SMS Site System Status Summarizer still cannot access storage object. The operating system reported error 2147942405: Access is denied.

Now that I've got my OCS 2007 R2 successfully integrated with Cisco Call Manager 7, I thought I'll expand our test environment and start implementing SCCM 2007 R2 for monitoring the servers installed and facilitate the deployment of future clients.
I chose to set up my SCCM environment on 4 servers:
SCCM1 = MP, FSP, SLP, Site server
SCCM2 = DP, PXE, SUP
IIS1 = Reporting Point, SQL Reporting
SQL1 = DB server

I installed the first SCCM1 server and from within the management console I deployed the other SCCM services (SCCM2 and IIS1). For this I followed the Technet deployment and configuration guides for SCCM 2007 R2. No problems there.
Also with the installation and configuration of Reporting on IIS1 all went ok. Running the reports works fine. So all ok you would think?!

Still, I kept receiving these annoying messages under Site Status - Site System Status - IIS1\C$\SMS
(in the print screen below, the status is now OK, because of course by now I resolved the problem ...)
(The Site System Status is CRITICAL because I have installed the PXE service, but haven't configured it yet, I'll do that next ...)

So anyway, here I would get these messages:

SMS Site System Status Summarizer still cannot access storage object "\\BTLABIIS1\C$\SMS" on site system "\\BTLABIIS1". The operating system reported error 2147942405: Access is denied.

Everywhere you look online it will tell you to make sure the SCCM site server computer account (SCCM1 in my case) is member of the local Administrators group on the remote SCCM server.

Unfortunately for me, that didn't do the trick. Reading the documentation on Technet, I knew I had this before anything else, but still with the result displayed above.

To resolve this, there is a second account that needs to be member of the Administrators group on the remote server: the service account used to deploy the SCCM service with. You can look it up Site management - Site Settings - Site Systems - - Role properties.

When you add this account to the Administrators group, this error message will dispear.

Hope it helps.

OCS 2007 R2 Documentation

You also noticed that when you search for OCS 2007 R2 documentation, you get a lot of OCS 2007 documents? Drove me crazy, whenever I followed a link on a OCS 2007 R2 site, I got to OCS 2007 knowledge base.

So I decided to make a collection of true OCS 2007 R2 document libraries, to facilitate my OCS 2007 R2 - Cisco Call Manager integration project:
1. Microsoft Office Communications Server 2007 R2
The mother load, from the Microsoft download center. I just don't understand why this doesn't show up when you Google it.
2. Microsoft Office Communications Server 2007 R2 Documentation
A CHM file with technical documentation to help you understand, plan, deploy, and operate Microsoft Office Communications Server 2007 R2 servers.
Remember that you might have to "Unblock" the content.
If you need help on that, here is the Microsoft support page: You cannot open HTML Help (.chm) files from Internet Explorer
3. Microsoft Office Communications Server 2007 R2 online documentation
If you don't want to mess about with the .chm file, you can find the same documentation online, on the Technet pages.

Hope this can help you on your OCS search.

Exchange 2010 beta available: a list of the new features

So yesterday (14/04/09) we were able to download the first beta of the new email system that is used by 65 % of the companies. In Q3 of 2009 the distribution of the RTM version should be a fact.

First thing I noticed is that the admin interface has not been majorly changed, compared to the new interface we got from E2K7. That's good, cause I like this new interface much better than the old one.

Based on Microsoft documentation, I've set off testing and playing around in my test lab. The improvements they have made (27 to be exact) are divided by Microsoft in 3 big pilars:
1. Flexibility and reliability
2. Anywhere access
3. Protection and compliance

Of course, one of the most eye catching improvement is the support for OWA on Internet Explorer 7 & 8, Safari 3 and Firefox 3. But another cool feature that I think will be much used is the "MailTips". It will protect end users from sending personal mails to large mailing groups. The last thing that caught my eye yesterday already is the "Consolidated view" and "Conversation Mute". Finally we are able to view all e-mails concerning a single topic in a single node (in Outlook ànd OWA).

