Scenario objectives: We have an Exchange Hybrid setup between on-premises and Exchange Online (Office 365). All users are synced and the mailbox is located at Exchange Online.

We need to separate an existing mailbox from its user account and re-connect this mailbox to a new user account. If the mailbox in this scenario was located at the on-premises Exchange it would be an easy process just using the Exchange Management Console. But in a Hybrid scenario, the process includes many steps since the mailbox is not directory conencted to the Active Directory user account but it is conected to the Azure AD Synced User Account.

For the ease of the guide we will name the Existing User Account: OLDUSER and the New User Account: NEWUSER.

We will disconnect the Exchange Online Mailbox from the OLDUSER and connect it to the NEWUSER.

Step 1.

At the on-premises Active Directory, at an OU that is not synced with Azure AD, create the new user account. The “NEWUSER”. Ensure that you do not enter nothing at the email field. Just a user account with no email attributes.

Step 2.

Move the “OLDUSER” to an OU that is not synced with Azure AD

Step 3.

Run a Delta Sync. Go to the server that the AD Connect is installed, open the PowerShell and run “Start-ADSyncSyncCycle”

Step 4.

We need to get the GUID of the NEWUSER. To do so login to a Domain Controller, open PowerShell and run:

[system.convert]::ToBase64String((Get-Aduser NEWUSER).objectGUid.ToByteArray())

Copy the GUID to a Notepad

Step 5.

Open the Office 365 Admin Center and Restore the deleted user “OLDUSER”

Go to Users –> Deleted Users –> Select the user “OLDUSER” –>Click Restore

Step 6.

Connect to Azure AD and set the GUID of the “NEWUSER” to the Office 365 “OLD USER”. Details for connecting to Azure AD “https://technet.microsoft.com/en-us/library/dn975125.aspx“

Connect-MsolService

Set-MsolUser -UserPrincipalName olduser@mydomain.com -ImmutableId vMZGJpW6CUGY09bduJ5dlw==

Step 5.

Open the Office 365 Admin Center and Delete the old user “OLDUSER”

Go to Users –> Active users –> Select the “OLDUSER” –> click Delete user

Step 6.

Clean the on-premises Active Directory account of the old user “OLDUSER” from all attributes that will be added to the new user, like Proxy addresses, Target, address, Alias name, nickname etc.

Step 7.

Make the “NEWUSER” user account a Remote Mailbox object

At the on-premises Exchange, open the Exchange Management Shell and run:

Enable-RemoteMailbox -Identity NEWUSER -DisplayName "NEW USER" -RemoteRoutingAddress newuser@mydomain.onmicrosoft.com -Alias newuser -PrimarySmtpAddress newuser@mydomain.com

Step 8.

Move the “NEWUSER” to an OU that is Synced with Azure AD and run a Delta Sync like Step 3.

After that the “NEWUSER” active directory account will be connected with the “OLDUSER” Exchange Online mailbox and all attributes of the Exchange Online mailbox will be replaced with the “NEWUSER’s” values.

I suppose there are other ways, maybe easier, to accomplish this task, but following this process you will have the desired result without problems.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario appeared first on Apostolidis Cloud Corner.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Exchange 2013/16 Set Virtual Directories Notes appeared first on Apostolidis Cloud Corner.

Open the Microsoft Exchange Management Console and navigate to Microsoft Exchange -> Server Configuration.

On the right panel press the “New Exchange Certificate”

The “New Exchange Certificate” wizard will start. Enter a friendly name, just a name to remember what this certificate is about.

no need to check the wildcard option

At the next page select the services that you want, in most cases select all  “Client Access Server”,

Next add all the alternative names that you want to include to the certificate

fill the Organization form and select the save path

finally press “new” to create the certificate request

after this at the Exchange Certificates windows of the Exchange Management Console you will see a new item that will say “Pending request”.

Open the exported file with notepad and save it as “ASCII” encoding (the original is Unicode)

Now we need to go to our Domain’s Active Directory Certification Authority and open an elevated command prompt.

Run the command:

certreq.exe -submit -attrib CertificateTemplate:WebServer

It will ask you to select the request file, select the ACHII encoded file

and then select the Certification Authority

finally it will produce a cer file.

