SSL for Exchange 2013 with ARR

Hi,
Need advice on the number of SSL i would need to purchase.
I know that I require to have a SSL with example: mail.domain.com & autodiscover.domain.com
How about the ARR server that I will be setting up. Refer to http://social.technet.microsoft.com/Forums/exchange/en-US/fe8d1aae-a3c9-432a-a139-7b770cb07576/new-exchange-2013-setup-vmware?forum=exchangesvrdeploy
do i need to have a SSL cert for the ARR server?
Thanks in advance!

Hi,
Just like all above saying, we do not need to generate a new certificate for IIS ARR server. We can configure
all protocols (OWA, ECP, EWS etc) published with the mail.domain.com
namespace.
When install IIS, we can export the Exchange certificate (from a CAS) and import the certificate to the local machine certificate store on the IIS Reverse Proxy, together with any required root or intermediate certificates. For more information
about it, here is a detailed article we can refer to:
Reverse Proxy for Exchange Server 2013 using IIS ARR
http://blogs.technet.com/b/exchange/archive/2013/07/19/reverse-proxy-for-exchange-server-2013-using-iis-arr-part-1.aspx
Thanks,
Winnie Liang
TechNet Community Support

Similar Messages

SP1 for Exchange 2013 install fails with ECP virtual directory issues and now transport service won't start and mail is unavailable

SP1 for Exchange 2013 install failed on me with ECP virtual directory issues:
Error:
The following error was generated when "$error.Clear();
          $BEVdirIdentity = $RoleNetBIOSName + "\ecp (name)";
          $be = get-EcpVirtualDirectory -ShowMailboxVirtualDirectories -Identity $BEVdirIdentity -DomainController $RoleDomainController -ErrorAction SilentlyContinue;
          if ($be -eq $null)
          new-EcpVirtualDirectory -Role Mailbox -WebSiteName "name" -DomainController $RoleDomainController;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -FormsAuthentication:$false -WindowsAuthentication:$true;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -InternalUrl $null -ExternalUrl $null;
          . "$RoleInstallPath\Scripts\Update-AppPoolManagedFrameworkVersion.ps1" -AppPoolName:"MSExchangeECPAppPool" -Version:"v4.0";
        " was run: "The virtual directory 'ecp' already exists under 'server/name'.
Parameter name: VirtualDirectoryName".
Error:
The following error was generated when "$error.Clear();
          $BEVdirIdentity = $RoleNetBIOSName + "\ECP (name)";
          $be = get-EcpVirtualDirectory -ShowMailboxVirtualDirectories -Identity $BEVdirIdentity -DomainController $RoleDomainController -ErrorAction SilentlyContinue;
          if ($be -eq $null)
          new-EcpVirtualDirectory -Role Mailbox -WebSiteName "name" -DomainController $RoleDomainController;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -FormsAuthentication:$false -WindowsAuthentication:$true;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -InternalUrl $null -ExternalUrl $null;
          . "$RoleInstallPath\Scripts\Update-AppPoolManagedFrameworkVersion.ps1" -AppPoolName:"MSExchangeECPAppPool" -Version:"v4.0";
        " was run: "The operation couldn't be performed because object 'server\ECP (name)' couldn't be found on 'DC0xx.domain.com'.".
Error:
The following error was generated when "$error.Clear();
          $BEVdirIdentity = $RoleNetBIOSName + "\ECP (name)";
          $be = get-EcpVirtualDirectory -ShowMailboxVirtualDirectories -Identity $BEVdirIdentity -DomainController $RoleDomainController -ErrorAction SilentlyContinue;
          if ($be -eq $null)
          new-EcpVirtualDirectory -Role Mailbox -WebSiteName "name" -DomainController $RoleDomainController;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -FormsAuthentication:$false -WindowsAuthentication:$true;
          set-EcpVirtualdirectory -Identity $BEVdirIdentity -InternalUrl $null -ExternalUrl $null;
          . "$RoleInstallPath\Scripts\Update-AppPoolManagedFrameworkVersion.ps1" -AppPoolName:"MSExchangeECPAppPool" -Version:"v4.0";
        " was run: "The operation couldn't be performed because object 'server\ECP (name)' couldn't be found on 'DC0xx.domain.com'.".
!! And now transport service won't start and mail is unavailable !!
Any help would be appreciated.
I have removed the ecp site from default site and attempting to rerun SP1 now. I do not have high hopes. :(

Hi,
Thanks for your response.
From the error description, you need to manually remove the ECP with IIS manager in both the Default Web Site and the Exchange Back End firstly. And then continue the upgrade to check the result.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Configuring Lync Server 2013 to be a partner Application for Exchange 2013

