnet to test SMTP communication to or from the transport servers that exist in your Microsoft Exchange Server organization:
•    Connect to your organization's Edge Transport server from a host that is located outside your perimeter network and send a test message.
•    Connect to a remote messaging server from your organization's Edge Transport server and send a test message.
The procedure in this topic shows you how to use Telnet Client, which is a component that is included with Microsoft Windows. Third-party Telnet clients may require a syntax that is different from that of the Windows Telnet component.
________________________________________
 Use Telnet on Port 25 to test SMTP communication
________________________________________
For purposes of providing an example, the following procedure uses the values that are described in the following list:
•    Destination SMTP server   mail1.fabrikam.com
•    Source domain   contoso.com
•    Sender's e-mail address   chris@contoso.com
•    Recipient's e-mail address   kate@fabrikam.com
•    Message subject   Test from Contoso
•    Message body   This is a test message
 Note:
You should always use a valid sender e-mail address so that any non-delivery report (NDR) messages that are generated by the destination SMTP server are delivered to the sender of the message. 

The commands in Telnet Client are not case-sensitive. The SMTP command verbs are capitalized for clarity.
1.    At a command prompt, type telnet, and then press ENTER. This command opens the Telnet session.

2.    Type set localecho and then press ENTER. This optional command lets you view the characters as you type them. This setting may be required for some SMTP servers.
3.    Type set logfile <filename>. This optional command enables logging of the Telnet session to the specified log file. If you only specify a file name, the location of the log file is the current working directory. If you specify a path and a file name, the path must be local to the computer. Both the path and the file name that you specify must be entered in the Microsoft DOS 8.3 format. The path that you specify must already exist. If you specify a log file that doesn't exist, it will be created for you.
4.    Type open mail1.fabrikam.com 25 and then press ENTER.

 Note:
You can't use the backspace key after you have connected to the destination SMTP server within the Telnet session. If you make a mistake as you type an SMTP command, you must press ENTER and then type the command again. Unrecognized SMTP commands or syntax errors result in an error message that resembles the following:
5.    500 5.3.3 Unrecognized command
6.    Type EHLO contoso.com and then press ENTER.
7.    Type MAIL FROM:chris@contoso.com and then press ENTER.
8.    Type RCPT TO:kate@fabrikam.com NOTIFY=success,failure and then press ENTER. The optional NOTIFY command defines the particular delivery status notification (DSN) messages that the destination SMTP server must provide to the sender. DSN messages are defined in RFC 1891. In this case, you're requesting a DSN message for successful or failed message delivery.
9.    Type DATA and then press ENTER. You will receive a response that resembles the following:
10.    354 Start mail input; end with <CLRF>.<CLRF>
11.    Type Subject: Test from Contoso and then press ENTER.
12.    Press ENTER. RFC 2822 requires a blank line between the Subject: header field and the message body.
13.    Type This is a test message and then press ENTER.
14.    Press ENTER, type a period ( . ) and then press ENTER. You will receive a response that resembles the following:
15.    250 2.6.0 <GUID> Queued mail for delivery
16.    To disconnect from the destination SMTP server, type QUIT and then press ENTER. You will receive a response that resembles the following:
17.    221 2.0.0 Service closing transmission channel
18.    To close the Telnet session, type quit and then press ENTER.



Technet

SMTP Error and Reply codes

I was recently asked about SMTP Errors / Reply Codes and I realized that I have not committed them to memory , so I decided to look them up and found this really nice table.  

Check the RFC index for further mail-related RFCs.

