Applies to: Exchange Server 2007 SP3, Exchange Server
2007 SP2, Exchange Server 2007 SP1
Topic Last Modified: 2010-04-20
The following Microsoft Exchange Server 2007 installation guide template can be used as a starting point for formally documenting your organization's server build procedures for Exchange 2007 servers that have the Client Access server role installed.
Executive Summary
The purpose of this document is to explain the installation and configurations necessary to install Exchange 2007 Client Access server role on the Windows Server 2008 platform.
Business Justification
By having an installation guide, Contoso will be able to ensure standardization across the enterprise, reducing Total Cost of Ownership, and easing troubleshooting steps.
Scope
The scope of this document is limited to installation of an Exchange 2007 Client Access server for Contoso on the Windows Server 2008 x64 Edition operating system platform.
Prerequisites
The operator should have working knowledge of Windows Server 2008 x64 Edition concepts, Exchange Server 2007 concepts, the Exchange Management Console and Exchange Management Shell, the command line, and various system utilities. This document does not elaborate on the details of any system utility except as necessary to complete the tasks within.
In addition, the operator should review the Planning for Client Access Servers topic in the Exchange 2007 Online Help before implementing the server role.
Assumptions
This document assumes that Windows Server 2008 x64 Edition is installed per company baseline regulations which include the latest approved service pack and hotfixes.
This document assumes that forest and domain preparation steps have been performed per How to Prepare Active Directory and Domains topic in the Exchange 2007 Online Help.
This document assumes that both Exchange 2007 and Windows Server 2008 will be secured following the best practices found in the following documentation:
- Exchange Server 2007: Security and
Protection
- Windows Server 2008: Windows Server 2008 Security Guide
Important: |
---|
The procedures within this document should be followed sequentially. If changes are made out of sequence, unexpected results may occur. |
Server Configuration
The following media are required for this section.
- Windows Server 2008 x64 Edition media
- Exchange 2007 Configuration DVD
Note: For instructions about how to build your Exchange 2007 Configuration DVD, see How to Create a Configuration DVD and Automation Files.
Additional Software Verification
- Verify that Remote Desktop is enabled.
- As an optional process, install Microsoft Network Monitor.
Network Interfaces Configuration
- Log on to the server with an account that has at least local
administrative access.
- Click Start, Control Panel and double-click Network
and Sharing Center.
- Click Manage Network Connections.
- Locate the connection for the internal network and rename it
appropriately.
- Right-click the connection and select Properties.
- For the TCP/IP Protocol add the following:
- Static IP Address, Subnet Mask, and
Gateway
- DNS Server IP Addresses
- Check the box to Append parent suffixes of the primary DNS
suffix
- WINS IP Addresses (if using WINS)
- Static IP Address, Subnet Mask, and
Gateway
Drive Configuration
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Click Start, Administrative Tools, and select
Computer Management.
- Expand Storage and click on Disk Management.
- Open the Disk Management Microsoft Management Console (MMC) and
format, rename, and assign the appropriate Drive Letters so
that the volumes and DVD drive match the appropriate server
configuration. At the very least, there should be a D drive for the
Exchange binaries and the DVD drive should be configured as the Z
drive. Refer to the Database Log logical unit number (LUN) Appendix
at the end of this document for the actual drive configuration that
should be used.
Drive configuration
LUN Drive letter Usage 1
C
Operating system
2
D
Exchange binaries
3
Z
DVD drive
Windows Server 2008 Hotfix Installation
All hotfixes are installed through a batch file. For a complete list of hotfixes that are installed, see Contoso server build DVD hotfix list. A sample hotfix list can be seen at Server Build DVD - Sample Hotfix List.
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access and has been delegated
local Administrator access.
- Insert the Exchange 2007 Configuration DVD.
- Browse to \W2K8-HotFix\ and double-click
W2K8-hotfix.bat.
- Click Yes for any Digital Signature not Found dialog
boxes that may appear.
Note: These dialog boxes will not appear in environments that have not deployed the Windows Security templates. - Wait for all file copies to complete and restart the
server.
Domain Membership Configuration
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Click Start, right-click My Computer and select
Properties.
- Under the Computer Name, domain, and workgroup settings,
click Change Settings.
- Click Change.
- Choose the Domain option button and enter the
appropriate Domain name.
- Enter the appropriate credentials.
- Click OK and OK.
- Click OK to close the System Properties.
- Restart the server.
Local Administrators Verification
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Verify (or add if not already there) that the following
accounts are members of the local administrators group on this
server.
Local administrators
Item Account Description Role 1
Domain Admins
Domain Administrative Global Group
Administrator
2
Root Domain\Exchange Organization Administrators
Exchange Administrators
Administrator
- Verify that your user account is a member of a group which is a
member of the local administrators group on the Windows Server 2008
server. If it is not, use an account that is a member of the local
administrators group before continuing.
