12/3/2013

Microsoft Official Course

Module 1

Deploying and Managing Microsoft Exchange Server 2013

Module Overview
Exchange Server 2013 Prerequisites and

Requirements
Exchange Server 2013 Deployment Managing Exchange Server 2013

Lesson 1: Exchange Server 2013 Prerequisites and Requirements

Active Directory Components and Exchange Server

Integration
DNS Server Requirements for Exchange Server

2013
Software Requirements for Exchange Server 2013 Hardware Requirements for Exchange Server 2013 Infrastructure Requirements for Exchange Server

2013
Preparing AD DS for Exchange Server 2013

Deployment

12/3/2013

Active Directory Components and Exchange Server Integration

Exchange organization and Active Directory forest: one-to-one relationship

Forests

Schema

Exchange object classes and attributes

Exchange configuration Configuration

Exchange recipients Domain Exchange object attributes for mail-enabled and mailbox-enabled objects

Global Catalog

DNS Server Requirements for Exchange Server 2013

Exchange Server 2013 uses DNS to locate AD DS

domain controllers and to register its SRV records

Exchange Server 2013 uses following record types: SRV records Host records MX records Additional DNS records might be needed for

Sender Policy Framework and Sender ID

Software Requirements for Exchange Server 2013

Exchange Server 2013 can be installed on:

Windows Server 2012 Standard or Datacenter Windows Server 2008 R2 Standard with SP1 Windows Server 2008 R2 Enterprise with SP1 Windows Server 2008 R2 Datacenter RTM or later

Additional components needed:

Microsoft .NET Framework 4.5 Windows Management Framework 3.0 Remote Server Administration Tools for AD DS Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit Microsoft Office 2010 Filter Pack SP1 64-bit Microsoft Office 2013 Filter Pack 64-bit

12/3/2013

Hardware Requirements for Exchange Server 2013

Resource Processor Memory

Requirements
Intel 64-bit architecture AMD64 architecture 8 GB recommended Additional memory required based on server role

and load Disk

1.2 GB free disk space for Exchange Server files 200 MB free on the system drive Additional space for mailbox storage

File System

NTFS file system for all drives

Infrastructure Requirements for Exchange Server 2013

Infrastructure Component Requirements
Schema master must be running Windows

Server 2003 (SP2), Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012
At least one global catalog servers must

be running Windows Server 2003 SP2, Windows Server 2008,Windows Server 2008 R2, or Windows Server 2012, in sites where Exchange is installed Active Directory DNS
Domain and forest functional levels must

be at least Windows Server 2003

Must be configured to enable domain

controller and global-catalog server name resolution

Preparing AD DS for Exchange Server 2013 Deployment

Setup parameter /PrepareAD /OrganizationName: organizationname

Description
Prepares the global Exchange objects Creates the Exchange universal security

groups in the root domain

Prepares the current domain Prepares the schema for the Exchange

/PrepareSchema /PrepareDomain /PrepareDomain domainname /PrepareAllDomains

Server 2013 installation

Prepares the domain where Exchange

Server recipients are located

12/3/2013

Lesson 2: Exchange Server 2013 Deployment

Exchange Server Role Architecture in Exchange Server

2013
Deployment Options for Exchange Server 2013 Exchange Server 2013 Hybrid Deployment with Office 365 Upgrade and Migration Options Deploying Exchange Server 2013 as Virtual Machines Discussion: Implementing Exchange Infrastructure in a

Virtual Environment
How to Install Exchange Server 2013 Using the Setup

Wizard
How to Install Exchange Server 2013 in Unattended Mode Demonstration: Installing Exchange Server 2013 Post-Installation Tasks Troubleshooting Exchange Server Installation

Exchange Server Role Architecture in Exchange Server 2013

Server roles in Exchange Server 2013:

Client Access Server Mailbox Server

Client Access Server provides:

Client authentication Redirection and proxy services Support for client protocols (HTTP, POP, IMAP, SMTP)

Mailbox Server provides:

Mailbox and public-folder database Transport services Unified Messaging

Client connectivity is only established using RPC over HTTPS

Deployment Options for Exchange Server 2013

Exchange Server 2013 versions: Standard (allows creating up to 5 mailbox databases) Enterprise (allows creating up to 50 mailbox databases) Exchange Server CAL: Standard Enterprise Deployment scenarios: Single-server deployment Multiple-server deployment Hybrid deployment

12/3/2013

Exchange Server 2013 Hybrid Deployment with Office 365

Hybrid Exchange Deployment provides following features:

Mail routing with a shared domain namespace Unified GAL Free/busy and calendar sharing Centralized control of mail flow A single Outlook Web App URL Ability to move existing mailboxes to the cloud Centralized mailbox management Cloud-based message archiving

Additional components needed for hybrid deployment:

Microsoft Federation Gateway Active Directory synchronization

Upgrade and Migration Options

Exchange Version Exchange Server 2003 and earlier versions Exchange 2007 Exchange 2010

Exchange Organization Coexistence Not supported Supported Supported

Deploying Exchange Server 2013 as Virtual Machines

You can deploy all Exchange Server roles on virtual

machines running on a supported virtualization platform

Do not use snapshots with Exchange virtual machines You can combine high-availability features for Mailbox

Servers in Exchange Server 2013 with highly available virtual machines

Design virtual hardware by using the same criteria

that you use for your physical hardware

12/3/2013

How to Install Exchange Server 2013 Using the Setup Wizard Installation steps in the Exchange Server setup wizard include:
1. 2. 3. 4. 5. 6. 7. 8.

Check for Updates License Agreement Recommended Settings Server Role Selection Installation Space and Location Exchange Organization Malware Protection Settings Readiness Checks

How to Install Exchange Server 2013 in Unattended Mode

Syntax for unattended installation:
Setup.exe [/Mode:<setup mode>] [/IAcceptExchangeServerLicenseTerms] [/Roles:<server roles to install>] [/InstallWindowsComponents] [/OrganizationName:<name for the new Exchange organization>] [/TargetDir:<target directory>] [/SourceDir:<source directory>] [/UpdatesDir:<directory from which to install updates>] [/DomainController:<FQDN of domain controller>] [/AnswerFile:<filename>] [/DoNotStartTransport] [/LegacyRoutingServer] [/EnableErrorReporting] [/NoSelfSignedCertificates] [/AddUmLanguagePack:<UM language pack name>] [/RemoveUmLanguagePack:<UM language pack name>] [/NewProvisionedServer:<server>] [/RemoveProvisionedServer:<server>] [/ExternalCASServerDomain:<domain>] [/MdbName:<mailbox database name>] [/DbFilePath:<Edb file path>] [/LogFolderPath:<log folder path>] [/Upgrade]

Post-Installation Tasks
Verify services functionality Secure your Exchange Server:

Restrict physical access Restrict communication Reduce the attack surface Restrict permissions

Install and configure additional software (optional):

Antivirus software Anti-spam software Backup software Monitoring tools and agents

12/3/2013

Lesson 3: Managing Exchange Server 2013

Managing Exchange Server 2013 What Is EAC? Managing User Mailbox Properties with Outlook

Web App
What Is Windows PowerShell? Windows PowerShell Syntax Accessing Help in Windows PowerShell What Is Exchange Management Shell? Exchange Management Shell Administration

Examples
Demonstration: Using Exchange Administration

Tools to Manage Exchange

Managing Exchange Server 2013 Methods for Exchange Server 2013 management:
Exchange Administration Center Outlook Web App options Exchange Management Shell

What Is EAC?

12/3/2013

Managing User Mailbox Properties with Outlook Web App

Users can manage the following features by using

Outlook Web App:

Outlook Web App settings Manage inbox rules Message tracking Manage site mailboxes Manage mobile devices Manage text messaging Group memberships Recover deleted messages Block and allow lists Change their password Manage apps

What Is Exchange Management Shell?