Go back to the Exchange Certificates window of the Exchange Management Console, select the “pending certificate request” and press “complete pending request”. Select the cer file, select the services needed (IIS, SMTP, POP, IMAP) and the wizard will create the certificate and enable it for the services.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Exchange 2010 | add local domain CA certificate appeared first on Apostolidis Cloud Corner.

I prepared a lab with one DC and I created a trial Office 365 E3 account with custom domain. I created users with the same username to both.  At Active Directory I set the UPN to match the Office 365 user name and also added the email address.

Next I enabled directory synchronization from Office 365 and installed Azure AD Connect to DC2. After the initial sync i got this error:

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [Mail test1@xxxxx.gr;].

I realized that Office 365 could not map the users, it was trying to create new. So there must be an attribute that needs correction. The solution came form the following blog:

http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

and specifically at the “manual match method” section:

In order to match the user with the cloud user you have to set the Immutable ID of onPremise Active Directory user’s ObjectGUID to the immutableID value of the Office365 user.
To retrieve the ObjectGUID you can use the following command:

Ldifde –d “CN=xxx…,OU=xxx,DC=xxxx,DC=xx” –f c:\temp\exportuser1.txt

“CN=xxx…,OU=xxx,DC=xxxx,DC=xx” is the distinguished name of the user. You can use ADSIEdit or the AD Users & Computer (attribute editor) to find this value

In the Textfile exportuser1.txt look for the ObjectGUID. You will find a string like z2Xbu0xFTUapOeDqHRTN1A==

Then connect to Windows Azure Active Director and use the command

set-MsolUser -UserPrincipalName user1.surname1@customerdomain.com -ImmutableId z2Xbu0xFTUapOeDqHRTN1A==

After that I just forced a delta sync “Start-ADSyncSyncCycle -PolicyType Delta” , the sync was successful and the users in Office 365 changed from “In Clout” to “Synced with Active Directory”

How to Map OnPrem Active Directory users to existing Office365 Users

source: http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Match OnPrem Active Directory users to existing Office365 Users appeared first on Apostolidis Cloud Corner.

Select the type of migration endpoint (Outlook Anywhere) and enter the details requested:

• An email address that will be migrated – this is used to test mailbox access during configuration
• Account with privileges – usually a Domain Administrator, but it can be another user, in which case you must assign permissions as specified here
• The privileged account you specify will be used to autodiscover the connection settings and test access to the mailbox specified above.

Click next and verify that the correct details have been populated in the next dialogue box:

Now that the endpoint has been tested you just need to define values for the number of concurrent migrations and supply a descriptive name for the endpoint.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Create migration endpoint | (Cutover & Staging Migration) appeared first on Apostolidis Cloud Corner.

to create the certificate request:

http://exchangeserverpro.com/create-ssl-certificate-request-exchange-2013/

to compete the pending request:

http://exchangeserverpro.com/exchange-2013-complete-pending-certificate-request/

and to enable it:

http://exchangeserverpro.com/exchange-2013-assign-ssl-certificate-to-services/

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Exchange 2013 Add public certificate and enable it appeared first on Apostolidis Cloud Corner.

First open a telnet client. The simplest is to open a Command Prompt and type:

“telnet yourexchangeserver 25” and press Enter

The Command Prompt will start the telnet client and try to connect to the mail server. The email server will post a 220 message that the mail service is ready. Now type “helo” and press enter.

The email server will reply to the helo command with a 250 Hello message. After that we need to specify the sender using the “mail from:”comand. Type “mail from: sender@domain.com” and press enter.

If the sender is accepted the email server will reply with a 250 2.1.0 Sender OK message.

Now we need to add the recipient using the “rcpt to:” command. Type “rcpt to: receipient@domain.com” and press enter.

If the recipient is accepted then the email server will reply with a 250 2.1.5 Recipient OK message.

Now we are ready to add text to the message. Type “data” press Enter and then start writting your message. To send the message type a dot “.” and press Enter. If the message is accepted the server will reply with a 250 2.6.0 message and post the message ID and the email is queued for delivery.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Test Exchange mail submission using SMTP commands appeared first on Apostolidis Cloud Corner.