Local Administrator Account Password Reset
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Click Start, right-click Computer and select
Manage.
- Expand the nodes to find Configuration\Local Users and
Groups\Users.
- Right-click Administrator and select Set
Password. Change the password so that it meets strong
complexity requirements.
- As an optional step, right-click Administrator and
select Rename. Rename the account according to company
regulations.
Tools Installation
This section installs several useful tools that will aid administrators in Exchange administration and in troubleshooting support issues.
Note: |
---|
Debugging Tools for Windows will allow administrators to debug processes that are affecting service and determine root cause. For more information, see Install Debugging Tools for Windows 32-bit Version. |
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Insert the Exchange 2007 Configuration DVD.
- Open a command prompt and navigate to the \Support
folder.
- Run the following command where DVDROM-Drive is the DVD
drive: W2K8Toolsinstall.cmd DVDROM-Drive (ex:
W2K8Toolsinstall.cmd Z:).
- Right-click the c:\Tools folder and select
Properties.
- Click the Security tab.
- Click the Advanced button.
- Uncheck Inheritance and copy the permissions.
- Remove the Everyone (and if listed, the Authenticated
Users) security principal.
- Add the following groups, granting FULL CONTROL:
- SYSTEM
- The local Administrators group
- Creator Owner
- SYSTEM
Page File Modifications
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Click Start, right-click Computer and select
Properties.
- Select the Advanced System Settings.
- Under Startup and Recovery, click the Settings
button.
- Under Write Debugging Information, change the memory
dump drop-down list to Kernel Memory Dump.
- Click OK.
- Under Write Debugging Information, change the memory
dump drop-down list to Kernel Memory Dump.
- Under Performance, click the Settings button.
- Click the Advanced tab.
- Under Virtual Memory, click the Change
button.
- On servers that have a dedicated page file drive, follow these
steps:
- In the Drive list, click C:, and then click
Custom size.
- For the C: drive, set the Initial Size (MB) value to a
minimum of 200 MB. (Windows requires between 150 MB and 2 GB page
file space, depending on server load and the amount of physical RAM
that is available for page file space on the boot volume when
Windows is configured for a kernel memory dump. Therefore, you may
be required to increase the size.)
- For the C: drive, set the Maximum Size (MB) value to
that of the Initial Size.
- In the Drive list, select the page file drive (for
example, the P: drive), and then click Custom size.
- In the Initial Size (MB) box, type the result of one of
the following calculations:
If the server has less than 8 GB of RAM, multiply the amount of RAM times 1.5,.
If the server has 8 GB of RAM or more, add the amount of RAM plus 10 MB.
- In the Maximum Size (MB) box, type the same amount that
you typed in the Initial Size box.
- Delete all other page files.
- Click OK.
- In the Drive list, click C:, and then click
Custom size.
- On servers that do not have a dedicated page file drive, follow
these steps:
- In the Drive list, click C:, and then click
Custom size.
- For the C: drive, in the Initial Size (MB) box, type the
result of one of the following calculations:
If the server has less than 8 GB of RAM, multiply the amount of RAM times 1.5.
If the server has 8 GB of RAM or more, add the amount of RAM plus 10 MB.
- Delete all other page files.
- Click OK.
- In the Drive list, click C:, and then click
Custom size.
- Click OK two times to close the System Properties
dialog box.
- Click No if prompted to restart the system.
Note: For more information about Page File recommendations, see the following Microsoft Knowledge Base articles: How to determine the appropriate page file size for 64-bit versions of Windows Server 2003 or Windows XP; and Overview of memory dump file options for Windows Vista, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows XP, and Windows 2000.
Drive Permissions
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Click Start and select Computer.
- Right-click the D Drive and select
Properties.
- Click the Security tab.
- Click Edit.
- Click Add and select the local server from
Locations.
- Grant the following rights as outlined in the following
table.
Drive permissions
Account Permissions Administrators
Full Control
SYSTEM
Full Control
Authenticated Users
Read and Execute, List, Read
CREATOR OWNER
Full Control
- Click the Advanced button.
- Select the CREATOR OWNER permission entry and click
View/Edit.
- Select Subfolders and Files Only from the drop-down
list.
- Click OK two times.
- Click OK to close the drive properties.
- Repeat steps 3-12 for each additional drive (other than the C
drive).
Load Balancing Configuration
This section only needs to be performed on Client Access servers that will be used in a load balanced array. In particular, this section focuses on Windows Network Load Balancing. For more information about Network Load Balancing within Windows Server, see Network Load Balancing Technical Reference and Network Load Balancing Clusters. If you are deploying a hardware load balancing array, review your vendor’s documentation and follow their guidance for configuration.