Hello Guys,
I just want to share my experience while configuring Lync server 2013 to be a partner Application for exchange 2013 sever.
As mentioned on technet you need to run Configure-EnterprisePartnerApplication.ps1 script that ships with Exchange 2013.
But when I tried to run the script as described on the technet article, I found it always fails with " the accepted domain is not valid"
I have checked my accepted domains many times and i found that there's no issues with my configured accepted domain.
So I started to review the script to find the issue and I found that the script was configured as below
$acceptedDomains = Get-AcceptedDomain ;
if ($acceptedDomains -eq $null)
WriteError ("There is no accepted domain so user can not be created.")
$acceptedDomain = $acceptedDomains[0].Name;
if($UseDomainController -eq $true)
$user = New-MailUser -Name $username -DomainController $DomainController -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true -DomainController $DomainController
else
$user = New-MailUser -Name $username -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true;
which is totally wrong as below:
firstly it makes $AcceptedDomain variable to equal the Name of the accepted domain.
Not all customers configure the name of the Accepted Domain to be the Domain Name.
Secondly it makes $AcceptedDomain variable to equal the name of the first Accepted Domain.
The first domain may be not the default Accepted Domain.
So I have configured the script as below
$acceptedDomains = Get-AcceptedDomain | ? {$_.Default -eq "True"} ;
if ($acceptedDomains -eq $null)
WriteError ("There is no accepted domain so user can not be created.")
$acceptedDomain = $acceptedDomains.DomainName;
if($UseDomainController -eq $true)
$user = New-MailUser -Name $username -DomainController $DomainController -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true -DomainController $DomainController
else
$user = New-MailUser -Name $username -ExternalEmailAddress $username@$acceptedDomain;
set-mailuser -Identity $user.Identity -HiddenFromAddressListsEnabled $true;
I hope This help.
Thanks
Ahmed Fouad

Hi,
This is helpful, thanks for sharing.
Best regards,
Belinda Ma
TechNet Community Support

Exchange 2013 with CAS and HLB in different sites

Hello...
Coming son, we'll deploy Exchange 2013 with high availability in all roles. The CAS and Hub Transport roles, are with a HLB; and the Mailbox with DAG. The infrastructure is formed by:
Citi1:
- AD Site 1
- 1 Hardware Load Balance: HLB01 to load balance the CAS and Hub Transport of Exc01 and Exc02
- 2 Exchange: Exc01 and Exc02 multiroles Exchange Server 2013
- 1 DAG for Citi1 databases: conformed by the Exc01 and Exc02
Citi2:
- AD Site 2
- 1 Hardware Load Balance: HLB02 to load balance the CAS and Hub Transport of Exc03 and Exc04
- 2 Exchange: Exc03 and Exc04 multiroles Exchange Server 2013
- 1 DAG for Citi2 databases: conformed by the Exc03 and Exc04
The Active Directory is one forest with one domain. The Domain Controllers are Windows Server 2012. The Site1 and Site 2 are connected by a WAN link. The accepted domain is domain.com. The smtp address is @domain.com
How to make that users of Citi1 always connect throught the HLB01 to their mailboxes; and the users of Citi2 always connect throught the HLB02 to their mailboxes if the autodiscover.domain.com is the same for all users?
I have not found documentation about
this architecture. Please help me.
Thank you very much.
Best regards, Javier Uribe

Hi javier,
In this issue, I guess you can try to use site affinity for the Autodiscover service for intranet-based traffic.
To use site affinity, you specify which Active Directory sites are preferred for clients to connect to a particular Autodiscover service
instance.
You configure site affinity by using the
Set-ClientAccessServer cmdlet. This cmdlet lets you specify the preferred Active Directory sites for connecting to the Autodiscover service on a specific Client Access server. After you configure site affinity for the Autodiscover service,
the client will connect to the Autodiscover service as you specified.
According to your needs, you might want to allow users in the site1 to use site1, users in site2 to use site2 to access the Autodiscover Service.
You can configure site scope for Client Access servers in the Site1 by following command.
Set-ClientAccessServer -Identity "site1-cas" -AutodiscoverServiceInternalURI "https://internal.domain.com/autodiscover/autodiscover.xml" –AutodiscoverServiceSiteScope “site1”
The Command for Site2.
Set-ClientAccessServer -Identity "site2-cas" -AutodiscoverServiceInternalURI "https://internal.domain.com/autodiscover/autodiscover.xml" –AutodiscoverServiceSiteScope “site2”
Hope it helps
Best regards

It is there an alternative to the Test-SystemHealth powershell cmdlet for Exchange 2013?