Reply codes in numerical order
Code	Meaning
200	(nonstandard success response, see rfc876)
211	System status, or system help reply
214	Help message
220	<domain> Service ready
221	<domain> Service closing transmission channel
250	Requested mail action okay, completed
251	User not local; will forward to <forward-path>
354	Start mail input; end with <CRLF>.<CRLF>
421	<domain> Service not available, closing transmission channel
450	Requested mail action not taken: mailbox unavailable
451	Requested action aborted: local error in processing
452	Requested action not taken: insufficient system storage
500	Syntax error, command unrecognised
501	Syntax error in parameters or arguments
502	Command not implemented
503	Bad sequence of commands
504	Command parameter not implemented
521	<domain> does not accept mail (see rfc1846)
530	Access denied (???a Sendmailism)
550	Requested action not taken: mailbox unavailable
551	User not local; please try <forward-path>
552	Requested mail action aborted: exceeded storage allocation
553	Requested action not taken: mailbox name not allowed
554	Transaction failed

Thanks to  Greenend.org

PowerShell Script to list daily health checks of all Exchange 2007 Servers.

$ExchServer=Get-ExchangeServer
foreach ($Server in $ExchServer)
{
echo $Server.name (Test-ServiceHealth $Server)
}


SMTP Port 25

Upgrade of a NetBackup master server to version 7.1.0.2 may cause bmrsavecfg failures at backup time when Bare Metal Restore (BMR) information is being collected.  At backup time, the BMR process runs a bmrsavecfg job that will collect information from the client and submit the data into the BMR database on the master server to be imported. Although this process previously worked prior to the upgrade, there may be failures while the data is being imported into the BMR database.

Error Messages in Job Detail Status:

 BMRERR: Received BMR error: Failed to import Config file. (1) 
Error bpbrm(pid=6456) BMRERR: Received BMR error: Failed sending the discovery. (1) 
Error bpbrm(pid=6456) BMRERR: Received BMR error: BMR information discovery failed. (1)

Symantec TechNote

NetBackup Status Code 59

Every now and then some of my Netbackup jobs end with status code 59 which means that the Netbackup master or Media server is not in the client Server allow list.  This usually happens after an Agent upgrade which not a big issue, but annoying none the less.

Message: access to the client was not allowed
Explanation: The master or the media server tries to access the client, but the client does not recognize the server as a valid server.
For the Enterprise Vault Agent: The names of all of the media servers among the Enterprise Vault servers are not specified in the client configuration.
Recommended Action: Do the following, as appropriate:
•    If the server is a valid server, verify that it is in the server list on the client. If necessary add it as follows:
•    1. Open the Backup Archive and Restore Utility on the Windows Client.
•    2. Select File >Specify NetBackup Machines and Policy Type
•    3. On the Specify NetBackup Machines  and Policy Type dialog opens Select Edit Server list and type in the name of Netbackup master or media server that will backup the client up..

Update: I've not had a chance to try this fix but it seems related.  From Symantec How TO articles. 

bpsetconfig

I have also seen this fix for status code (46) I've seen the technote but do not have the link. 
From the Netbackup OppsCenter Help Menu

Netbackup: Import Disk Based images

This is the procedure I used to import Netbackup disk based images from a failed media server.  This is a 2 phased method that uses the NBU Admin console.  Phase 1 initiates the import process by locating the path to the images to be imported and the second phases imports the images into the database.  The disk images must be present on a local disk. In my experience network importing from a network share did not work.

Phase 1
Importing NetBackup disk images
First, run the "phase 1 import".
1. Start the NetBackup Administration Console and go to the Catalog section.
2. From the menu select Actions > Initiate Import and a dialog box will appear.
3. Check the "The images to be imported are on disk" radio button and enter a disk path to import images from.
4. Check the Activity Monitor for progress of the phase one import.

Phase 2
Once the "phase 1 import" completes, run the "phase 2 import".
1. Start the NetBackup Administration Console and go to the Catalog section.
2. Under Pathname:, enter the disk path used for the phase 2 import.
3. Select a date range for the images to import and click the Search button.
4. Select Backup IDs to import from the search results.
5. From the menu select Actions > Import to begin the phase 2 import.
6. Check the Activity Monitor for progress of the phase 2 import.

Once the phase 2 import completes successfully, the disk images will be available for restores.


Documentation