You can rename your connectors however you want by using Exchange management console but you will lose functionality of TLS in SMTP traffic – becouse the certificate remote.company.com does not match fqdn or smtp greeting of a connector that advertise mail.company.com. You will also get an error in Event log saying:

Microsoft Exchange could not find a certificate that contains the domain name mail.company.com in the personal store on the local computer…

 Ok, what can we do now?

Well turn on Exchange Management Shell – that is Powershell with modules for Exchange 2007 management – you can find it in star menu… And first of all we want to see current Exchange certificates that are enabled for Exchange services by using cmdlet:

[PS] C:\Windows\System32>Get-ExchangeCertificate 

and you wil receive something like this:

[PS] C:\Windows\System32>Get-ExchangeCertificate 

[PS] C:\Windows\System32>

Thumbprint                                Services   Subject
———-                                ——–   ——-
59D62E7850EE4093AFF1EC73E2623D52058C2B35  ….S      CN=mail.company.com
45EEEB44DF4BFE2EB1B7A7592EA1DF5BF93F44B4  IP.WS      CN=remote.company.com

42F146B12BEF918A6A8FC730F5AA87AC4ACB1CEB  IP..S      CN=remote.company.com

817F1311CB72FB70F962EC0FAD2D8FA857F114A4  ….S      CN=sbssrv01.company.local
4BAAC7906689AFF0129767CF492AAE058B5DF494  ….S      CN=Sites
8F1D9C5FEB6EF0C39F25175AFBDEA54FE9668EF9  …..      CN=xxxxxxxxxxx-xxxxxxxxxxxx01-CA
8E4F33523325500F38ECF41FCDFBBE684AFC6145  …..      CN=WMSvc-WIN-K7KGUV5MQ40

We can now see that SMTP connectors are using all certificates (S defnies SMTP service).

Ok… How can you test that TLS works?

You can try it by using telnet client and connect to your server:

telnet mail.company.com 25

 

Exchange should respond something like:

220 mail.company.com Microsoft ESMTP MAIL Service ready at Wed, 27 Jan 2010 17:
12:09 +0100

 

then you can write:

helo test.blablabla.com

 

220 mail.company.com Microsoft ESMTP MAIL Service ready at Wed, 27 Jan 2010 17:
13:07 +0100
helo test.blablabla.si
250 mail.xxxxxxxxxxxxxxxx.si Hello [xxx.xxx.xxxx.xxx]

after that enter command:

starttls

 

server should respond:

220 2.0.0 SMTP server ready

 

Server ready? Super!

 

PS.

If you did miss something you will receive error from server saying:

 

starttls
500 5.3.3 Unrecognized command

 

If you get that? Read this tutorial again

PS. PS. You do not need to restart anything when you apply this commands… No need for restarting Exchange services…

Special thanks to Saso Erdeljanov for some hints about this issue…

Received: from mail.server.si (xxx.xxx.xxx.xxx) by mail.server2.si
 (172.31.200.2) with Microsoft SMTP Server (TLS) id 8.2.247.2; Wed, 19 May
 2010 13:08:47 +0200
Received: from SRVEXCH01.domain.local ([10.11.12.2]) by SRVEXCH01.domain.local
 ([10.11.12.2]) with mapi; Wed, 19 May 2010 13:08:02 +0200
From: xxxxx xxxxx xxxxx@xxxxx
To: =?iso-8859-2?Q?xxxxx_xxxxx=E6_=28xxxxx=xxxxx=2Exxxxx=29?=
 <xxxxx@xxxxx>
Return-Receipt-To: xxxxx@xxxxx
Date: Wed, 19 May 2010 13:08:00 +0200
Subject: xxxxx
Thread-Topic: xxxxx
Thread-Index: Acr3Q4r6dSBNnU37R9ypBLYy8PMzcA==
Message-ID: <13204AAD07BCDD4EB69C3367FF1783A9124C065BB2@SRVEXCH01.domain.local>
Accept-Language: sl-SI
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: sl-SI
Content-Type: multipart/alternative;
 boundary=”_000_13204AAD07BCDD4EB69C3367FF1783A9124C065BB2_”
MIME-Version: 1.0
Return-Path: xxxxx@xxxxx
X-MS-Exchange-Organization-PRD: xxxxx.si
X-MS-Exchange-Organization-SenderIdResult: Pass
Received-SPF: Pass (xxxxx.xxxxx.xxxxx: domain of xxxxx@xxxxx
 designates xxx.xxx.xxx.xxx as permitted sender) receiver=xxxxx.xxxxx.local;
 client-ip=xxx.xxx.xxx.xxx; helo=mail.xxxxx.si;
X-MS-Exchange-Organization-SCL: 1
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.8917.498;SV:3.3.8919.449;SID:SenderIDStatus Pass;OrigIP:xxx.xxx.xxx.xxx