Hello
The Powershell cmdlet Test-SystemHealth, that was available on Exchange 2010, is no longer available on Exchange 2013.
Test-SystemHealth cmdlet gathered data about the Microsoft Exchange system and analyzed the data according to best practices.
Are there any alternatives to this for Exchange 2013?
Thanks!

Haven't really played with it too much, but check out Get-ServerHealth
http://technet.microsoft.com/en-us/library/jj218703(v=exchg.150).aspx
Looks to have replaced Test-SystemHealth.

Best Practice Analyzer for Exchange 2013

Greetings,
I have upgraded the messaging infrastructure from Exchange 2007 to Exchange 2013.
I want to test the Health of the system through ExBPA for Exchange 2013.
But i don't find any setup for Exchange 2013 like it was in 2010.
I went through an article by Office365 community, according to which for In-premises Exchange also we need to have office 365 account (can use trial account also) to get the downloader file for ExBPA 2013.
http://community.office365.com/en-us/w/deploy/office-365-best-practices-analyzer-for-exchange-server-2013.aspx
But to run the setup the servers needs to be connected to internet.
And, i don't want to expose my environment to internet in any condition.
Somebody, please suggest me if there is any setup available so that i can install directly without exposing to internet.
Thanks in advance.
Best Regards,
K2

Welcome to Exchange 2013.
Exchange Server 2013 doesn't come with ExBPA for health check. This might help
http://exchangeserverpro.com/powershell-script-health-check-report-exchange-2010/
Apart from that you can run these commands too
Get-ServerHealth -Identity Exchange2013ServerName
Test-ServiceHealth
Cheers,
Gulab Prasad
Technology Consultant
Blog:
http://www.exchangeranger.com    Twitter:
  LinkedIn:
   Check out CodeTwo’s tools for Exchange admins
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Best practices for buying a digital certificate for Exchange 2013

Good dayfriends,
Could you indicateme which are the bestpractices when buying
a public digital certificatefor use onExchangeServer 2013.
I'd be interested in knowing your opinion about
using wildcardor SAN certificates.
Likewise what are the best recommendations
to include names and why they should or
should not include the internal FQDN
of my servers.
Currently I have an infrastructure that has two
MailBox servers,two CAS servers and an EDGE
2010 server, but I'm planning update it to Exchange 2013.
I searched what are the best
practices according to Microsoft but
have found little information.
I would appreciate
if you can post links like
Microsoft KBs and other technical documents that
discuss the above mentioned.
Thanking your
invaluable support.
Greetings.

Hi,
Personal suggestion, we can use two namespaces for your Exchange 2013:
Autodiscover.domain.com (Used for autodiscover service)
Mail.domain.com (used for all Exchange services external and internal URLs)
Please pointed mail.domain.com and autodiscover.domain.com to your internet facing CAS 2013.
For more information about Digital Certificates and SSL in Exchange 2013, please refer to the
Digital Certificates Best Practices part in the following technet article:
http://technet.microsoft.com/en-us/library/dd351044%28v=exchg.141%29.aspx?lc=1033
Additionally, here are some other scenarios about certificate planning in Exchange 2013:
http://blogs.technet.com/b/exchange/archive/2014/03/19/certificate-planning-in-exchange-2013.aspx
Regards,
Winnie Liang
TechNet Community Support

EXMON "exchange server user monitor" for Exchange 2013?

Hello,
it Looks like EXMON is not supported for Exchange 2013. Is this correct or can i use it with Server 2012 R2 and Exchange 2013 (CU6++) ?
Is there any alternative to check high log growth rate to see which user is responsable for this?
Thanks for Feedback.
best,
Martin

Hi Martin,
Yes, ExMon is not supported for exchange 2013.
Except the suggestion above, here is an exclusive application for you reference, it could retrieve statistics for all or selected mailboxes in a specified database and server, it may give you some help:
Exchange Server Mailbox Statistics Tool - v1.6.2
The tool retrieves mailbox statistics which includes Folder Count, Total Items, Associated Items, Deleted Items, Total Items Size, Deleted Items Size, Oldest Item Date, Newest Item Date, Items Age, Mailbox Age and Quota details. It also includes an additional
option named "Archive Statistics Planner" which will let you search mailboxes and provide statistics report with specific dates.
Best regards,
Niko Cheng
TechNet Community Support