Η εγκατάσταση του Exchange από την έκδοση 2013 μας δίνει την δυνατότητα να ενεργοποιήσει όλα τα προαπαιτούμενα όσον αφορά τα Windows Roles & Features. Το μόνο που χρειάζεται να εγκαταστήσουμε πριν τρέξουμε το Setup του Exchange 2016 είναι το Unified Communications Managed API 4.0 Runtime από το: http://go.microsoft.com/fwlink/?LinkId=260990

Μπορούμε να κατεβάσουμε την εγκατάσταση του Microsoft Exchange 2016 από το: http://www.microsoft.com/en-us/download/details.aspx?id=49161
Αφού κατέβει το αρχείο Exchange2016-x64.exe το τρέχουμε και κάνει αποσυμπίεση όλα τα αρχεία της εγκατάστασης όπου του ορίσουμε. Στη συνέχεια τρέχουμε το setup.exe και ξεκινάει ο Setup Wizard.

Αποδεχόμαστε το agreement και πατάμε next

Διαλέγουμε “recommended Settings” και πατάμε next

Διαλέγουμε “Mailbox Role” & “Automatically install Windows Server roles that are required to install Exchange Server” και πατάμε next

Επιλέγουμε την διαδρομή για την εγκατάσταση και πατάμε next

Δίνουμε όνομα στο Exchange Organization ή το αφήνουμε στο προεπιλεγμένο. Αν θέλουμε να διαχωρίσουμε τα δικαιώματα μεταξύ Active Directory & Exchange Organization διαλέγουμε “Apply Active Directory split permissions security model to the Exchange organization”. Αν το Active Directory & ο Exchange έχουν τους ίδιους Administrators τότε απλά το αφήνουμε στην προεπιλογή  (unchecked) & πατάμε next

Διαλέγουμε αν θέλουμε το malware service ενεργό ή όχι και πατάμε next. 

περιμένουμε να τελειώσουν τα Readiness Checks και πατάμε install για να ξεκινήσει η εγκατάσταση.

Περιμένουμε να ολοκληρωθεί η εγκατάσταση και πατάμε finish

Η εγκατάσταση του Exchange ολοκληρώθηκε. Παρακάτω είναι τα απαραίτητα βήματα για να μπορέσουμε να στείλουμε emails.

Ανοίγουμε το Exhcange Admin Center. Στο lab μου είναι https://localhost/ecp & login

Στο “mail flow” πατάμε “send connectors”

Στο “Send Connector” wizard δίνουμε ένα όνομα και διαλέγουμε “Internet”. Αυτό θα δημιουργήσει έναν connector ο οποίος θα στέλνει emails στο internet.

Στην επόμενη εικόνα επιλέγουμε “MX record associated withrecipient domain”

Στο “Address space” πατάμε το + και στο “add domain” διάλογο γράφουμε “*” στο πεδίο FQDN.

Διαλέγουμε τον Exchange Server για Source server και πατάμε finish

Μόλις δημιουργηθεί ο connector πατάμε το κουμπί “edit” (το εικονίδιο με το μολύβι) για να επεξεργαστούμε τον connector

Και στο “scoping” tab στο πεδίο FQDN βάζουμε την εξωτερική διεύθυνση που θα απαντάει στο HELO/EHLO, για το lab έβαλα “mail.mylab.lab” και πατάμε save

Τώρα είμαστε έτοιμοι να στείλουμε το πρώτο μας email. Μπορούμε να ανοίξουμε το OWA και να στείλουμε ένα email οπουδήποτε. Το ποιο πιθανό είναι να πάει στο spam/junk φάκελο του παραλήπτη βέβαια.

Ένα τελευταίο βήμα για να επιτρέψουμε στον Exchange να δέχεται emails από τον έξω κόσμο είναι να ρυθμίσουμε τον default receive connector.

Από το “mail flow”, πατάμε “receive connectors”, και διαλέγουμε “Default Frontend servername” connector και πατάμε edit

Στο “security” tab επιλέγουμε το “Anonymous users” και πατάμε save

Φυσικά χρειάζεται να κάνουμε έναν κανόνα στο εξωτερικό Firewall ώστε να προωθεί τις πόρτες 25 & 443 εσωτερικά στον Exchange Server.