Network Load Balancing Installation and Configuration
The values selected in Network Load Balancing, must be the same across all nodes in the cluster.
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access.
- Install Network Load Balancing by opening an administrative
command prompt and executing the following command:
Copy Code servermanagercmd.exe -i nlb
- Click Start, Administrative Tools and right-click
Network Load Balancing Manager.
- Click Cluster-New.
- In the New Cluster wizard, enter the local server’s
computer name and click Connect and select the appropriate
network connection.
- Click Next.
- In the Host Parameters section, verify the host’s IP
address and subnet mask.
- Click Next.
- In the Cluster IP Address section, click Add and
enter:
- IP Address
- Subnet Mask
- IP Address
- Click Next.
- In the Cluster Parameters section, enter in the Full
Internet Name (for example, mail.contoso.com) that will be used
by the cluster and ensure Unicast is selected.
- Click Next.
- In the Port Rules section, select the default rule and
click Edit.
- Under Port Range, change the From value to
80 and the To value to 80.
- Under Protocols, select TCP.
- Click OK.
- Click Add to create a new port rule.
- Under Port Range, change the From value to
443 and the To value to 443.
- Under Protocols, select TCP.
- Click OK.
Note: If using IMAP or POP in the environment, be sure to create the appropriate rules.
- Under Port Range, change the From value to
443 and the To value to 443.
- Click Add to create a new port rule.
- Under Port Range, change the From value to
143 and the To value to 143.
- Under Protocols, select TCP.
- Click OK.
- Under Port Range, change the From value to
143 and the To value to 143.
- Click Add to create a new port rule.
- Under Port Range, change the From value to
110 and the To value to 110.
- Under Protocols, select TCP.
- Click OK.
- Under Port Range, change the From value to
110 and the To value to 110.
- Click Add to create a new port rule.
- Under Port Range, change the From value to
993 and the To value to 993.
- Under Protocols, select TCP.
- Click OK.
- Under Port Range, change the From value to
993 and the To value to 993.
- Click Add to create a new port rule.
- Under Port Range, change the From value to
995 and the To value to 995.
- Under Protocols, select TCP.
- Click OK.
Note: If using IPSec in the environment, be sure to create a rule for UDP 500.
- Under Port Range, change the From value to
995 and the To value to 995.
- Click Add to create a new port rule.
- Under Port Range, change the From value to
500 and the To value to 500.
- Under Protocols, select UDP.
- Click OK.
- Under Port Range, change the From value to
500 and the To value to 500.
- Click OK.
- Click OK to acknowledge the resulting dialog.
- While still in the internal network connection properties,
click Internet Protocol (TCP/IP) and select
Properties.
- Click Advanced.
- Under IP Addresses, click Add.
- Enter the virtual IP Address and Subnet Mask and
click OK.
- Click OK.
- Enter the virtual IP Address and Subnet Mask and
click OK.
- Click Finish to complete the New Cluster wizard.
DNS Entry Creation
Submit a change request and have the domain name that was specified in the Network Load Balancing Installation and Configuration section for the Network Load Balancing cluster (for example, mail.contoso.com) created as a host record associated to the Network Load Balancing cluster’s IP address.
Verification Steps
Organizational Unit Verification
Submit a change request and have the computer object moved to the appropriate organizational unit (OU). If following the recommendations in the Exchange 2007 Security Guide, the OU will be \Member Servers\Exchange Backend Servers\Exchange Client Access Servers.
Active Directory site Verification
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Open a command prompt.
- Verify that the server is in the correct domain and Active
Directory site. At the command line type the following:
Copy Code NLTEST /server:%COMPUTERNAME% /dsgetsite
- The name of the Active Directory site to which the server
belongs will be displayed. If the server is not in the correct
Active Directory site, submit a change request to the appropriate
operations group and have the server moved to the appropriate
Active Directory site.
Domain Controller Diagnostics Verification
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Open a command prompt and change paths to the C drive.
- Run the following command:
Copy Code dcdiag /s:<Domain Controller> /f:c:\dcdiag.log
Note: Change <domain Controller> to a domain controller contained within the same Active Directory site as the Exchange server. - Review the output of C:\dcdiag.log file and verify that
there are no connectivity issues with the local domain
controller.
- Repeat steps 3 and 4 for each domain controller in the local
Active Directory site.
Note: Domain Controller Diagnostics (DCDiag) is a Windows support tool that tests network connectivity and DNS resolution for domain controllers. If the account being used does not have administrative privileges, several tests under the Doing primary tests heading may not pass. These tests can be ignored if the connectivity tests pass. In addition, the log file may report that some service validation tests did not pass. These messages can be ignored if the services do not exist on the domain controller.