Below is a list of the other 27 improvements. The ones I think are really interesting and that I'll be looking into I've indicated in bold:
1. Added internet browser support for OWA
2. Answer/forward status is being kept by the server and can be shown on all clients
3. MailTips to prevent personal mails from being distributed to large communities
4. Conversation view for the threating of messages
5. Calendar sharing available in OWA and for federated users
6. Sharing of contacts outside the company and outside the desktop
7. Voice Mail Preview: automatic written preview of a received voice mail
8. Call Answering Rules to administer phone calls just like e-mails
9. Rights Management in OWA as well as Outlook
10. Federation Services to connect your Exchange servers to those of other organizations
11. Page patching: automatic fixing of corrupted DB pages
12. I/O Optimalization: less I/O bursts, support for SATA disks
13. JBOD (Just a Bunch Of Disks) support instead of only RAID
14. Database Availability groups: redundant DB's for mailboxes which provide automatic recovery
15. Failover on DB level, clustering not longer necessary to provide high-availability, so more uptime
16. Online Move-Mailbox: moving MBX'en while the user is logged in
17. Rules for transport protection: an administrator can change the IRM protection AFTER they have been sent
18. Moderation: a transport rule that allows you to send a message to a reviewer before the message is actually sent
19. Rules for protection Outlook which allows you to automatically assign RMS templates to e-mails
20. Role-based access control for Outlook
21. Exchange Control Panel to assign end users specific levels of control
22. Message tracking for end users (without having to contact the helpdesk)
23. Distribution Groups can be created, modified and deleted by end users
24. Block/Allow list for mobile devices
25. Protected voicemail: you are able to block the sending of voicemails outside the organization
26. Personal archive: moving of PST files to a secundary mailbox for better performance and compliance
27. Multi mailbox search: finally you are able to search multiple mailboxes with a single click

As you can see, there are quite a few cool improvements.
Can't wait to get started ... :)

OCS 2007 - Failed to send SIP request: outgoing TLS negotiation failed; HRESULT=-2146893022

So now that I have my OCS server installed, a few troubleshooting tasks have to be done (in my case anyway).

First error I saw when running the Validate Front End Server Configuration wizard, is this:

Looking around online I see everywhere that the certificate is probably wrong. I configured the certificate with the FQDN of the OCS server, which looks to be correct, especially when I see the entries above the check user logon section, where it shows it succeeds in connecting to the OCS pool.

So anyway, I tried recreating a new certificate, this time with the FQDN of the OCS pool instead of the OCS server. After signing the new certificate with my CA and assigning it to the OCS server, it still Completes with failures. Only this is very interesting: now my login is successful but I can't connect to the OCS pool anymore. Complete opposite of what I had before!

What the f***??!! Before you start trying: assigning the certificate with the server FDQN to the OCS server and the OCS FQDN to the IIS (or visa versa) does not work either.

Instead, create a new certificate with these settings:
1. Subject name: FQDN of the OCS pool
2. Alternate name: not that important
3. Remember to check the Automatically add local machine name to Subject Alt Name, that way you create a multi-homed certificate

After assigning this certificate to your OCS server and in the IIS manager, you should be good:

Hope it can help...

OCS 2007 & SQL2005 SP3 – Pool backend discovery failed

A few weeks ago I was installing an OCS server in a lab environment for the purposes of giving demo’s and testing some stuff out myself.

However, before I could actually even start I ran into a nice little problem.
First I prepared the AD, as documented by Microsoft, no problem there at all. Then I launched the Create Enterprise Pool from the setup.exe

In the next screen of the simple wizard you need to provide a pool name, after which the FQDN is filled in automatically and the SQL backend. (if your SQL farm is separated by a firewall, make sure port 1433 is open from the OCS to the SQL)

That should be that. Unfortunately for me, I received this error:

Since I have a SQL 2005 server, I checked the Service Pack level and made sure it was the latest version (SP3). The Backward Compatibility pack installed on the OCS is from the same SP level. No problem there you would say. But no matter how I tried configuring the OCS pool, it didn’t work.