If you want to remove this stuff we need to create a Hub Transport Rule:
Open Microsoft Exchange Console
Navigate to:
Microsoft Exchange \ Organization Configuration \ Hub Transport \ Transport Rules

Right Click and select New Transport Rule and name it “Remove headers” click Next,

chose From users inside or outside the organization and select Inside click Next,chose Remove header and as message header just write: Received twice click Next…

You are done… Headers will not be sent any more to users outside the organization…

Bye,
Luka (under influence of wonderful NT Konferenca 2010)

Saso has an explanation for this phenomenon

http://exchange.si/archive/2010/01/12/pow-11-kb973917-and-repeated-login-prompts.aspx

I currently use:
zen.spamhaus.org provided by http://www.spamhaus.org
bl.spamcop.net provided by http://www.spamcop.net

As you should decide to use or not to use blocklist providers on your mail servers I am adding interesting article from august 2009 to better understand how this providers work: http://www.allspammedup.com/2009/08/understanding-blocklist-providers/

I wish you luck in fighting spam!

EHLO team r0x! http://msexchangeteam.com/

But nowhere I have encountered the problem describing this error code in combination with Windows Server 2008 and Exchange 2007 SP1 with rollup 5.

Well… As I figured out it apparently does not work – if you want OAB to be distributed by Web-based distribution…

You get this error in your Outlook 2007 SP1 clients (on Windows XP and on Windows Vista)

As I can see there is somekind of permission problem becoues OAB virtual directory points to:

C:\Program Files\Microsoft\Exchange Server\ClientAccess\OAB

This directory has NO NTFS permissions for Auhtenticated users… but in IIS there is on this folder a parameter: Pass-through authentication - but as I know it can not work becouse your credentials are not covered in NTFS permissions of that folder.

But it does not work even if you give NTFS permissions to authenticated users… (you are still prompted for username and password in Outlook…)

Maybe I am missing something but weekend is almost over and my users need to use Exchange and RPC over HTTP(s) feature in their Outlooks tomorow… What I did is that I disabled Web-based distribution of Offline address book and I left only Public folder distribution. It took a couple of minutes for autodiscover.xml to update and Outlooks to get new parameters about Offline address book distribution.

Everything works correctly now…

Comments / suggestions appriaciated…

PS.
Hey all you Exchangegurus!
I think you will find this link useful: https://www.testexchangeconnectivity.com/

You need to do it this way:

1. Uncheck Internet protocol version 6 (TCP/IPv6) in your network card properties

2. Delete localhost value for ipv6 in file called HOSTS in C:\Windows\System32\drivers\etc

::1             localhost

or comment it by using # at the start of line

3. Create/add a 32 bit DWORD with name DisabledComponents and value 0xFFFFFFFF to:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters

My setup was Windows server 2008 standard as Hyper-V platform, inside Windows server 2008 standard with Active directory in functional level 2008 – everything updated and clean.

When I changed this three parameters exchange setup completed sucessfuly and now my testing Exchange 2007 is working! Wiiiii!!!

Get-MailboxStatistics -Database “mailbox database” | Sort -Property DisplayName | ft DisplayName,@{expression={$_.totalitemsize.value.ToMB()};label=”Mailbox Size(MB)”}, itemcount, lastlogontime,lastlogofftime,lastloggedonuseraccount

2. Sorted by Last logon time
Get-MailboxStatistics -Database “mailbox database” | Sort -Property lastlogontime | ft DisplayName,@{expression={$_.totalitemsize.value.ToMB()};label=”Mailbox Size(MB)”}, itemcount, lastlogontime, lastlogofftime

Enable-MailPublicFolder -Identity “\TEST\test@test.com”

Set-MailPublicFolder -Identity “\TEST\test@test.com” -EmailAddressPolicyEnabled $false

Set-MailPublicFolder -Identity “\TEST\test@test.com” -EmailAddresses “test@test.com”, “test@test.net”, “test@test.org”

Set-MailPublicFolder -Identity “\TEST\test@test.com” -PrimarySmtpAddress test@test.comAdd-PublicFolderClientPermission -Identity “\TEST\test@test.com” -User Username -AccessRights EditorGet-PublicFolderClientPermission -Identity “\TEST\test@test.com” | fl