Exchange Best Practices Analyzer Verification
- Connect to a server in the environment that either has the
Exchange Best Practices Analyzer installed or the Exchange 2007
Management tools installed through Remote Desktop and log on with
an account that has local administrative access. Depending on the
configuration, do the following:
- Click Start, All Programs, Microsoft Exchange and select
Best Practices Analyzer.
- Click Start, All Programs, Microsoft Exchange Server
2007 and select Exchange Management Console.
- Click Toolbox.
- Double-click Best Practices Analyzer.
- Check and apply any updates for the Best Practices Analyzer
engine.
- Provide the appropriate information to connect to Active
Directory and then click Connect to the Active Directory
server.
- In the Start a New Best Practices Scan, select
Exchange 2007 Readiness Check and then click Start
Scanning.
- Review the report and take action on any errors or warnings
that are reported by following the resolution articles that are
provided within the Best Practices Analyzer.
Note: The Microsoft Exchange Analyzers help Microsoft Exchange Server administrators troubleshoot various operational support issues.
Exchange Server Role Installation
The following CD media are required for this section.
- Microsoft Exchange 2007 DVD
- Exchange 2007 Configuration DVD
Exchange 2007 Prerequisites Installation
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Open an administrative command prompt window.
- Run the following command where <path> references the
E2K7 CONFIG DVD \E2K7-PreReqs folder:
Copy Code ServerManagerCmd -ip <path>\Exchange-Base.XML
- Run the following command where <path> references the
E2K7 CONFIG DVD \E2K7-PreReqs folder and <Exchange-role>
references the appropriate role XML file:
Copy Code ServerManagerCmd -ip <path>\<Exchange-role>.XML
- Restart the server if required.
Exchange 2007 Installation
Though this document uses the command line method for installing the Exchange roles, the GUI can also be used. For more information about how to use the setup GUI to install an Exchange server role, see the Exchange 2007 Online Help topic How to Perform a Custom Installation Using Exchange 2007.
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher) if the server
has been pre-created.
- Follow the procedure from the Exchange 2007 Online Help topic
How to Install
Exchange 2007 in Unattended Mode. For example, setup.com /r:CA
/t:d:\exchsrvr.
- Restart the server, if required.
- To prevent the use of the server role before it is fully
configured, open an administrative command prompt and stop the IIS
services by running the following command:
Copy Code net stop iisadmin /y.
Exchange Server 2007 Post-SP1 Roll-up Installation
All hotfixes are installed through a batch file. For a complete list of hotfixes that are installed, see Contoso server build DVD hotfix list. A sample hotfix list can be seen at Server Build DVD - Sample Hotfix List.
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access and was delegated
local Administrator access.
- Insert the Exchange 2007 Configuration DVD.
- Browse to \E2K7-PostSP1\ and double-click
E2K7-postsp1.bat.
- Click Yes for any Digital Signature not Found dialog
boxes that may appear
Note: These dialog boxes will not appear in environments that have not deployed the Windows Security templates. - Wait for all file copies to complete and restart the
server.
Product Key Configuration
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access and was delegated the
Exchange Organization Administrator role.
- Follow the procedure outlined in the Exchange 2007 Online Help
topic How to
Enter the Product Key.
Security Configuration Wizard
This section is optional and may be skipped.
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Follow the procedures from the Exchange 2007 Online Help topic
How to Install
the Security Configuration Wizard to install the Security
Configuration Wizard.
- Follow the procedures from the Exchange 2007 Online Help topic
How to Register
Exchange Server Role SCW Extensions to register the Exchange
2007 Server SCW extension.
- Follow the procedures from the Exchange 2007 Online Help topic
How to Create a
New Exchange Server Role SCW Policy to configure and apply the
policy.
System Performance Verification
By default, Exchange 2007 optimizes the server’s memory management for programs, which configures the server’s system cache as the default size.
- Connect to the server through Remote Desktop and log on with an
account that has local administrative access.
- Click Start, right-click Computer and select
Properties.
- Select the Advanced System Settings.
- Under Performance, click the Settings button.
- Click the Advanced tab.
- Verify that the Processor Scheduling is set to
Background Services.
- Click the Advanced tab.
- Click OK.
Exchange Server Role Configuration
Commercial Certificate Configuration
A commercial certificate is only needed if the Client Access server will service client requests from the Internet or to facilitate un-trusted cross-forest communication between Client Access servers.
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher).
Note: For more information about using the certificate tasks, see the Exchange 2007 Online Help topic Creating a Certificate or Certificate Request for TLS. Note: If generating a certificate that will use Subject Alternative Names, be sure that the certificate’s principal name will be the one that the clients (for example, Outlook) will use to connect (for example, mail.contoso.com). In other words, do not list the Autodiscover namespace as the principal name in the certificate. - Generate the certificate request by using the following
Exchange Management Shell command. The DomainName parameter
includes the principal URL, Autodiscover FQDN, and the server FQDN.