I guess not many people have this issue, since I didn’t find much online about it. But then I stumbled across this article from Microsoft: You cannot create the enterprise pool for Office Communications Server 2007 on a back-end server that has SQL 2005 Service Pack 3 (SP3) installed
Basically it says the backward compatibility pack from SP3 does NOT work correctly and what you need to do is this:
1. Uninstall the SQL 2005 SP3 Backward compatibility pack
2. Download the correct backward compatibility pack (SQLserver2005_BC.msi) from this link: SQLServer2005_BC.msi
3. Install this new BC pack

Immediately after that I tried the OCS enterprise pool wizard again (no reboot) and what do you know: it flew straight through!

Replicate Exchange to a DRS (Disaster Recovery Site): Best Practices

In my last post I’ve gone over some of the considerations you need to keep in mind when choosing a replication setup for Exchange 2007.

Now there are of course some best practices you can keep in mind when you’ve chosen your setup concerning the replication of Exchange 2007. Since we are on the subject, and in order to keep a nice overview, I’ve created this post which is a summary of the Microsoft guidelines.

1. Mandatory Data to replicate
a) edb files: messages and MAPI-content
b) stm files: non-MAPI content
c) log files: changes to commit to the database
d) chk files: info on the entries in the log files

2. Best Practices for asynchronous replication (replication mechanisms)
a) Configure replication at the logical/mount point volume level: if the mailbox data path is G:\MDB1\MDB1.EDB, then drive G should be the base unit to perform replication. As a result, all the data on drive G will be replicated. Setting replication to occur at the file or subdirectory level is prone to human error and is not supported by Microsoft.
b) Create many replication points: reduce the queuing of multiple I/O’s which are destined for the same replication point
c) Keep transaction logs on different logical volumes: since each write I/O request is queued at the replication point, it is best to split the edb and log files to different logical volumes, to reduce long write response times.
d) Use multiple replication links: expensive, but necessary (although not technically) for availability and load-balancing.

3. Best Practices for Configuring Exchange For Synchronous Replication
a) Create the maximum number of storage groups per Exchange server: there will be more parallel log writing processes, which can reduce the overall transaction log-write latency
b) Increase transaction log buffer size: Increasing the log buffer size reduces the frequency of capacity flushes, increases the log write size, and subsequently reduces the overall log write latency.

That's about it for this post. Of course, this is only a short summary and can (should be) supplemented with other articles on this subject.

Replicate Exchange to a DRS (Disaster Recovery Site): Design

Last week, we had a discussion over the design and configuration of an Exchange 2007 server in a DRS.

Of course, as always, there isn’t one answer that fits all. There are a few questions you need to answer to get to a solution that fits your needs:
- How will the data be replicated to the server located in the DRS?
- How performant is the link between the main site and the DRS?
- How important is are the e-mails within your company?
- How much money do you have to spend?

Let’s go over the questions one by one to come to our solution.

1. How will the data be replicated to the server located in the DRS?
There are 4 different replication menthods:
a) Synchronous replication: the Exchange host receives a “successful write” response when the operation is complete on the local AND remote locations.
Advantages:
I. guaranteed no data loss (how is that for a sole advantage … )
Disadvantage:
I. reduced performance (site link, link utilization, distance very important since mails have to saved to both local and remote storage)
II. more expensive than asynchronous replication
III. need for 3rd party software
b) Asynchronous replication: the Exchange host writes to the local storage and the data is replicated independently afterwards
Advantages:
I. not as heavy on performance indicators as synchronous replication
II. cheaper than synchronous replication
III. native Exchange 2007 technology (LCR, SCR & CCR)
IV. robust: (in case of a CCR no single failure will lead to a loss of service)
Disadvantages:
I. no guarantee against data loss can be provided
c) Host-based replication: a filter driver manages the replication (and needs to cut the I/O stream to do this)
d) Storage-based replication: replication at storage level (more performant than host-based replication)

2. How performant is the link between the main site and the DRS?
Whether you choose synchronous or asynchronous replication might not just depend on the budget you have to spend, but also on the environment that is already in place. Be aware that choosing synchronous replication will not only reduce the number of mailboxes per server (up to 75 % reduction in mailboxes/server scalability), the site link is largely impacted as well.