Exchange Management Shell is a command-line interface

for administering Exchange Server 2013

Exchange Management Shell includes the following

features:

Provides more than several hundred cmdlets for Exchange Server 2013 administration Offers an extensible scripting engine Applies RBAC permissions

Exchange Management Shell Administration Examples

Enable-Mailbox -Identity adatum\Bart New-MailboxExportRequest -Mailbox Bart FilePath \\LON-EX1

\PSTFileShare\Bart_Mailbox.pst
Get-MailboxStatistics -Database MailboxDatabase New-MailboxDatabase -Name MailboxDatabase -Server LON-Ex1 Get-ExchangeServer -Status | Format-List New-DynamicDistributionGroup -Name DDG -Alias DDGAlias -

OrganizationalUnit OU -IncludedRecipients MailboxUsers

New-MoveRequest -Identity 'user1'-TargetDatabase Executives

12/3/2013

Microsoft Official Course

Module 2

Planning and Configuring Mailbox Servers

Module Overview
Overview of the Mailbox Server Role Planning the Mailbox Server Deployment Configuring the Mailbox Servers

Lesson 1: Overview of the Mailbox Server Role

The Mailbox Server Role in Exchange Server 2013 How the Mailbox Server Role Interacts with Clients

and the Client Access Server

The Mailbox Store in Exchange Server 2013 Database Log File Considerations How Are Mailbox Databases Updated? Storage Options for the Exchange Server 2013

Mailbox Server Role

Importing and Exporting Data from a Mailbox

Database
Demonstration: Importing Data to a Users

Mailbox

12/3/2013

The Mailbox Server Role in Exchange Server 2013

In Exchange Server 2013, the Mailbox Server role provides:

Hosting for mailbox databases Hosting for public folders Transport and message routing services:

Hub Transport service Mailbox Transport services

Unified Messaging service High-availability services

Mailbox Server role features enhancements such as:

Improved transaction logs for DAGs Enhanced site resiliency

How the Mailbox Server Role Interacts with Clients and the Client Access Server
The Hub Transport service on the Mailbox server communicates with the Transport service on the Client Access server

The Mailbox Store in Exchange Server 2013

Mailbox stores in Exchange Server 2013 consist of

following files:

Mailbox database (.edb file) Transaction log (.log file) Checkpoint file (.chk) Temporary file (Tmp.edb) Reserve log files (E##res0001.jrs - E##res000A.log per database, where ## is the log prefix)

Administrators rarely directly interact with these

files, except during backup and restore procedures

10

12/3/2013

Database Log File Considerations

Each change performed in a mailbox database must be

logged in the transaction log file before it is committed to the database

Each transaction log file is 1 MB in size Transaction log files are not deleted automatically

Circular logging can be used, but it is not recommended

Follow these guidelines for log files:

Regularly perform Exchange Server backups Move transaction logs to a dedicated drive (does not apply if you are using DAGs) Place transaction log files on a redundant disk array Ensure enough free disk space is available on the log disk Do not use compression on the volume with the logs

Storage Options for the Exchange Server 2013 Mailbox Server Role
Disk storage options: DAS

SAN

RAID options: RAID 0 Striping

RAID 1 Mirroring RAID 5 Striping with parity RAID 0+1 Mirrored striped sets RAID 6 Striping with double parity RAID 1+0 or RAID 10 Mirrored sets in a striped set JBOD

Importing and Exporting Data from a Mailbox Database

Exchange Server 2013 allows you to export a users

mailbox data to a .pst file or import data to a users mailbox from a .pst file
Use the following cmdlets to import or export data: New-MailboxImportRequest

New-MailboxExportRequest

Mailbox Import Export roles must be assigned to

the user that performs the operation

PST files can be located on shares

11

12/3/2013

Lesson 2: Planning the Mailbox Server Deployment

Planning Hardware for the Mailbox Server Role Planning Storage for the Mailbox Server Role Database Design for Mailbox Databases Planning Mailbox Servers for High Availability Virtualizing Mailbox Server Considerations Considerations for Planning Mailbox Databases What Is an Exchange Mailbox Server Role

Requirements Calculator?
Demonstration: Using the Exchange Mailbox

Server Role Requirements Calculator

Verifying Mailbox Server Role Performance

Planning Hardware for the Mailbox Server Role When planning hardware for Exchange Server 2013, consider the following:
CPU: Must be 64-bit

Multicore recommended One core per 1,000 active mailboxes

Memory: Minimum 8 GB per Mailbox server

3 MB per mailbox per 50 messages/day

Planning Storage for the Mailbox Server Role

Consider the following when planning for Exchange Server

2013 storage:

Replicated database copies increase the amount of storage required Slower disks have a lower cost per GB than faster disks DAS is significantly less expensive than a SAN JBOD can be considered when there are three or more replicas of a database There are typically fewer database copies when a SAN is used Use RAID to increase redundancy Use the Exchange Server Mailbox Server Role Requirements Calculator

12

12/3/2013

Database Design for Mailbox Databases When designing databases, you should consider:

Use split log files and database storage to enhance recoverability when replication is not used Allocate space for indexes Allocate space for single-item recovery Allocate space for personal archives Allocate space for a recovery database

Planning Mailbox Servers for High Availability

You can implement high availability for Mailbox servers by

using DAGs
Consider the following when planning DAGs:

Mailbox database names must be unique in the organization Storage paths must be identical for all copies of a database DAGs require the failover clustering feature in Windows Server DAGs can be managed completely with Exchange Server 2013 tools DAGs can also protect public folders

Virtualizing Mailbox Server Considerations

Both Exchange Server 2013 server roles can be virtualized When implementing Exchange Server 2013 on the virtual machine,

consider the following:

Exchange Server 2010 has the same hardware requirements in a virtualized environment Do not use dynamic memory Limit virtual processor allocation to a ratio of 2:1 Do not dynamically expand virtual disks Do not use differencing or snapshots Test virtual disk performance Use pass-through and iSCSI storage if desired

You can combine virtual machine high-availability methods with

Exchange Server 2013 high-availability methods

13

12/3/2013

Considerations for Planning Mailbox Databases

When planning mailbox databases, first determine

whether you will deploy standalone mailbox servers or DAGs

Based on this choice, you determine:

Backup policies Mailbox database size Database and transaction log locations Storage solutions

What Is an Exchange Mailbox Server Role Requirements Calculator?

Exchange Mailbox Server Role Requirements Calculator is a

free tool from Microsoft that helps you design your Mailbox server deployment
User inputs are made in the following categories:

User profile High-availability architecture Server's CPU platform Storage architecture Backup architecture Network architecture

It provides very detailed information about requirements for

mailbox servers

Lesson 3: Configuring the Mailbox Servers

Initial Mailbox Server Configuration Tasks Configuring iSCSI Storage in Windows Server 2012 Demonstration: Configuring iSCSI Storage for the

Mailbox Server Role Creating and Managing Mailbox Databases Demonstration: Creating and Managing Mailbox Databases

14

12/3/2013

Configuring iSCSI Storage in Windows Server 2012

iSCSI is a protocol that supports access to remote,

SCSI-based storage devices over a TCP/IP network

iSCSI SAN deployments include:

IP network iSCSI targets iSCSI initiators iSCSI Qualified Name (IQN)

iSCSI Target Servers in Windows Server 2012 include:

Network/diskless boot Server application storage Heterogeneous storage Lab environments

Creating and Managing Mailbox Databases

You can create and manage mailbox databases by using the

Exchange Administration Center or Exchange Management Shell The Exchange Administration Center is used for basic management The Exchange Management Shell is used for advanced mailbox database management
You cannot use the Exchange Administration Center to move

mailbox databases
Useful Exchange Management Shell cmdlets include:

New-MailboxDatabase Get-MailboxDatabase Set-MailboxDatabase Move-DatabasePath

Lab: Configuring Mailbox Servers

Exercise 1: Planning Configuration for Mailbox

Servers
Exercise 2: Configure Storage on the Mailbox

Servers
Exercise 3: Creating and Configuring Mailbox

Databases
Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1 20341B-LON-CL1 Adatum\Administrator Pa$$w0rd

User name Password

Estimated Time: 60 minutes

15

12/3/2013

Microsoft Official Course

Module 3

Managing Recipient Objects

Module Overview
Managing Exchange Server 2013 Mailboxes Managing Other Exchange Recipients Planning and Implementing Public Folder

Mailboxes
Managing Address Lists and Policies

Lesson 1: Managing Exchange Server 2013 Mailboxes

Types of Exchange Server Recipients Managing Mailboxes Demonstration: Creating and Configuring

Mailboxes
Demonstration: Moving Mailboxes What Are Resource Mailboxes? Demonstration: Creating and Managing Resource

Mailboxes
What Are Site Mailboxes? What Is a Shared Mailbox? Demonstration: Creating a Shared Mailbox What Are Linked Mailboxes?