The FriendlyName parameter matches the principal URL that is
used by Outlook Web Access and Outlook Anywhere.
Copy Code New-ExchangeCertificate -GenerateRequest -SubjectName [Full Subject Path] -DomainName mail.contoso.com, autodiscover.contoso.msft, CAS01, CAS01.contoso.com -FriendlyName mail.contoso.com -privatekeyexportable:$true -path c:\cert.txt
Note: An example of [Full Subject Path] is "c=US, o=Company, cn=CAS01.contoso.com". Note: In Windows Vista, the Windows RPC/HTTP client-side component required that the Subject Name (Common Name) on the certificate match the “Certificate Principal Name” configured for the Outlook Anywhere connection in the Outlook profile. This behavior was changed in Windows Vista Service Pack 1 (SP1). Therefore, as a best practice, make sure that mail.contoso.com is listed as the Subject Name in your certificate unless you plan to change the configuration. To change the configuration, use the Set-OutlookProvider cmdlet with the -EXPR parameter. For more information about how to change the configuration, see the Exchange Team Blog article, When , if and how do you modify Outlook Providers? - Submit the request file to the Certificate Authority (CA) and
have the CA generate the certificate.
- After receiving the certificate, import and enable the
certificate by running the following Exchange Management Shell
command where [services] can be POP, IMAP, IIS, or a
combination:
Copy Code Import-ExchangeCertificate -path c:\newcert.cer | Enable-ExchangeCertificate -services "[services]"
- To mandate SSL on the default Web site, do the following:
- Open Internet Information Services (IIS) Manager.
- Expand the Server Node object and the Sites
node.
- Click the Default Web Site.
- In the middle pane, double-click SSL Settings.
- Verify Require secure channel (SSL) is enabled.
Note: If you require 128-bit encryption, also verify that Require 128-bit encryption is enabled. - Open Internet Information Services (IIS) Manager.
Autodiscover Configuration
An example script that performs the steps outlined in this section is included in the Exchange 2007 Configuration DVD. It is located within the E2K7-Scripts\CAS folder and is named ConfigureAutoDiscover.ps1. For more information about how to use the script, execute .\ConfigureAutoDiscover.ps1 –help.
For more information about deployment considerations for the Autodiscover service, see the Exchange 2007 Online Help topic Deployment Considerations for the Autodiscover Service.
- Connect to an Exchange 2007 server via Remote Desktop and log
on with an account that has local administrative access and has
been delegated the Exchange Server Administrator role (or
higher).
- Configure the internal Autodiscover URL by running the
following command within the Exchange Management Shell where CAS01
is the name of the Client Access server and internal.domain.fqdn is
the name of the internal namespace used for Autodiscover:
Copy Code Set-ClientAccessServer -Identity CAS01 -AutoDiscoverServiceInternalUri "https://internal.domain.fqdn/autodiscover/autodiscover.xml"
- Optional: Follow the procedure outlined in the Exchange 2007
Online Help topic How to Configure
Exchange Services for the Autodiscover Service to configure the
Autodiscover service for usage by Internet clients. This will
enable Outlook Anywhere and set the offline address book (OAB), Web
Services, and Unified Messaging virtual directories external URL
parameter.
- Optional: Follow the procedure outlined in the Exchange 2007
Online Help topic How to Configure
Autodiscover for Exchange ActiveSync for usage by Internet
clients.
- Optional: Enable site affinity by following the procedure
outlined in the Exchange 2007 Online Help topic How to Configure the
Autodiscover Service to Use Site Affinity.
- Verify that Autodiscover functions correctly by following the
procedure outlined in the Exchange 2007 Online Help topic How to Test Outlook 2007
Autodiscover Connectivity.
Outlook Anywhere Configuration
An example script that performs the steps outlined in this section is included in the Exchange 2007 Configuration DVD. It is located within the E2K7-Scripts\CAS folder and is named ConfigureOLAnywhere.ps1. For more information about how to use the script, execute .\ConfigureOLAnywhere.ps1 –help.
Note: |
---|
If step 3 from the Autodiscover Configuration section was followed, then this section can be skipped. |
- Connect to an Exchange 2007 server via Remote Desktop and log
on with an account that has local administrative access and has
been delegated the Exchange Server Administrator role (or
higher).
- Optional: Follow the procedure outlined in the Exchange 2007
Online Help topic How to Enable Outlook
Anywhere to enable Outlook Anywhere.
- Optional: Follow the procedure outlined in the Exchange 2007
Online Help topic How to Configure an
External Host Name for Outlook Anywhere if the server will be
servicing Outlook Anywhere clients on the Internet.