Migration Exchange 2010 to Exchange 2013 with CAS Array and DAG

Dear All,
I am starting the migration of Exchange 2010 2 servers (CAS/Mailbox) with DAG no CAS Array to Exchange 2013 with 2 servers CAS array and 2 Mailbox servers with DAG. I read on some blogs that no requirement of CAS array on Exchange 2013. My concern how to
configure NLB on CAS servers for the client to connect.
Please guide and have any deployment guide for this, kindly share.
Thanks

Hi ,
As you said there is no use and meaning of having the cas array in exchange 2013 and also thanks a lot to Microsoft for introducing an single namespace facility in exchange 2013.
My suggestion and Microsoft recommendation should be to go with hardware load balancers for exchange 2013 rather than using the windows NLB and round robin method.
Why we need to go for HLB ?
Disadvantages
of some load balancing methods :
Windows
NLB :-
If you use Windows NLB then it can provide redundancy on server level failure and not on application level.
DNS
round robin :-
In case if we use the windows round robin method for load balancing then it wouldn't provide server level
and application level redundancy during the failures.At the Same time we need to manually adjust the DNS records during the server failure but on the client end dns caches will create the issues.
Configuring NLB for exchange 2013 :
http://msexchangeguru.com/2013/08/14/windowsnlb/
NLB configurations for exchange 2010 and 2013 will be same.
Configuring round robin for exchange 2013 :
http://exchangeserverpro.com/exchange-2013-client-access-server-high-availability/
Advisable method is to have the CAS and MBX roles on the same box if NLB not comes it to play.Because windows failover clustering and NLB cannot be configured on the same box.In exchange 2013 cas role is a stateless server role so there is no need to have
that role on a separate box.
Thanks & Regards S.Nithyanandham

Disaster Recovery site for Exchange 2013

Hi, I have to build DR site with Exchange 2013 environment and unable to see document for Exchange 2013 perspective.
In new environment will contain 10 CAS/MBS co-located servers in primary datacenter with two mailbox copies and disaster recovery site with 5 Exchange 2013 CAS/MBS co-located servers with one database copy in blocked activation mode. Any document related
to this screnario would be helpful. The required solution is when all the servers in PDC goes down then DR site would be activated at DMZ level and Server level. Can I use same IP subnet/Site for the DR site?

Hi,
Yes, you can use the same subnet for DR site. If you use the same subnet, you need to use stretched VLAN.
Here is a related thread for your reference. (This case is for Exchange 2010, but it also applies to Exchange 2013 DAG deployment)
http://social.technet.microsoft.com/Forums/exchange/en-US/80ca452f-f950-4496-83e8-3067d571bb57/exchange-2010-dag-across-sites-different-subnets-vs-stretched-vlan?forum=exchangesvravailabilityandisasterrecovery
Best regards,
Belinda Ma
TechNet Community Support