16

12/3/2013

Types of Exchange Server Recipients Exchange Server recipients include:

User mailboxes Mail contacts Mail users Resource mailboxes Shared mailboxes Mail-enabled security and distribution groups Dynamic distribution groups Linked mailboxes Remote mailboxes Site mailboxes

What Are Resource Mailboxes?

Mailboxes that represent meeting rooms or shared

equipment, and that you can include as resources in meeting requests

To create a resource mailbox: Create a new mailbox as a room or equipment mailbox

Configure the resource properties

Configure how the resource mailbox will accept

meeting requests

What Are Site Mailboxes?

Compliance Clients

Owners Members

Site Mailbox

Outlook SharePoint

Membership Shared Storage

Management

Owners Members Exchange Site Mailbox SharePoint Site

Provisioning Lifecycle

17

12/3/2013

What Is a Shared Mailbox?

Shared mailboxes are used to provide multiple

users access to a common mailbox

Shared mailboxes can be created in a single step

in the EAC or Exchange Management Shell

Users can be granted Full Access and Send As

permissions

What Are Linked Mailboxes?

Provide mailboxes for users in separate, trusted

forests
Mailboxes can be used in: Resource forest scenarios Merger and acquisition scenarios Requirements: The domain where Exchange Server is deployed must trust the user account domain The user account must exist in the user account domain A two-way trust is recommended to simplify

administration

Lesson 2: Managing Other Exchange Recipients

What Are Distribution Groups? Demonstration: Creating and Configuring

Distribution Groups
Implementing Self-Service Distribution Group

Management
Demonstration: Configuring Self-Service

Distribution Group Management

Managing Mail Contacts and Mail Users

18

12/3/2013

What Are Distribution Groups?

Distribution groups are mail-enabled groups that appear in

the GAL
Distribution groups are used to:

Send messages to multiple users at one time Assign permissions to Exchange objects

Distribution groups can be:

Mail-enabled universal security groups Mail-enabled universal distribution groups

Dynamic distribution groups are mail-enabled groups in

which the membership list is calculated based on user attributes when a message is sent to the group

Implementing Self-Service Distribution Group Management

To enable group self-service: Assign non-Exchange administrators as distribution group owners

Enable open distribution group memberships Enable users to create and manage their own distribution groups

Use group naming policies to manage the

distribution group names

Managing Mail Contacts and Mail Users

Mail contacts: Mail-enabled AD DS contacts

Listed in the GAL Provide email addresses for users or groups that exist outside the Exchange organization

Mail users: Similar to mail contacts, but mail users have AD DS security identifiers

Can access resources in the local domain, but email is sent to external messaging systems

19

12/3/2013

Lesson 3: Planning and Implementing Public Folder Mailboxes

Using Public Folders in Exchange Server 2013 Managing Public Folders Demonstration: Creating and Configuring Public

Folders
Migrating Public Folders to Exchange Server 2013 Considerations for Implementing Public Folders

Using Public Folders in Exchange Server 2013 In Exchange Server 2013:

Public folders are stored in public folder mailboxes Public folder mailboxes are stored in regular mailbox databases

Can be placed in mailbox databases that are in a DAG

Public folder content can be spread across multiple public folder mailboxes Can be added as Favorites in Outlook Web App in Exchange Server 2013 CU1 The primary public folder mailbox contains the only writeable copy of the public folder hierarchy

Managing Public Folders Public folder management includes:

Configuring public folder permissions Mail-enabling public folders Managing quota and retention settings Monitoring public folders

20

12/3/2013

Migrating Public Folders to Exchange Server 2013

1. Prepare the environment for the migration 2. Prepare the public folder mapping file 3. Create the public folder mailboxes on the

Exchange 2013 server

4. Start the migration request 5. Lock down the public folders on the previous

version of Exchange Server

6. Finalize the public folder migration

Considerations for Implementing Public Folders

Plan the geographic distribution of public folder

contents and mailboxes

Plan for public folder mailbox size limits Note that user access to public folders has not

changed significantly
Place the primary hierarchy public folder mailbox

in a mailbox database in a DAG

Lesson 4: Managing Address Lists and Policies

What Are Address Lists? Demonstration: Configuring Address Lists Configuring Offline Address Books What Are Address Book Policies? Demonstration: Configuring Address Book Policies What Are Email Address Policies? Demonstration: Configuring Email Address Policies

21

12/3/2013

What Are Address Lists?

Recipient objects that are grouped together based

on an LDAP query for specific AD DS attributes

Address lists can simplify the process of locating

recipients in the GAL

Default address lists include: All Contacts All Groups All Rooms All Users Public Folders Default Global Address List

Configuring Offline Address Books

The offline address book is cached on the local

client so that users can search the GAL when disconnected from Exchange Server
The default offline address book contains the

entire GAL

Can configure custom offline address books that contain smaller address lists

The offline address book: Is generated on the Mailbox server that hosts the Organization mailbox Is distributed through web services using the OAB virtual directory

What Are Address Book Policies?

Company scenario: organization the GAL
Address Book Policy Assignment Division1 ABP Address Lists Div1 Users

Div1 DLs Company has two divisions in the same Exchange

Div1 Contacts

Div1 OAB Users should see only other users in their division in Default Address List Div1 GAL Room Address List Div1 Room AL

Address Book Policy A

Offline Address Book

User

Address Lists

Effective Filter = Div1 GAL

Offline Address Books Div1 OAB +Div1 Users +Div1 Contacts + Div2 Users Div2 OAB +Div1 Users + Div1 DLs +Div2 DLs + Div 2 Contacts + Div1 GAL Global Address Lists Room Address Lists

Div1 GAL

Div1 Users

Div1 DLs

Div1 Contacts

Div1 OAB

Div1 Room AL

Div2 GAL

Div2 Users

Div2 Room AL

Div2 DLs

Div2 Contacts

Div2 OAB

22

12/3/2013

Demonstration: Configuring Address Book Policies In this demonstration, you will see how to: Configure a GAL Configure an offline address list Configure an address book policy

What Are Email Address Policies?

Email address policies automate the process of

assigning email addresses to recipients

Email address policies define the format for the

email address

Can assign SMTP and non-SMTP addresses Can configure both the local and domain components

Email address policies define the recipients to

whom the policy applies

Can filter based on recipient scopes and custom attributes

Lab: Managing Recipient Objects

Exercise 1: Configure Trey Research Recipients Exercise 2: Configure Address Lists and Policies for

Trey Research
Exercise 3: Configure Public Folders for Trey

Research
Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1 20341B-LON-CL1 Adatum\Administrator Pa$$w0rd

User name Password

Estimated Time: 60 minutes

23

12/3/2013

Microsoft Official Course

Module 4

Planning and Deploying Client Access Servers

Module Overview
Planning Client Access Server Deployment Configuring the Client Access Server Role Managing Client Access Services

Lesson 1: Planning Client Access Server Deployment

What Is the Client Access Server Role? Hardware and Software Requirements for the

Client Access Server

Planning Client Access Server Deployment How Does a Client Access Server Work? Connecting Outlook Clients to Mailboxes How Does a Client Access Server Work with

Multiple Sites?
Planning Client Connectivity for Client Access

Server

24

12/3/2013

What Is the Client Access Server Role?

Client Access server role handles client

connections and server SMTP-based connections

Clients do not communicate with Mailbox server

directly
Connections are routed through Client Access

server
Client Access server does not store any user data Client Access server provides services for

messaging security through Front End Transport service

Hardware and Software Requirements for the Client Access Server

General hardware and software requirements for

Exchange Server 2013 apply to Client Access server Client Access server needs to have reliable disks Make sure that operating system volume is redundant Provide more than one Client Access server if possible Client Access server requires a fast network connection to Mailbox servers and global catalog servers

Planning Client Access Server Deployment

Client Access server: Must be deployed in each AD DS site that has Mailbox servers Must have a fast connection to Mailbox servers and domain controllers Needs to be accessible from the Internet using the client protocol in Internet-facing sites You deploy Client Access server: On a single server with other Exchange Server roles On a dedicated server to provide scalability On multiple dedicated servers in NLB cluster

25

12/3/2013

How Does a Client Access Server Work?