Important: |
---|
When installing the Exchange 2007 SP1 Client Access server role on Windows Server 2008 to support Outlook Anywhere, you will need to manually modify the default Internet Information Services (IIS) 7.0 concurrent connection limit. The default value is 5,000 concurrent connections. We recommend changing this setting to a value between 20,000 and 65,535 concurrent connections. |
- Open an administrative command prompt and navigate to the
%windir%\system32\inetsrv directory.
- Run the following commands:
Copy Code %windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/Rpc" -section:system.webServer/serverRuntime -appConcurrentRequestLimit:65535 -commitpath:apphost %windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/RpcWithCert" -section:system.webServer/serverRuntime -appConcurrentRequestLimit:65535 -commitpath:apphost
Offline Address Book Configuration
An example script that performs the steps outlined in this section is included in the Exchange 2007 Configuration DVD. It is located within the E2K7-Scripts\CAS folder and is named ConfigureOAB.ps1. For more information about how to use the script, execute .\ConfigureOAB.ps1 –help.
Note: |
---|
If the Client Access server will not be a distribution point
for the OAB, this section can be skipped. By default, the OAB virtual directory does not require SSL. By default, Client Access servers use self-signed certificates for providing HTTP and RPC encryption. Clients that use the BITS service to download files (like OAB) cannot use self-signed certificates. If a commercial certificate is going to be used and ISA 2006 is not going to be used to enforce SSL, then SSL should be enabled on the OAB virtual directory. |
- Connect to an Exchange 2007 server via Remote Desktop and log
on with an account that has local administrative access and has
been delegated the Exchange Server Administrator role (or
higher).
Note: To use OAB Web distribution, the OAB must be generated on an Exchange 2007 Mailbox server. If the OAB is not generated on an Exchange 2007 Mailbox server, step 2 can be skipped. - Launch the Exchange Management Shell and run the following
commands where CAS01 is the name of the Client Access server and
mail.contoso.com is the name of the external URL:
Copy Code $a=get-oabvirtualdirectory -Server CAS01 Set-oabvirtualdirectory $a -ExternalURL https://mail.contoso.com/OAB Set-OfflineAddressBook "default offline address book" -VirtualDirectories $a iisreset /noforce
- Optional: Follow the procedure outlined in the Exchange 2007
Online Help topic How to Require SSL for
Offline Address Book Distribution if the server has a
commercial certificate and will be servicing requests from the
Internet and ISA 2006 will not be in use to enforce SSL for
Internet requests.
IMAP4 Configuration
If the Client Access server will not allow IMAP4 connections, this section may be skipped.
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher).
- Open the Exchange Management Shell.
- To configure the IMAP4 bindings, run the following command
where CAS01 is the Client Access server and 0.0.0.0 implies any IP
address:
Copy Code Set-ImapSettings -server CAS01 -UnencryptedOrTLSBindings "0.0.0.0:143" -SSLBindings "0.0.0.0:993"
- To disable plain text authentication and enable custom calendar
item retrieval option for IMAP4, run the following command where
mail.contoso.com is the certificate name and external URL:
Copy Code Set-ImapSettings -server CAS01 -X509CertificateName "mail.contoso.com" -LoginType SecureLogin -CalendarItemRetrievalOption Custom -OwaServerUrl https://mail.contoso.com/owa
- To enable the Exchange IMAP4 service for automatic startup, run
the following command:
Copy Code Set-Service MSExchangeIMAP4 -StartupType automatic
- To configure the IMAP4 bindings, run the following command
where CAS01 is the Client Access server and 0.0.0.0 implies any IP
address:
POP3 Configuration
If the Client Access server will not allow POP3 connections, this section may be skipped.
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher).
- Open the Exchange Management Shell.
- To configure the POP3 bindings, run the following command where
CAS01 is the Client Access server and 0.0.0.0 implies any IP
address:
Copy Code Set-PopSettings -server CAS01 -UnencryptedOrTLSBindings "0.0.0.0:110" -SSLBindings "0.0.0.0:995"
- To disable plain text authentication and enable custom calendar
item retrieval option for POP3, run the following command where
mail.contoso.com is the certificate name and external URL:
Copy Code Set-PopSettings -server CAS01 -X509CertificateName "mail.contoso.com" -LoginType SecureLogin -CalendarItemRetrievalOption Custom -OwaServerUrl https://mail.contoso.com/owa
- To enable the Microsoft Exchange POP3 service for automatic
startup, run the following command:
Copy Code Set-Service MSExchangePOP3 -StartupType automatic
- To configure the POP3 bindings, run the following command where
CAS01 is the Client Access server and 0.0.0.0 implies any IP
address:
Outlook Web Access Configuration (Internet Scenario)
Follow the steps in this section if the Client Access server will service directly from the Internet and ISA 2006 pre-authentication mechanisms are not in use.
If either is true, then skip this section and follow the steps outlined in the Outlook Web Access Configuration (Proxy Scenario) section below.