Τώρα έχουμε έναν πλήρη Exchange Server 2016 που μπορεί να στείλει και να λάβει emails.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Microsoft Exchange 2016 | Από το 0 στο 1ο email appeared first on Apostolidis Cloud Corner.

Exchange Setup, since 2013, allows us to select if we want the setup wizard to enable all required Windows Roles & Features automatically. The only prerequisite is to install the Unified Communications Managed API 4.0 Runtime from: http://go.microsoft.com/fwlink/?LinkId=260990

The Microsoft Exchange 2016 installation can be downloaded from: http://www.microsoft.com/en-us/download/details.aspx?id=49161
Next we can start the Microsoft Exchange 2016 setup, using the setup.exe at the installation media.

Accept the agreement and click next

Select “recommended Settings” and click next

Select “Mailbox Role” and “Automatically install Windows Server roles that are required to install Exchange Server” and press next

Select the path for  the installation and press next

Name the Exchange Organization or leave it default. If you want to split the premissions between Active Directory and Exchange Organization select the “Apply Active Directory split permissions security model to the Exchange organization”. If Active Directory and Exchange have the same Administrators then leave it default (unchecked) and press next

Chose if the malware service will be active or not and press next. 

wait the Readiness Checks to complete and press install

Wait the Setup progress and finally once the setup is completed press finish

The Exchange Setup is completed. Below are the minimum steps to start sending emails.

Open the Exhcange Admin Center. At my lab I used the https://localhost/ecp and login

Go to “mail flow” and click the “send connectors”

At the “Send Connector” wizard type a name and select “Internet”. This will create a connector that will send emails to the internet.

Next select the “MX record associated withrecipient domain”

Next at the “Address space” click the + and at the “add domain” dialog add “*” to the FQDN to configure the connector to send all emails.

Next select the Exchange Server for Source server and press finish

Once the connector is created, press the “edit” button (the icon with the pen) to edit the connector

And at the “scoping” tab add the FQDN that the server will provide for HELO/EHLO, for the lab i added “mail.mylab.lab” and press save

Now we are ready to send our first email. We can open OWA with the administrator account and send an email to the outside world. Probably it will be delivered to the spam/junk folder of the receipient 🙂

One final step to enable our Exchange to receive emails from the outer world we need to configure the default receive connector.

Go to “mail flow”, click the”receive connectors”, select the “Default Frontend servername” connector and click edit

Go to the “security” tab and check the “Anonymous users” and click save

Of cource we need to add a Port Forwarding rule to the external firewall for the ports 25 and 443 to the Exchange Server’s internal IP.

Now we have a fully functional Microsoft Exchange 2016 server that sends and receives emails.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Microsoft Exchange 2016 | From 0 to 1st email appeared first on Apostolidis Cloud Corner.

Now, Step-by-Step:

Lets say that the Mail-Enabled PF’s name is mypublicfolder and the Email Address is mypublicfolder@mydomain.gr

1. Open Exchange Management Console
2. Go to “Receipient Configuration” / “Mail Contact” / “New Mail Contact”
   
3. Select “New Contact” and click Next
4. Since the we cannot add the same details as the Public Folder, enter something similar just to remember, I use the “-O365” extension like this:
   Name: mypublicfolder-O365
   Alias: mypublicfolder-O365
   External e-mail address: mypublicfolder-O365@mydomain.gr
   
5. Click Next, New and finally Finish to create the Mail Contact
6. Open Active Directory Users & Computers
7. Go to “View” and check the “Advanced Features”
8. Go to the container that the new Mail Contact is located and double click to open the properties
9. Go to the “Attribute Editor” tab and search for the “TargetAddress”
   
10. Click Edit and change the address to the Mail-Enable Public Folders address, in this case the Target Address field should change to: SMTP:mypublicfolder@mydomain.gr
    
11. Click OK, Apply and OK to close the properties.
12. Now go back to the Exchange Management Console and go to “Reciepient Configuration” / “Distribution Group”
    
13. Locate the Distribution Group and add the Mail-Contact as a member.
14. Wait the DirSync to finish a full sync or force it and you are ok.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post DirSync & Mail-Enabled Public Folders Distribution Group Members appeared first on Apostolidis Cloud Corner.