Outlook Web App

EAS

PowerShell EAC

POP/IMAP SMTP

Outlook SIP

Firewall SIP + RTP Client Access IIS HTTP Proxy

HTTP Redirect

POP, IMAP

SMTP

UM

POP, IMAP

SMTP

IIS RPS

IIS
RpcProxy

Mailbox

RPC

MDB

OWA, EAS, EWS, ECP , OAB

POP, IMAP

Transport

UM

MailQ

Connecting Outlook Clients to Mailboxes

Exchange Server 2013 no longer uses FQDNs of

Client Access servers or arrays to locate user mailboxes Client Access server uses the GUID that is assigned to the user mailbox The connection point is the string that is a unique identifier of the mailbox Connection point contains the mailbox GUID and domain name

How Does a Client Access Server Work with Multiple Sites?

In a pure Exchange 2013 environment, Client

Access server will always proxy the client connection to the right Mailbox server In a mixed Exchange environment, Client Access server 2013 will proxy the connection to the Client Access Server 2007 or 2010 in the destination site POP3 and IMAP4 clients must connect directly to the Client Access server in their destination site

26

12/3/2013

Planning Client Connectivity for Client Access Server

Officially supported client platforms: Outlook 2013 Outlook 2010 SP1 with April 2012 Cumulative Update Outlook 2007 SP3 with July 2012 Cumulative Update Entourage 2008 for Mac, Web Services Edition Outlook for Mac 2011 You can also connect from various POP3 and

IMAP4 clients, and ActiveSync devices

Lesson 2: Configuring the Client Access Server Role

Configuring Client Access Server Options Configuring Namespaces on a Client Access Server Configuring Certificates on the Client Access

Server
Demonstration: Creating a Certificate Request on

a Client Access Server

Securing a Client Access Server Configuring the Client Access Server for Internet

Access
Configuring POP3 and IMAP4 Client Access

Configuring Client Access Server Options

On a Client Access server, you can configure the

following groups of options:

Virtual Directory settings Certificates Mobile device settings Mail flow Antimalware protection Outlook Anywhere options

27

12/3/2013

Securing a Client Access Server

To secure a Client Access server: Install server certificates, and ensure that SSL is required Configure authentication settings:

Integrated Windows authentication Digest authentication Basic authentication Forms-based authentication

Protect the server with an application layer firewall

Configuring the Client Access Server for Internet Access

To enable Internet access to Client Access services: Configure external URLs Configure the external DNS names Configure access to Client Access virtual directories Implement SSL certificates with multiple subject alternative names Plan for Client Access server access with multiple sites

Lesson 3: Managing Client Access Services

Services Provided by the Client Access Server What Is Autodiscover? Configuring and Managing Autodiscover What Is the Availability Service? What Are MailTips? Demonstration: Configuring MailTips

28

12/3/2013

Services Provided by the Client Access Server

Services provided by Client Access server role: Autodiscover Availability MailTips Offline Address Book download Exchange Administration Center Exchange Web Services Outlook Anywhere

What Is Autodiscover? Autodiscover provides information that you can use to configure Outlook 2007 and newer client profiles Autodiscover process:
1. 2. 3. 4. 5. 6. 7.

Client Access Server registers the SCP Client uses LDAP query to AD DS to locate appropriate SCP Based on information in SCP, client locates the Autodiscover service on Client Access Server Client provides its SMTP address to the Autodiscover service and asks for appropriate configuration information The Client Access server responds by returning an XML file Outlook downloads the required configuration information from the Autodiscover service Outlook connects to the Exchange Server

What Is the Availability Service? The availability Service on Client Access server provides following:
Retrieve live free/busy information for mailboxes in local or other Exchange organizations View the working hours of attendees Show meeting time suggestions

Only Outlook 2007 or newer and Outlook Web App

use the Availability service

The Availability service is deployed by default on all

Client Access servers

The service does not need any configuration by

default

29

12/3/2013

What Are MailTips?

MailTips provide information about a message

delivery before the message is sent

The Exchange Server 2013 provides: Default MailTips Custom MailTips The Client Access server provides the MailTips to

the client

Lab: Deploying and Configuring a Client Access Server Role

Exercise 1: Configuring Certificates for the Client

Access Server
Exercise 2: Configuring Client Access Services

Options
Exercise 3: Configuring Custom MailTips
Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1

User Name Password

Adatum\Administrator Pa$$w0rd

Estimated time: 50 minutes

Microsoft Official Course

Module 5

Planning and Configuring Messaging Client Connectivity

30

12/3/2013

Module Overview
Client Connectivity to the Client Access Server Configuring Outlook Web App Planning and Configuring Mobile Messaging Configuring Secure Internet Access for Client

Access Server

Lesson 1: Client Connectivity to the Client Access Server

What Is Outlook Web App? What Is Outlook Anywhere? What Is Exchange ActiveSync? What Is Outlook Web App Light? Connecting Non-Outlook Clients to the Client

Access Server

What Is Outlook Web App?

Outlook Web App allows users to access their

mailboxes through a Web browser

Outlook Web App provides: Web-based access to all Exchange mailbox components Secure HTTPS access from the Internet An alternative to deploying a messaging client Access to Exchange Server 2013 features that are not available in earlier versions of Outlook

31

12/3/2013

What Is Outlook Anywhere?

Outlook Anywhere enables RPC connections over

HTTPS to an Exchange Server 2013 Client Access server

Outlook 2007 or Newer Client

Global Catalog Servers

LDAP

HTTPS

Mailbox Server Client Access Server HTTPS Outlook 2007 or Newer Client

What Is Exchange ActiveSync?

Exchange Active Sync is a protocol that enables

mobile devices to access Exchange Server data

It provides synchronization and management

capabilities for mobile platforms

It is supported on most current mobile platforms

with various level of functionality

Uses HTTPS to connect to Exchange Server

What Is Outlook Web App Light?

Outlook Web App Light is an application within

Outlook Web App that works with older browsers

Outlook Web App Light provides: Connectivity to user mailbox from mobile browsers Subset of functionalities of Outlook Web App Secure authentication

32

12/3/2013

Connecting Non-Outlook Clients to the Client Access Server

Non-Outlook clients can connect to Exchange

Server by using:

POP3 protocol IMAP4 protocol

Consider using Outlook WebApp as an alternative

for a locally installed email client

Consider using the Windows 8 built-in Mail

application that connects to Exchange by using ActiveSync

Lesson 2: Configuring Outlook Web App

Configuring Options for Outlook Web App What Is Outlook Web App Policy? Demonstration: Configuring Outlook Web App

Options and Policy

Integrated Applications in Outlook Web App Demonstration: Using Apps in Outlook Web App What Is Office Web Apps Server Integration? Using Outlook Web App in Offline Mode Demonstration: Enabling and Using Outlook Web

App in Offline Mode

Configuring Options for Outlook Web App

When using Exchange Admin Center, you can

configure following OWA settings:

Server certificate Internal and external URL Authentication options Available features File Access settings

For a full set of OWA options, you should use

Exchange Management Shell

33

12/3/2013

What Is Outlook Web App Policy? Outlook Web App policy allows you to configure a set of Outlook Web App related options and assign them to one or more mailboxes In Outlook Web App policy, you can configure following:
Policy name Communication management options Information management options Security options User experience options Time management Direct file access and web ready document viewing Offline access

Integrated Applications in Outlook Web App

Integrated Apps in OWA enhance user experience

by suggesting tasks based on messages content

Preinstalled applications are: Bing Maps Action Items Suggested Apointments Unsubscribe You can add apps from the Office Store, a URL or

from a file

What Is Office Web Apps Server Integration?

Office Web Apps Server integration provides

an enhanced user experience when handling office-based email attachments

Office Web Apps are used to render documents Users can modify documents online Office Web Apps integrate in Outlook Web App

interface
Usage is available to users of Exchange Online or

Exchange installed on-premises

Office Web Apps server is required

34

12/3/2013

Using Outlook Web App in Offline Mode

Offline Outlook Web App provides users with the

ability to access data in their mailboxes even when not connected to Exchange Server
Offline Outlook Web App: Works only with selected browsers Caches part of the mailbox content Allows users to perform selected tasks Is enabled on per-computer basis Can be controlled by using OWA policies

Lesson 3: Planning and Configuring Mobile Messaging

Discussion: Using Mobile Devices in Business Environments How Exchange ActiveSync Works Supported Features in Exchange ActiveSync What Is Direct Push? What Is Remote Wipe? What Is Mobile Device Quarantine? Securing Mobile Devices with Mobile Device Mailbox

Policies
Demonstration: Reviewing Options for Mobile Device

Management in the Exchange Server Administration Center Alternatives for Mobile Device Management

How Exchange ActiveSync Works

ActiveSync enables users to synchronize data from

Exchange to the mobile device

It uses HTTPS to connect to Client Access server Autodiscover is used to configure settings on the

device
You can selectively sync data to the mobile device Synchronized data stay on the mobile device even

when offline

35

12/3/2013

Supported Features in Exchange ActiveSync

Some of the features implemented in Exchange

Server 2013 ActiveSync are:

Support for HTML-formatted messages Conversation grouping of email messages Ability to synchronize or not sync conversation Support for fast message retrieval Enhanced Exchange Search Autodiscover for over-the-air provisioning Direct Push Support for availability information GAL photos Information Rights Management

What Is Direct Push?