The tools LoadSim and JetStress are developed by Microsoft to test latencies and storage throughput.

3. How important is are the e-mails within your company?
As said above, asynchronous replication cannot guarantee that all data will be retained in case of a “disaster”, while synchronous replication does (providing the site links are operational). However, Exchange 2007 is designed to lose as little information as possible in case of a failure. Thanks to the LCR, CCR and SCR technologies, the losses should be minimized to read/unread messages statuses, incomplete contact, calendar entries, … If this is acceptable for your SLA, they offer a really good solution. Of course, if databases have to be moved to a new stand-by Exchange server, some downtime will be unavoidable.

4. How much money do you have to spend?
I guess this point is pretty clear. Choosing between LCR, SCR and CCR have already huge price effects on your budget. If your SLA requires you to choose for synchronous replication, this price will mount exponentially since third party software will have to be purchased, installed, configured, received training on, …

PowerShell Graphical Help

PowerShell is cool, isn't it? I absolutely love it.

But there was a downside. Using the help function within the PowerShell prompt is difficult to read not to mention it can scroll your screen quite a bit.

So instead of using the help function within PowerShell, the PowerShell guys of Microsoft have created a Graphical Help File.

It contains just the same information as the help within PowerShell when using the -detailed switch, but it comes with some definate advantages:
- fully searchable
- graphical
- seperate window so you can a clear eye on your code

A must have download.

“The execution of scripts is disabled on this system” … How to run your own PowerShell scripts

So you’re picking up PowerShell scripting, are you?
As a first test, you create a little, never fail “hello world” script and launch it from within a PowerShell, but instead of seeing “Hello World” you see this:
File C:\scripts\test.ps1 cannot be loaded because the execution of scripts is disabled on this system. Please see "get-
help about_signing" for more details.
At line:1 char:19
+ c:\scripts\test.ps1 <<<<

What the hell?? Yep, that’s right: by default only digitally signed scripts can be run from within PowerShell. Luckily, this can be remedied fairly easily.

If you launch the command Get-ExecutionPolicy you will see that the default policy is set to Restricted, basically creating your problem.

Now we can change that value to 5 different settings:
1. Restricted: no scripts will be executed
2. Unrestricted: all scripts will be executed
3. RemoteSigned: all scripts you created yourself will be run, all scripts downloaded from the internet will need to be signed by a trusted publisher
4. AllSigned: all scripts, including your own, will need to be signed by a trusted publisher
5. Default: = Restricted (unless you change the default value to something else)

OK, so now that we know that we can change the policy by simply typing Set-ExecutionPolicy RemoteSigned.

And that’s it! Your scripts can be run. I’ll be posting soon about how to set up your own “trusted publisher” so that we can secure our PowerShell environment as much as possible.

Have fun!

Infrastructure Planning & Design (IPD)

This weekend I've found a collection of documents on the Microsoft download pages: IPD.zip

It holds a whole list of documents, defided per technology, in which they go over the design processes:
- Windows Server 2008 File Services
- Selecting the Right NAP Architecture
- Windows Server 2008 Active Directory Domain Services
- ...

The series is a collection of documents that leads the reader through a sequence of core decision points to design an infrastructure for Microsoft products. It also provides a means to validate design decisions with the business to ensure that the solution meets the requirements for both business and infrastructure stakeholders..

Very interesting reading, for whoever is interested ...