Note: |
---|
An example script that performs steps 1-8 in this section is included in the Exchange 2007 Configuration DVD. It is located within the E2K7-Scripts\CAS folder and is named ConfigureOWA.ps1. For more information about how to use the script, execute .\ConfigureOWA.ps1 –help. |
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher).
- By default, when the Client Access server role is installed,
forms-based authentication is enabled. Ensure that forms-based
authentication is enabled by following the procedure outlined in
the Exchange 2007 Online Help topic How to Configure
Forms-Based Authentication for Outlook Web Access.
- Configure the public and private cookie timeouts by following
the procedures outlined in the Exchange 2007 Online Help topic
How to Set the
Forms-Based Authentication Public Computer Cookie Time-Out
Value and How to Set the
Forms-Based Authentication Private Computer Cookie Time-Out
Value.
- Optional: Configure GZip compression by following the procedure
outlined in the Exchange 2007 Online Help topic How to Configure Gzip
Compression Settings.
- Configure WebReady Document Viewing by following the procedure
outlined in the Exchange 2007 Online Help topic How to Manage WebReady
Document Viewing.
- Configure private and public computer file access by following
the procedure outlined in the Exchange 2007 Online Help topic
How to Manage
Public and Private Computer File Access.
- Configure Windows SharePoint and Windows File Share integration
by following the procedure outlined in the Exchange 2007 Online
Help topic How
to Enable or Block Access from Public and Private
Computers.
- Optional: If redirection is to be used, then run the following
command from the Exchange Management Shell where CAS01 is the name
of the Client Access server and mail.contoso.com is the name of the
external URL:
Copy Code Set-OwaVirtualDirectory -identity "CAS01\owa (Default Web Site)" -ExternalURL https://mail.contoso.com/owa
- If legacy Mailbox servers exist within the organization, then
you will need to follow these steps:
- Follow the procedures outlined in the following topics, but
replace the value of the identity parameter with ”CAS01\exchange
(Default Web Site)” (where CAS01 is the name of the Client Access
server).
- By default, when the Client Access server role is installed,
forms-based authentication is enabled. Ensure that forms-based
authentication is enabled by following the procedure outlined in
the Exchange 2007 Online Help topic How to Configure
Forms-Based Authentication for Outlook Web Access.
- Optional: Configure GZip compression by following the procedure
outlined in the Exchange 2007 Online Help topic How to Configure Gzip
Compression Settings.
- Repeat step a, but use "CAS01\exchweb (Default Web Site)” for
the value of the identity parameter.
- Repeat step a, but use "CAS01\public (Default Web Site)” for
the value of the identity parameter.
- Follow the procedures outlined in the following topics, but
replace the value of the identity parameter with ”CAS01\exchange
(Default Web Site)” (where CAS01 is the name of the Client Access
server).
- Optional: To simplify the Outlook Web Access URL and redirect
users to HTTPS, follow the procedure outlined in the Exchange 2007
Online Help topic How to Simplify the
Outlook Web Access URL.
- Restartt the Client Access server.
Outlook Web Access Configuration (Proxy Scenario)
Follow the steps in this section if the Client Access server meets the following conditions.
- Will not service requests directly from the Internet, but
instead will receive requests from other Client Access servers that
are located in other Active Directory sites.
- Will be using ISA 2006 to pre-authenticate Internet
requests.
For more information about how to configure ISA Server, see Publishing Exchange Server 2007 with Configuring ISA Server 2006 for Exchange Client Access.
If neither statement applies, skip this section and follow the Outlook Web Access Configuration (Internet Scenario) section above.
Note: |
---|
An example script that performs the steps 1-8 in this section is included in the Exchange 2007 Configuration DVD. It is located within the E2K7-Scripts\CAS folder and is named ConfigureOWA.ps1. For more information about how to use the script, execute .\ConfigureOWA.ps1 –help. |
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher).
- Configure Windows Integrated Authentication by following the
procedure outlined in the Exchange 2007 Online Help topic How to Configure
Integrated Windows Authentication.
- Optional: Configure GZip compression by following the procedure
outlined in the Exchange 2007 Online Help topic How to Configure Gzip
Compression Settings.
- Configure WebReady Document Viewing by following the procedure
outlined in the Exchange 2007 Online Help topic How to Manage WebReady
Document Viewing.
- Configure private and public computer file access by following
the procedure outlined in the Exchange 2007 Online Help topic
How to Manage
Public and Private Computer File Access.
- Configure Windows SharePoint and Windows File Share integration
by following the procedure outlined in the Exchange 2007 Online
Help topic How
to Enable or Block Access from Public and Private
Computers.