DirectPush: Is an ActiveSync protocol feature that keeps the mailbox content on your device up to date Works over data or Wi-Fi connection Notifies mobile device whenever change in mailbox happens Uses TCP port 443 Time-out values on firewall should be modified

What Is Remote Wipe?

Remote Wipe allows you to remotely delete all

data on your mobile device in case it is lost or stolen

Remote Wipe: Can be issued by device owner or administrator Can delete all data from an internal and removable memory Can be issued from Outlook Web App, EAC or Exchange Management Shell Requires connection to Exchange Server

36

12/3/2013

What Is Mobile Device Quarantine?

Each mobile device that connects to Exchange has

its access state defined

Access state for mobile device can be: Allowed Blocked Quarantined You can define rules for device access based on

the device family and device type

Securing Mobile Devices with Mobile Device Mailbox Policies

Mobile Device Mailbox Policy allows you to

enforce security settings for mobile devices on a per user basis

In Mobile Device Mailbox Policy you can

configure:
Device password requirements Encryption requirements Local wipe options Device inactivity settings Password lifecycle settings

Lesson 4: Configuring Secure Internet Access for Client Access Server

Exchange Server Security Guidelines Secure Internet Access Components Deploying Exchange Server 2013 for Internet

Access Securing Client Access Traffic from the Internet Securing SMTP Connections from the Internet Benefits of Using A Reverse Proxy

37

12/3/2013

Deploying Exchange Server 2013 for Internet Access

Firewall Client Edge Transport Server or SMTP Gateway Firewall or Reverse Proxy

Client Access Server

Protocol HTTP POP3 IMAP4 SMTP

Unsecure Port 80 110 143 25

TLS/SSL Port 443 995 993 25 587

Mailbox Server Domain Controller

SMTP client 587 submission

Securing Client Access Traffic from the Internet To provide secure CA from the Internet: Create and configure a server certificate Require SSL for all virtual directories Enable only required client access methods Require secure authentication Enforce remote client security Require TLS/SSL for IMAP4 and POP3 access Implement an application layer firewall or reverse proxy

Securing SMTP Connections from the Internet

SMTP connections from the Internet are used for

remote SMTP servers, and may be required for IMAP4 or POP3 clients
To secure the SMTP connections: Enable TLS/SSL for SMTP client connections Use the Client Receive Connector (Port 587) Ensure that anonymous relay is disabled Enable IMAP4 and POP3 selectively

38

12/3/2013

Benefits of Using A Reverse Proxy

Reverse proxy provides: Security: Internet client connections are terminated on the reverse proxy

Application-layer filtering: Inspect the contents of network traffic SSL bridging: All connections to the reverse proxy and to the Client Access server are encrypted Load balancing: Arrays of reverse proxy servers can distribute network traffic for a single URL SSL offloading: SSL requests can be terminated on the reverse proxy

Lab: Planning and Configuring Messaging Client Connectivity Exercise 1: Planning Client Connectivity Exercise 2: Configuring Outlook Web App and Outlook Anywhere Exercise 3: Configuring Exchange ActiveSync Exercise 4: Publishing Exchange Server 2013 Through TMG 2010
Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1 20341B-LON-TMG 20341B-LON-CL1 Adatum\Administrator Pa$$w0rd

User Name Password

Estimated time: 75 minutes

Microsoft Official Course

Module 6

Planning and Implementing High Availability

39

12/3/2013

Module Overview
High Availability on Exchange Server 2013 Configuring Highly Available Mailbox Databases Configuring Highly Available Client Access Servers

Lesson 1: High Availability on Exchange Server 2013

Components of High Availability What Is a Database Availability Group? Understanding How Database Availability Groups Work Understanding How High Availability Works with Client

Access Servers
Understanding How Transport High Availability Works Understanding How High Availability Works with Edge

Transport Servers
What Is Site Resilience? Discussion: Virtualization High-Availability Technologies

versus Exchange High-Availability Technologies for Mailbox Servers

Components of High Availability

All parts of the application and infrastructure it

relies on must be highly available

Data center infrastructure Server hardware Storage Network infrastructure Internet Network services

40

12/3/2013

What Is a Database Availability Group?

A DAG is a collection of servers that provides the

infrastructure for replicating and activating database copies. DAGs:

Require the failover clustering feature, although all installation and configuration is done with the Exchange Server management tools Use Active Manager to control failover Use an enhanced version of the continuous replication technology that Exchange Server 2007 introduced Can be created after the Mailbox server is installed Allow a single database to be activated on another server in the group without affecting other databases Allow up to 16 copies of a single database on separate servers Define the boundary for replication

Understanding How Database Availability Groups Work Continuous replication protects databases across servers in the DAG
MBX1 MBX2 MBX3

DB1

DB2

DB1

DB2

DB3

DB2

DB3

DB3

Understanding How High Availability Works with Client Access Servers

You make Client Access servers highly available with

multiple Client Access servers and by configuring load balancing You can achieve high availability and load balancing by using:

DNS round-robin Network Load Balancing Hardware-based load balancing

41

12/3/2013

Understanding How Transport High Availability Works

SMTP Server MBX01 MBX02 (Shadow Server)

Active Queue Shadow Queue

Primary Queue

Transport Service

Shadow Safety Net

Mailbox Transport Service Transport Service Mailbox Database

Understanding How High Availability Works with Edge Transport Servers

Edge Transport Server 1 Edge Transport Server 2

Edge Transport Server

Mailbox Server Site A

Mailbox Server Site B

What Is Site Resilience?

Site resilience is the ability of the messaging

system to survive the failure of a site

An alternate data center can be located at another company location that has sufficient capacity A DAG can span Active Directory sites Other roles and services must already exist in the site

42

12/3/2013

Lesson 2: Configuring Highly Available Mailbox Databases

What Is a Quorum? Planning Software and Hardware Components for

Database Availability Groups

What Is Active Manager? What Is Continuous Replication? Configuring a Database Availability Group Configuring Databases for High Availability What Are Lagged Mailbox Database Copies? Demonstration: How to Create and Configure a Database

Availability Group
Understanding the Failover Process Planning, Monitoring, and Managing a Database

Availability Group
Demonstration: How to Monitor Replication Health

What Is a Quorum?
A quorum uses a consensus of voters to ensure that

enough cluster members are available to provide services

Exchange Server 2013 DAG quorums: Are based on votes in Windows Server 2012 Allow nodes, file shares, and shared disks to have votes, depending on the quorum mode Use node majority with a witness server for quorum:

DAGs with an even number of Mailbox servers use the witness server DAGs with an odd number of Mailbox servers use node majority

You can have non-voting nodes, if needed

Planning Software and Hardware Components for Database Availability Groups

General configuration Nodes in the same domain

Not domain controllers

Windows Server 2012 Datacenter, or Windows

Server 2008 R2 Datacenter or Enterprise

Network configuration Two adapters

Less than 250 ms latency

DAG must have one IP on the MAPI network Witness server

43

12/3/2013

What Is Active Manager? Active Manager:

Runs a process on each server in the DAG

The PAM is one node The remaining nodes are SAM

Manages which database copies are active and which are passive Stores database state information Manages database switchover and failover processes Does not require direct administration configuration

Configuring a Database Availability Group

To configure DAGs, you must define the following:

Witness Server server used to store witness information Witness Directory directory used on the witness server to store witness information Database availability group IP addresses IP address(es) used by a DAG

Also consider these settings for larger or multi-site

implementations:

DAG networks including replication DAG network compression DAG network encryption Third-party replication mode Alternative witness server Alternative Witness Directory

Configuring Databases for High Availability

After creating a DAG, adding Mailbox servers to

the DAG, and configuring the DAG, you must still complete the following steps:

Create database copies Set activation preference number Set replay lag time Set truncation lag time

44

12/3/2013

What Are Lagged Mailbox Database Copies?