Error Preparing Schema for Exchange 2013

I recive this error when running the preparing AD for exchange 2013 on a 2012 r2 server.
Error:
The following error was generated when "$error.Clear();
# O15# 2844081 - Create PartnerApplication "Exchange Online" in DC and On-Premise
$exch = [Microsoft.Exchange.Data.Directory.SystemConfiguration.WellknownPartnerApplicationIdentifiers]::Exchange;
$exchApp = Get-PartnerApplication $exch -ErrorAction SilentlyContinue -DomainController $RoleDomainController | Where { $_.UseAuthServer };
if ($exchApp -eq $null)
$exchAppName = "Exchange Online";
$exchApp = New-PartnerApplication -Name $exchAppName -ApplicationIdentifier $exch -Enabled $RoleIsDatacenter -AcceptSecurityIdentifierInformation $false -DomainController $RoleDomainController;
# Create application account for Exchange
$appAccountName = $exchApp.Name + "-ApplicationAccount";
$appAccount = Get-LinkedUser -Identity $appAccountName -ErrorAction SilentlyContinue -DomainController $RoleDomainController;
if ($appAccount -eq $null)
$appAccountUpn = $appAccountName.Replace(" ", "_") + "@" + $RoleFullyQualifiedDomainName;
$appAccount = New-LinkedUser -Name $appAccountName -UserPrincipalName $appAccountUpn -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "UserApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "ArchiveApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "LegalHoldApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "Mailbox Search" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "TeamMailboxLifecycleApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "MailboxSearchApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
Set-PartnerApplication -Identity $exchApp.Identity -LinkedAccount $appAccount.Identity -DomainController $RoleDomainController;;
" was run: "Couldn't find a user with the identity "ESL.LOC/Users/Exchange Online-ApplicationAccount".".
Error:
The following error was generated when "$error.Clear();
# O15# 2844081 - Create PartnerApplication "Exchange Online" in DC and On-Premise
$exch = [Microsoft.Exchange.Data.Directory.SystemConfiguration.WellknownPartnerApplicationIdentifiers]::Exchange;
$exchApp = Get-PartnerApplication $exch -ErrorAction SilentlyContinue -DomainController $RoleDomainController | Where { $_.UseAuthServer };
if ($exchApp -eq $null)
$exchAppName = "Exchange Online";
$exchApp = New-PartnerApplication -Name $exchAppName -ApplicationIdentifier $exch -Enabled $RoleIsDatacenter -AcceptSecurityIdentifierInformation $false -DomainController $RoleDomainController;
# Create application account for Exchange
$appAccountName = $exchApp.Name + "-ApplicationAccount";
$appAccount = Get-LinkedUser -Identity $appAccountName -ErrorAction SilentlyContinue -DomainController $RoleDomainController;
if ($appAccount -eq $null)
$appAccountUpn = $appAccountName.Replace(" ", "_") + "@" + $RoleFullyQualifiedDomainName;
$appAccount = New-LinkedUser -Name $appAccountName -UserPrincipalName $appAccountUpn -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "UserApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "ArchiveApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "LegalHoldApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "Mailbox Search" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "TeamMailboxLifecycleApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
New-ManagementRoleAssignment -Role "MailboxSearchApplication" -User $appAccount.Identity -DomainController $RoleDomainController;
Set-PartnerApplication -Identity $exchApp.Identity -LinkedAccount $appAccount.Identity -DomainController $RoleDomainController;;
" was run: "Couldn't find a user with the identity "ESL.LOC/Users/Exchange Online-ApplicationAccount".".

Hi,
Fist, please check if there is an account which is Exchange Online-ApplicationAccount via ADUC.
By default, this account is disabled, please enable it and re-run Setup /PrepareAD again. It should success. After preparing AD schema, please disable the account again.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

F5 Big IP 4000 Send /Return String for Exchange 2013

Hi,
I need to Implement F5 Big IP 4000 and need to set send / return string for Exchange 2013 server for OWA monitoring... Can anyone help me with Exact output String.
Amit

Hi,
In the Send String box enter in GET /owa/healthcheck.htm. In the
Receive String box, enter in 200 OK.
Here is a related article for your reference.
http://port25guy.com/2013/07/24/how-to-use-managed-availability-in-exchange-2013-with-your-load-balancer/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make
sure that you completely understand the risk before retrieving any suggestions from the above link.
Hope this is helpful to you.
Best regards,
Belinda Ma
TechNet Community Support

Is smb 3.0 already supported for exchange 2013

Hello,
We are looking to deploy exchange 2013. We have a netapp storage and vmware environment.
I was wondering if smb 3.0 is already supported for exchange 2013. I read in a blog of 2012 that it wasn't supported at the time. We would like to use it instead of a iscsi lun.

Hi,
Based on my knowledge, it is still not supported for Exchange 2013 up to now.
Here is an article for your reference, please refer to the "Exchange storage requirements" section.
Exchange 2013 Virtualization
http://technet.microsoft.com/en-us/library/jj619301.aspx#BKMK_Prereq
Another related article for your reference.
Exchange 2013 Storage Configuration Options
http://technet.microsoft.com/en-us/library/ee832792(v=exchg.150).aspx
Best regards,
Belinda
Belinda Ma
TechNet Community Support

BPA for Exchange 2013 still in beta!?

Exchange 2013 is over 2 years old.
Is Microsoft ever going to release a BPA for their flagship messaging platform that's NOT in beta?

Hi,
At present, there is only a beta of Best Practices Analyzer for Exchange 2013 available. If you want to get the latest information about it, please pay attention to the Exchange blog.
For your convenience:
http://blogs.technet.com/b/exchange/
Hope this can be helpful to you.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

PowerGUI Powerpack for Exchange 2013

Is there a powerpack that can be added to the powerGUI script editor for scripting in exchange 2013?

Hi,
Based on my search, currently, there is no official document about
PowerGUI Powerpack for Exchange 2013.
However, we can connect to Exchange server using remote shell.
For more details about this, please refer to the following article.
https://technet.microsoft.com/en-us/library/dd335083(v=exchg.150).aspx
Hope this is helpful to you.
Best regards,
Belinda Ma
TechNet Community Support

SSL for Exchange 2013 with ARR

Similar Messages

Maybe you are looking for