- If legacy Mailbox servers exist within the organization, then
you will need to follow these steps:
- Follow the procedures outlined in the following topics, but
replace the value of the identity parameter with ”CAS01\exchange
(Default Web Site)” (where CAS01 is the name of the Client Access
server):
- Configure Windows Integrated Authentication by following the
procedure outlined in the Exchange 2007 Online Help topic How to Configure
Integrated Windows Authentication.
- Optional: Configure GZip compression by following the procedure
outlined in the Exchange 2007 Online Help topic How to Configure Gzip
Compression Settings.
- Repeat step a, but use "CAS01\exchweb (Default Web Site)” for
the value of the identity parameter.
- Repeat step a, but use "CAS01\public (Default Web Site)” for
the value of the identity parameter.
- Follow the procedures outlined in the following topics, but
replace the value of the identity parameter with ”CAS01\exchange
(Default Web Site)” (where CAS01 is the name of the Client Access
server):
- Optional: To simplify the Outlook Web Access URL and redirect
users to HTTPS, follow the procedure outlined in the Exchange 2007
Online Help topic How to Simplify the
Outlook Web Access URL.
- Restart the Client Access server.
ActiveSync Configuration
Follow the steps in this section if the Client Access server will not service requests directly from the Internet, but instead will receive requests from other Client Access servers that are located in other Active Directory sites. If that is not a true statement, skip this section.
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Server Administrator role (or higher).
- Click on Start, Administrative Tools and select
Internet Information Services (IIS) Manager.
- Expand the hierarchy nodes <Server>, Web Sites,
Default Web Site.
- Click on Microsoft-Server-ActiveSync.
- Double-click Authentication in the middle pane.
- Select Basic Authentication, right-click and select
Disable.
- Select Integrated Windows Authentication, right-click
and select Enable.
Legacy ActiveSync Configuration
In order for mobile devices to synchronize using Client Access servers when the mailbox resides on Exchange Server 2003, Microsoft-Server-ActiveSync virtual directory must be configured to use Windows Integrated Authentication.
If there are no legacy Exchange Mailbox servers in the organization, this section can be skipped.
Note: |
---|
You can manually configure Microsoft-Server-ActiveSync virtual directory to use Windows Integrated Authentication by installing http://support.microsoft.com/?id=937031 on a workstation running the Exchange 2003 System Manager. |
- Connect to the server via Remote Desktop and log on with an
account that has local administrative access and has been delegated
the Exchange Organization Administrator role.
- Insert the Exchange 2007 Configuration DVD.
- Open a command prompt and navigate to the
\E2K7-Scripts\CAS directory on the share and run the
following command:
Copy Code legacyEAS.vbs -d:DomainController -a:AdminGroup
Note: Replace Domain Controller with a domain controller that is in the same Active Directory site as the Exchange Server (optional parameter). Replace Exchange Server with the name of the server to be modified. - The output will be similar to the following if successful:
Copy Code Z:\E2K7-Scripts\CAS>legacyeas.vbs -d:W2K3-DC-01 -a:NorthAmerica Microsoft (R) Windows Script Host Version 5.1 for Windows Copyright (C) Microsoft Corporation 1996-1999. All rights reserved. Exchange Server Container - cn=Microsoft-Server-Activesync,cn=1,cn=HTTP,cn=Protocols,cn=<Server>,cn=Servers,cn=NorthAmerica,cn=Administrative Groups,cn=<OrgName>,cn=Microsoft Exchange,cn=Services,cn=Configuration,dc=<root domain> Attribute Name & Value - msExchAuthenticationFlags: 6 Attribute Set!!
Handoff Test
The diagnostics tasks used in this section require test mailboxes to be created on the Exchange 2007 Mailbox servers. For more information about how to use the Test script to create the test mailboxes, see the Monitoring for Agentless Servers topic in the Exchange 2007 Online Help.
- Connect to an Exchange 2007 server via Remote Desktop and log
on with an account that has local administrative access and has
been delegated the Exchange Server Administrator role (or
higher).
- If the server had not been restarted as a result of a previous
section’s instructions, then open a command prompt and start the
Web service by executing the command net start w3svc.
- Click Start, All Programs, Microsoft Exchange Server
2007 and select Exchange Management Shell.
- To test Exchange ActiveSync connectivity, run the following
command where <Server> is the name of the Client
Access server:
Copy Code Test-ActiveSyncConnectivity -ClientAccessServer <Server>
- To test Autodiscover connectivity, run the following command
where <EmailAddress> is the name e-mail address of a
mailbox:
Copy Code Test-OutlookWebServices -ClientAccessServer <Server>
- To test Outlook Anywhere connectivity, run the following
command:
Copy Code Test-WebServicesConnectivity -ClientAccessServer <Server> -AllowUnsecureAccess
- To test Outlook Web Access connectivity, run the following
command where <Server> is the name of the Client
Access server:
Copy Code Test-OwaConnectivity -ClientAccessServer:<Server> -AllowUnsecureAccess