A lagged database copy is a database that uses a

delayed replay lag time to commit the log files to the database
You create a lagged database to prevent:

Database Logical Corruption Store Logical Corruption Rogue Admin Protection

Lagged database copy enhancements in

Exchange Server 2013:

Automatic log play down Simpler activation with Safety Net Lagged copies can now be configured in EAC

Understanding the Failover Process

If a failure occurs, the following steps occur for the failed

database:

Active Manager determines the best copy to activate The replication service on the target server attempts to copy missing log files from the best source:

If successful, the database mounts with zero data loss If unsuccessful (failover), the database mounts based on the AutoDatabaseMountDial setting

The mounted database generates new log files (using the same log generation sequence) Safety Net requests are initiated for the mounted database to recover lost messages When the original server or database recovers, it determines if any logs are missing or corrupt, and fixes them if possible

Planning, Monitoring, and Managing a Database Availability Group

Allocate the necessary permissions for managing

a DAG

Organization Management DAGs Database copies

Failure may not be noticed Exchange Server 2013 includes several scripts and

commands for DAG monitoring and management

Consider using System Center Operations

Manager 2012

45

12/3/2013

Lesson 3: Configuring Highly Available Client Access Servers

Planning Software and Hardware Components for

Highly Available Client Access Servers

What Is Network Load Balancing? Considerations for Implementing Highly Available

Client Access Servers Demonstration: Configuring Options for Highly Available Client Access Servers

Planning Software and Hardware Components for Highly Available Client Access Servers
Client Access servers used by all clients Implement load balancing for Client Access

servers
Sites performing a proxy are most important Same SSL certificate is used on all nodes Consider redundant Internet connections for

external users

Considerations for Implementing Highly Available Client Access Servers

When implementing highly available Client Access

servers, consider the following:

All Client Access servers should have a certificate to match their address space All Client Access servers should have the same protocols enabled Use a hardware or software network load balancer Use layer 4 versus layer 7 load balancing Deploy servers with similar hardware, memory and performance

46

12/3/2013

Lab: Implementing High Availability

Exercise 1: Creating and Configuring a Database

Availability Group
Exercise 2: Deploying Highly Available Client Access

Servers
Exercise 3: Testing the High-Availability Configuration

Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-CAS2 20341B-LON-MBX1 20341B-LON-MBX2

User Name Password

Adatum\Administrator Pa$$w0rd

Estimated time: 90 minutes

Microsoft Official Course

Module 7

Planning and Implementing Disaster Recovery

Data-Loss Mitigation Features

Mitigating data loss avoids the need to recover

from backup
Data-loss mitigation features include: Deleted item recovery Single item recovery In-place hold Deleted mailbox retention DAGs Shadow redundancy

47

12/3/2013

Exchange Server Native Data Protection

Exchange Native Data Protection includes the following Exchange Server 2013 features:

High availability that minimizes downtime and data loss Single-item recovery and In-Place hold policies for recovering deleted messages Point-in-time database recovery with lagged copies of mailbox databases Archive mailboxes, retention and archive policies, In-place eDiscovery for managing large mailboxes

Exchange Native Data Protection reduces costs by:

Simplifying management Requiring no backup software or hardware Requiring no RAID

Scenarios Requiring Backup and Restore Scenarios:

Recover a message when single-item recovery is not enabled Recover a mailbox after the mailbox retention period has passed Recover a public folder item after the item retention has passed Recover from a failed database when a DAG is not in use Recover from a failed server when a DAG is not in use

Backups may be used to meet compliance requirements

Lesson 2: Planning and Implementing Exchange Server 2013 Backup

Backup Requirements for Exchange 2013 Choosing Exchange Server Backup Software Choosing Exchange Server Backup Media How Does a VSS Backup Work? Demonstration: How to Back Up Exchange Server

2013

48

12/3/2013

Backup Requirements for Exchange 2013

Exchange Server Role

All roles

Backed-Up Data
System State of server and Active Directory database on domain controllers Databases and transaction logs Message tracking logs Unified Messaging custom audio prompts Server certificates used for SSL Specific Internet IIS configuration

Mailbox server

Client Access server

Choosing Exchange Server Backup Software

Windows Server Backup:
Runs locally on the computer running Exchange Server Cannot back up to tape Restore only full databases Cannot backup passive DAG copies

DPM:
Uses agents on the computer running Exchange Server Typically backs up to disk and then archives to tape Can restore databases or mailboxes Can back up passive DAG copies

Non-Microsoft backup software may be able to:

The backup software must support VSS Restore individual items Perform brick-level backups

Choosing Exchange Server Backup Media

Media
Tape Disk SAN-based

Description
Is physically easy to transport and very durable Increases backup performance Backs up the traffic of the main network and keeps it on the SAN

49

12/3/2013

Lesson 3: Planning and Implementing Exchange Server 2013 Recovery

Options for Recovering Exchange Server Functionality Options for Recovering Mailbox Data and Databases Planning the Recovery of Mailbox Data and Databases Planning the Recovery of Client Access Servers Repairing Exchange Server Database Corruption Process for Recovering Data Using the Recovery

Database
Demonstration: How to Recover Data by Using the

Recovery Database
What Is Dial-Tone Recovery? Process for Implementing Dial-Tone Recovery

Options for Recovering Exchange Server Functionality To replace lost server roles:

Build a new server with equivalent functionality Add roles to an existing Exchange server

To restore a lost server:

Build a new server Restore system state (optional) Install Exchange Server with Recovery mode Restore any necessary data

Options for Recovering Mailbox Data and Databases

When a database or server fails, you have several

options for recovery, including:

Options Database restore Recovery database Database portability Dial-tone recovery Description Replaces an existing database Restores database to an alternate location for data recovery Restores database without having to recover a specific server Restores server functionality rapidly before historical mailbox contents are restored Mounts a database copy on a different Exchange server with the mailbox role installed

DAG recovery

50

12/3/2013

Planning the Recovery of Mailbox Data and Databases Considerations:

Use DAGs to avoid the need to recover Separate transaction logs and databases Use a dial-tone database to speed up recovery Allocate disk space for a recovery database Use mailbox databases with a smaller size

Planning the Recovery of Client Access Servers

The basic functions of Client Access servers can be

recovered without backup up existing servers

Replace a failed Client Access server by: Adding the server role to an existing Exchange server Deploying a new server with the same server role Replacing and deploying a new server can result in

some applications requiring reconfiguration

Repairing Exchange Server Database Corruption

The following cmdlet to repair database

corruption is available:

New-MailboxRepairRequest

The cmdlet provides the following benefit over

isinteg.exe:

No need to take the database offline Runs on Windows PowerShell, enabling you to automate the process

51

12/3/2013

Process for Recovering Data Using the Recovery Database A recovery database allows you to:

Restore the database from backup Mount the database and extract data

Recovery database scenarios include:

Dial-tone recovery Individual mailbox recovery Specific item recovery

What Is Dial-Tone Recovery?

Dial-tone recovery is the process of implementing

access to email services without restoring data to user mailbox

Dial-tone recovery benefits: Enables users to send and receive email as soon as possible after the loss of a database or server Dial-tone database can be merged with the recovered database into a single up-to-date mailbox database

Process for Implementing Dial-Tone Recovery Process for implementing dial-tone recovery:
1. 2.

Create the dial-tone database If necessary, configure the mailboxes that were on the database to use the new dial-tone database Restore the database and log files that you want to recover into the Recovery Database Swap the dial-tone database with the database that you have recovered in the step before Export and import the content from the dial-tone database into the recovered original database

3.

4.

5.

