A Room or Room List disappears from Outook Scheduling Assistant

This case is really cool, and on a first look it looks like there is some magic involved. Help desk support engineer has escalated a situation with a "problematic" user mailbox and outlook. Whenever this user has been scheduled a meeting in a room or room list, the scheduled room(s) automatically disappears from the scheduling assistant list in a few seconds. It sounds like magic, and I've checked with my outlook, and I couldn't believe my eyes how room(s) disappears automatically in a few seconds when this users was scheduled a meeting and meeting room(s).
So, I've started digging the properties of this users mailbox and bumped on following invalid configuration :

WorkingHoursStartTime and WorkingHoursEndTime were having invalid time set. Changing these values to correct time settings can be done using the Set-MailboxCalendarConfiguration. For example:

Set-MailboxCalendarConfiguration - identity "affected user" -WorkingHoursStartTime 08:00:00

Set-MailboxCalendarConfiguration -Identity "affected user" -WorkingHoursEndTime 17:00:00

After changing these values to regular working hours, the magical disappearance of the meeting room(s) has ended when this user was also scheduled.

There is also published support article from Microsoft about this phenomenon on https://support.microsoft.com/en-ca/help/2852702/a-room-or-room-list-disappears-in-scheduling-assistant . It's stated that Exchange online is affected, but in my case I have experienced with Exchange on premise.

Happy Scheduling :)

Searching For Email Groups Without Members

This is quick one for a reference, searching for AD groups with present email address, but without members using LDAP filter and powershell:

 Get-ADObject -LDAPFilter "(&(objectcategory=group)(!(member=*))(mail=*))" 

Same LDAP filter can be used with Active Directory Users and Computers:

Happy hunting :) 

Missing rule in Outlook

In this case, scheduled meetings to a user were mysteriously forwarded to a group of users. Helpdesk engineers have removed all the rules that could be seen for that user mailbox, and again all scheduled meetings for that user were again forwarded to this particular group of users. Helpdesk team escalated this user issue to Exchange admins in order to do same tracking. And from Exchange tracking logs can be seen that scheduled meetings were forwarded by mailbox rule ?!?!? :

But, where is that rule ? Get-InboxRule for this user mailbox returned nothing, because helpdesk engineers have removed all the rules, and still there is a rule in this user mailbox that is forwarding the scheduled meetings. So, obviously there is a rule corruption for this user mailbox, and MFCMAPI is your friend. Latest version of this tool can be downloaded from codeplex http://mfcmapi.codeplex.com/ .


Please follow this article https://blogs.msdn.microsoft.com/hkong/2015/02/27/how-to-delete-corrupted-hidden-inbox-rules-from-a-mailbox-using-mfcmapi/ , to learn how to delete corrupted rules with this very powerful tool.


After deleting this corrupted rule from the user mailbox, no other scheduled meetings were forwarded from this user to the particular group of users.


And again, please be very careful when using MFCMAPI in order to avoid corruption.

Microsoft Exchange excessive log growth on database

In this case, in Microsoft Exchange 2010 organization, there was excessive log files generation for one database. Number of logs generated for the database was 10 times higher than usual daily rate for that database. Besides monitor tools that were monitoring the parameters of the Exchange server and reported this excessive log growth for the database, backup administrators has also noticed that time needed for the backup of this database has also grown.
So, question was why there is excessive log growth for this database ?
For answering this question I've installed ExMon (Exchange Server User Monitor) on server that was having this database mounted.
For downloading Microsoft Exchange Server User Monitor for Microsoft Exchange Server 2000,2003,2007 and 2010 use this link
For downloading Microsoft Exchange Server User Monitor for Microsoft Exchange Server 2013 and 2016 use this link

Running Exchange Server User Monitor has reported a user that has "monopolized" store.exe process cpu usage to 50% and generated huge amount of log data. Disabling this user has normalized logs generated files for the affected database. And the reason for this huge amount of logs generated files for the database was a faulty activesync device registered by this user. Enabling this AD user and disabling activesync access for this user, has also stabilized affected database logs generation.

For more info about ExMon follow this link.

Refreshing ExMon might crash the console and prevent ExMon from running again with following error "Unknown StartTrace error (183)", because the previously started trace is still running. In order to resolve the issue, check the status of running traces and search for "Exchange Event Trace" with "logman query -ets" :

Stop the trace with "logman stop "Exchange Event Trace" -ets ", and ExMon should start successfully.

For more about debugging Microsoft Exchange excessive database logging please check https://blogs.technet.microsoft.com/exchange/2013/04/18/troubleshooting-rapid-growth-in-databases-and-transaction-log-files-in-exchange-server-2007-and-2010/ .
 

Searching for AD users with missing email address

In this case, I was searching for AD users with populated proxyaddresses property, but with missing email address from specific domain. For example: a user was having following email addresses: user@domain-a.com and user@domain-c.com, but was missing the user@domain-b.com. I wrote a singleliner PowerShell for listing those users:

Get-ADUser -LDAPFilter "(&(proxyAddresses=*)(!proxyAddresses=smtp:*domain-b.com))" -Properties * | ? {$_.enabled -eq $true } | ft name,proxyaddresses -AutoSize -Wrap

Also, there was one more condition that users with missing email address have to be enabled.

I hope that this singleliner Powershell will help you in a quest for missing email addresses.
 

Create Exchange Address Lists

For quick creation of exchange address lists, EAC or EMC can be used, when only a subset of AD attributes are needed for creating filter (AD container, State or Province, Company, Department, ExchangeAtribute1-15). If these attributes does not meet your needs for creating filter, Exchange Powershell is your friend. New-AddressList contains RecipientFilter parameter for creating advanced queries for filtering recipients. For more info about filterable properties that can be used in RecipientFilter parameter please check the following article : https://technet.microsoft.com/library/bb738157(EXCHG.80).aspx .

For example:

New-AddressList -Name TestList -RecipientFilter {((Alias -ne $null) -and (((Recipienttype -eq 'UserMailbox') -or (Recipienttype -eq 'MailUniversalDistributionGroup') -or (Recipienttype -eq 'MailUniversalSecurityGroup') -or (Recipienttype -eq 'PublicFolder')) -or ((Recipienttype -eq 'MailContact') -and (ExternalEmailAddress -like '*domain.com'))))}

In this example, TestList address list is created with following requirements: Alias is set and recipient types are UserMailbox, UniversalDistributionGruoup, UniversalSecurityGroup, Publicfolder and only Mailcontacts that have domain.com in their External Email Address.
 

Check Microsoft Exchange Services

In this post I would like to share one liner PowerShell, which I'm using in my Exchange test lab environment to check if all Microsoft Exchange services set to start automatically are running, and if not to start them:

"exserver1","exserver2" | % { get-wmiobject win32_service -computername $_ -filter "startmode = 'auto' and state != 'running' and name like 'MSExchange%'" |  % {write-host $_.PSComputername, $_.name; $_.startservice() | out-null }}

In my case there are two exchange servers exserver1 and exserver2, but you can change them to reflect your environment.
I'm also sharing this one liner PowerShell with my students when I'm teaching Microsoft Exchange courses to easily check MS Exchange services on their lab virtual machines. Sometimes not all necessary MSExchange services are started when the lab virtual machines boots up, and there might be problems during student's testing of lab scenarios. This one liner PowerShell is very simple way to avoid that situation.