52

12/3/2013

Lab: Implementing Disaster Recovery for Exchange Server 2013

Exercise 1: Backing Up Exchange 2013 Exercise 2: Restoring Exchange Server 2013 Data Exercise 3: Exchange Server 2013 Disaster

Recovery (Optional)
Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1 Adatum\Administrator Pa$$w0rd

User name Password

Estimated Time: 75 minutes

Microsoft Official Course

Module 8

Planning and Configuring Message Transport

Module Overview
Overview of Message Transport and Routing Planning and Configuring Message Transport Managing Transport Rules

53

12/3/2013

Message Transport Services Message Transport Services:

Front End Transport service

Runs on the Client Access server role Performs SMTP proxying Runs on the Mailbox Server role Routes messages between the Front End Transport Service and the Mailbox Transport Service Runs on the Mailbox Server role Consists of two components: Mailbox Transport Submission and Mailbox Transport Delivery Is the only service that handles RPC communication with the database

Hub Transport service

Mailbox Transport service

Message Transport Components

Routing Destinations and Delivery Groups

Routing destinations: Mailbox database Connector Distribution group expansion server Delivery Groups: Routable DAG Mailbox delivery group Connector source servers AD DS site Server list

54

12/3/2013

Mail Flow in Exchange Server 2013

SMTP Traffic

SMTP

Routing in the Front End Transport Service

Front End Transport Service acts as a SMTP proxy

for all incoming and outgoing connections

It communicates only with Hub Transport service

on the Mailbox server

You can use the following delivery groups: Routable DAG Mailbox delivery group AD DS site

Routing in the Mailbox Transport Service

Mailbox Transport service: Is stateless and runs on each Mailbox server Communicates with the Hub Transport service and the local mailbox database You can use following

delivery groups:
Routable DAG Mailbox delivery group AD DS site

55

12/3/2013

Modifying the Default Message Flow

You can modify default message flow by

performing the following: Configuring Hub Sites

Set-ADSite Identity sitename HubSiteEnabled $true cmdlet

Configuring

Exchange-Specific Routing Costs

Set-AdSiteLink Identity ADsitelinkname ExchangeCost value

Configuring

Expansion Servers for Distribution

Groups

Tools for Troubleshooting SMTP Message Delivery

Queue Viewer Use to view and manage undelivered messages Tracking logs and Delivery reports Use to confirm message delivery Protocol Logging Use to provide detailed protocol-level information Telnet Use to check if the SMTP port responds, or to directly send a SMTP mail to a connector Remote Connectivity Analyzer website Use to test connectivity to Exchange services from the Internet

What Are Transport Agents?

Transport agents process email messages that

pass through the transport pipeline

Default Transport agents: Transport Rule agent Journaling agent Active Directory Rights Management Services Prelicensing agent It is possible to create and install custom transport

agents

56

12/3/2013

Lesson 2: Planning and Configuring Message Transport

Planning Exchange Messaging Transport Demonstration: Reviewing Mail-Flow Settings Planning Accepted Domains and Remote Domains Demonstration: Creating and Configuring

Accepted and Remote Domains

What Is an SMTP Connector? Demonstration: How to Create and Configure

SMTP Connectors
What Are Foreign Connections?

Planning Accepted Domains and Remote Domains

Accepted domains define SMTP domain names for

which the Exchange server will accept email

Accepted domains can be: Authoritative domains Internal relay domains External relay domains Remote domains define SMTP domains that are

external to your Exchange organization

You can set following properties for Remote domains: Out-of-office message delivery Message format options including acceptable character sets

What Is an SMTP Connector?

SMTP connectors are Exchange Server components

that support one-way SMTP connections

Default SMTP Receive connectors: Default <server name> (HubTransport) Client Proxy <server name> (HubTransport) Default FrontEnd <server name> (FrontendTransport) Outbound Proxy Front End <server name> (FrontendTransport) Client Frontend <server name> (FrontendTransport) No default SMTP Send connectors are created, so

they must be created manually

57

12/3/2013

Lesson 3: Managing Transport Rules

What Are Transport Rules? Configuring Transport Rules Planning Transport Rules Demonstration: Creating Transport Rules What Are Data-Loss Prevention Policies? Demonstration: Configuring Data Loss Protection

Policies

What Are Transport Rules?

Transport rules restrict message flow or modify

message contents for messages in transit

Transport rules have the following chracteristics: They are stored in the AD DS Configuration partition They are applied by all Mailbox servers They are used to apply compliance requirements

Planning Transport Rules

When planning for transport rules: Plan conditions and exceptions carefully

Plan for transport rule priority and order Use regular expressions to check message contents Test the application of transport rules to avoid rule conflicts or duplication Plan for transport rule limitations with encrypted and digitally signed messages Document the transport rule configurations

58

12/3/2013

What Are Data-Loss Prevention Policies?

Data Loss Protection policies enforce compliance

requirements for business-critical data being sent by email

When implementing Data Loss Protection you can

choose to:
Use the Data Loss Protection templates provided by Microsoft Use policy files created by a third-party vendor Create a custom policy

Policy Tips can notify users if they are violating

policy before they send email

Lab: Planning and Configuring Message Transport

Exercise 1: Configuring Message Transport Exercise 2: Troubleshooting Message Delivery Exercise 3: Configuring Transport Rules and

Data-Loss Prevention Policies

Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1 20341B-LON-CL1

User Name Password

Adatum\Administrator Pa$$w0rd

Estimated time: 45 minutes

Microsoft Official Course

Module 9

Planning and Configuring Message Hygiene

59

12/3/2013

Module Overview
Planning Messaging Security Implementing an Antivirus Solution for Exchange

Server 2013
Implementing an Anti-Spam Solution for

Exchange Server 2013

Lesson 1: Planning Messaging Security

Defining Message Security Requirements SMTP Gateway Solution Planning Restrictions to Message Flow Planning SMTP Connector Security Planning Secure Message Routing Between

Partner Organizations
Planning Client-Based Messaging Security Demonstration: Configuring Secure Message

Routing Between Partner Organizations

Defining Message Security Requirements

Security requirements Exchange Server 2013 Protection technology Antimalware, anti-spam, security permissions, local firewall Firewall, reverse proxy, SMTP Gateway, antimalware, anti spam Antimalware, security permissions, local firewall Antimalware, security permissions, local firewall

Perimeter network

Internal client

External client

60

12/3/2013

SMTP Gateway Solution

The SMTP Gateway solution: Should have antimalware and anti-spam protection Must be configured with a FQDN Should be installed in perimeter network Requires a minimal number of ports opened on the internal and external firewalls Must be configured with the IP addresses for DNS servers that can resolve DNS names on the Internet

Planning Restrictions to Message Flow

Restricting mail flow options: Message delivery restrictions Transport rules Message moderation Data loss prevention

Planning SMTP Connector Security

SMTP connector security options:
Protocol IPsec Layer Network-based Purpose Encrypts server-to-server or client-to-server traffic Encrypts site-to-site traffic Encrypts server-to-server traffic

VPN

Network-based

TLS

Session-based

SMTP email can be additionally secured by using

authentication and authorization on the SMTP connector

61

12/3/2013

Planning Secure Message Routing Between Partner Organizations

Uses mutual TLS with business partners to enable

secured message paths over the Internet

To set up mutual TLS:

Generate a certificate request for TLS certificates Import and enable the certificate on the Mailbox server Configure outbound Domain Security Configure inbound Domain Security

Planning Client-Based Messaging Security

Method Digital signatures

Type of Security Provided Authentication: The message was sent by the person or organization who claims to have sent it Nonrepudiation: Helps to prevent the sender from disowning the message Data integrity: Any alteration of the message invalidates the signature Only the intended recipient can view the contents

Message encryption

S/MIME Infrastructure requirements:

The sender must have a valid certificate installed All target addresses must have a public certificate available either locally or in Active Directory Can use either an internal or public CA

Lesson 2: Implementing an Antivirus Solution for Exchange Server 2013

Overview of Antivirus Solution Requirements Options for Implementing an Antivirus Solution in

Exchange Server 2013

Antivirus Solution Features in Exchange Server 2013 What Is Exchange Online Protection? Best Practices for Deploying an Antivirus Solution Demonstration: Configuring Antimalware

Protection for Exchange Server

62

12/3/2013

Overview of Antivirus Solution Requirements

Antivirus solution requirements: Protection from malware Protection from spam Designed for Exchange Server 2013 Corporate antivirus solution

Options for Implementing an Antivirus Solution in Exchange Server 2013

Exchange Server 2013 antivirus solution options: Built-in antimalware protection Hosted, cloud-based solution or hybrid solution Corporate antivirus solution Antivirus solution in the perimeter network

Antivirus Solution Features in Exchange Server 2013

Exchange antimalware protection features include: Options for enable, disable, or bypass Download engine and definition updates Scanning is performed during send or receive Actions when malware is detected:

Delete entire message Delete all attachments and use default alert text Delete all attachments and use custom alert text Notify the administrator and the sender

63

12/3/2013

What Is Exchange Online Protection?

Exchange Online Protection has following features: Web-based management console Multi-engine antimalware Real-time response Email availability Reporting

Lesson 3: Implementing an Anti-Spam Solution for Exchange Server 2013 Overview of Anti-Spam Solutions Overview of Spam-Filtering Features Applying Exchange Server 2013 Spam Filters What Is Sender and Recipient Filtering? What Is Sender ID Filtering? What Is Sender Reputation Filtering? Understanding the SCL in Exchange Server 2013 What Is Content Filtering? Best Practices for Deploying an Anti-Spam Solution Demonstration: Configuring Anti-Spam Features on Exchange Server 2013

Overview of Spam-Filtering Features

Feature Content Filtering Sender ID Filters messages based on: The message contents The IP address of the sending server from which the message was received The Sender in the MAIL FROM: SMTP header The Recipients in the RCPT TO: SMTP header Several characteristics of the sender, accumulated over a period of time

Sender Filtering Recipient Filtering Sender Reputation

64

12/3/2013

Applying Exchange Server 2013 Spam Filters

Exchange Server 2013 Mailbox server

Sender Filtering

Internet

Recipient Filtering Outlook Safe Senders List Exceed SCL Threshold Below SCL Threshold

Sender ID Filtering

Content Filtering

What Is Sender and Recipient Filtering?

Sender filtering: Evaluates the sender SMTP address, email address, domain, or domain with subdomains Can be configured to reject email Can be configured to process email to another anti-spam agent Recipient filtering: Evaluates recipient the SMTP address Can be configured to reject email to a non-existing user or to a specific internal user Can be configured to process email to another anti-spam agent

What Is Sender ID Filtering?

DNS Server SMTP Server

Mailbox Server

2 1
Internet

You can configure it to:

Reject messages and issue an NDR Delete messages without sending an NDR Stamp the messages with the SenderID result, and continue processing

65

12/3/2013

What Is Sender Reputation Filtering?

Sender Reputation filtering filters messages based

on information about recent email messages received from specific senders

The Protocol Analysis agent assigns an SRL that is

based on:

Sender open proxy test HELO/EHLO analysis Reverse DNS lookup Analysis of SCL ratings on messages from a particular sender

Understanding the SCL in Exchange Server 2013

SCL is a numerical value between 0 and 9: 0 - the message is highly unlikely to be spam 9 - the message is very likely to be spam SCL thresholds and actions: SCL delete threshold SCL reject threshold SCL quarantine threshold SCL junk email folder threshold

What Is Content Filtering?

Content Filtering analyzes the content of each

email message and assigns an SCL to the message

You can configure content filtering to:

Delete, reject, or quarantine messages that exceed an SCL value Block or allow messages based on a custom word list Allow exceptions so that messages sent to specified recipients are not filtered

Quarantined messages are sent to a quarantine

mailbox

66

12/3/2013

Lab: Planning and Configuring Message Security

Exercise 1: Configure Antimalware Options in Exchange

Server 2013
Exercise 2: Configuring Anti-Spam Options on Exchange

Server
Exercise 3: Validating Antimalware and Anti-Spam

Configuration Logon Information

Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1

User Name Password

Adatum\Administrator Pa$$w0rd

Estimated time: 45 minutes

Microsoft Official Course

Module 10

Planning and Configuring Administrative Security and Auditing

Module Overview
Configuring Role-Based Access Control Configuring Audit Logging

67

12/3/2013

Lesson 1: Configuring Role-Based Access Control

What Is Role-Based Access Control? What Are Management Role Groups? Built-In Management Role Groups Demonstration: Managing Permissions Using the

Built-In Role Groups

Process for Configuring Custom Role Groups Demonstration: Configuring Custom Role Groups What Are Management Role Assignment Policies? What Are Exchange Server Split Permissions? Configuring RBAC Split Permissions Configuring Active Directory Split Permissions

What Is Role-Based Access Control?

RBAC defines all Exchange Server 2013 permissions, and is

applied by all Exchange Server management tools

RBAC defines which cmdlets the user can run :

Who: Can modify objects What: Objects and attributes that can be modified Where: Scope or context of objects that can be modified

RBAC options include:

Management role groups Management role-assignment policies Direct policy assignment (avoid using)

What Are Management Role Groups?

Role Holder Role Group Maria Ian Pat WHO WHERE
Recipient Read/Write Scope Configuration Read/Write Scope Role Assignment Management Role Role Entry

User Options
Role Assignment

Help Desk

Management Role Role Entry Get-Mailbox

View-only Recipients WHAT

Role Holder Mailboxes or universal security groups or users or distribution groups or role groups

Role Group Higher-level job function

Role Assignment Binding layer

Management Role Task-based permissions

Role Entry Cmdlet + parameters

68

12/3/2013

Built-In Management Role Groups Management role groups include:

Organization Management View-Only Organization Management Recipient Management Unified Messaging Management Discovery Management Records Management Server Management Help Desk Public Folder Management Delegated Setup Compliance Management (new in Exchange Server 2013) Hygiene Management (new in Exchange Server 2013)

What Are Management Role Assignment Policies?

Management role-assignment policies assign permissions to users to manage their mailboxes or distribution groups
Component Mailbox Management role assignment policy Management role Management role assignment Explanation Each mailbox is assigned one role-assignment policy Object for associating management roles with mailboxes Container for grouping other RBAC components Associates management roles with management role assignment policies Defines which Exchange cmdlets the user can run on their mailboxes or groups

Management role entry

What Are Exchange Server Split Permissions?

Split permissions separate creation of security principals in

AD DS, such as users and security groups, from the subsequent configuration of those objects through Exchange Server 2013 tools
With Exchange Server split permissions you can:

Separate the ability to create or delete security principals from Exchange administration Choose between two models:

RBAC split permissions Active Directory split permissions

Available since Exchange Server 2010 SP1

69

12/3/2013

Configuring RBAC Split Permissions

You must manually configure RBAC split permissions as follows:
1. 2. 3. 4.

Verify that Active Directory split permissions have not been enabled Create a new role group for AD DS administrators Create regular and delegating role assignments for the new role group for appropriate roles Remove regular and delegating management role assignments between the Mail Recipient Creation role, and both the Organization Management and Recipient Management role groups Remove the regular and delegating role assignments between the Security Group Creation and Membership role and the Organization Management role group

5.

RBAC split permission results:

Only members of the new role group that you create can create security

principals, such as mailboxes

Configuring Active Directory Split Permissions

Active Directory split permissions is configured automatically during Setup, or when you run the following command:
setup.com /PrepareAD /ActiveDirectorySplitPermissions:true

Active Directory split-permissions results:

Cannot create security principals with Exchange Server management tools Cannot manage distribution group members with Exchange Server management tools Exchange Trusted Subsystem and Exchange servers cannot create security principals Exchange servers and Exchange management tools can only modify Exchange attributes of existing Active Directory security principals

Lesson 2: Configuring Audit Logging

What Is Administrator Audit Logging? What Is Mailbox Audit Logging? Demonstration: Configuring Audit Logging

70

12/3/2013

What Is Administrator Audit Logging?

Administrator audit logging enables you to track changes

made to the Exchange environment by administrators

Administrator audit logging:

Is enabled by default in Exchange Server 2013 Is configured by default with the Set-AdminAuditLogConfigLogs for all cmdlets and parameters except for Test-, Get-, and SearchSupports searches using the Exchange Management Shell and the Exchange Administration Center

Perform detailed log searches with the Search-

AdminAuditLog and New-AdminAuditLogSearch cmdlets

What Is Mailbox Audit Logging?

Mailbox audit logging is used to track mailbox access by

mailbox owners, delegates, and administrators

Mailbox audit logging:

Must be enabled on a per-mailbox basis using the Set-Mailbox cmdlet Does not automatically log owner access unless specified to do so Supports non-owner access reports through the Exchange Administration Center

Perform detailed log searches with the Search-

MailboxAuditLog and New-MailboxAuditLogSearch cmdlets

Lab: Configuring Administrative Security and Auditing

Exercise 1: Configuring Exchange Server

Permissions
Exercise 2: Configuring Audit Logging Exercise 3: Configuring RBAC Split Permissions on

Exchange Server 2013

Logon Information
Virtual Machines 20341B-LON-DC1 20341B-LON-CAS1 20341B-LON-MBX1 Adatum\Administrator Pa$$w0rd

User name Password

Estimated Time: 60 minutes

71