New Exchange 2013 on Windows Server 2008 R2, in coexistence with Exchange 2007 on Windows Server 2003.

Except for one test mailbox, all mailboxes are still on Exchange 2007.

Virtual directories are redirected to Exchange 2013, with legacy dns name directed to Exchange 2007, and OWA/ActiveSync are working fine.

Mail flow from the internet is still directed to Exchange 2007 and is fine.

But mail flow is not working on Exchange 2013. Using OWA with the test mailbox, emails are stuck in the drafts folder. Emails from a mailbox on Exchange 2007 are received by the frontend transport service, but fails on the transport service with this error (192.168.1.76 is the address of Exchange 2013 server, and HV-SRV-EXCH-02 is its name):

MSExchangeTransport - 1035 - SmtpReceive

Inbound authentication failed with error UnexpectedExchangeAuthBlob for Receive connector Default HV-SRV-EXCH-02. The authentication mechanism is ExchangeAuth. The source IP address of the client who tried to authenticate to Microsoft Exchange is [192.168.1.76].

Certificate is signed by an enterprise CA, and contains public domain names, with the NetBIOS and fqdn names :

CN=owa.example.com, OU=xxx.......",Certificate subject
"CN=vsg-HV-SRV-CA-02-CA, DC=vsg, DC=qc, DC=ca",Certificate issuer name
owa.example.com;hv-srv-exch-02.vsg.qc.ca;AutoDiscover.vsg.qc.ca;AutoDiscover.example.net;AutoDiscover.example.com;HV-SRV-EXCH-02,Certificate alternate names

Clocks are in sync (both Exchange servers, and domain controllers)

SPNs seem ok :

setspn -L hv-srv-exch-02 | find /I "smtp"
        SmtpSvc/HV-SRV-EXCH-02.vsg.qc.ca
        SmtpSvc/HV-SRV-EXCH-02
        SMTP/HV-SRV-EXCH-02.vsg.qc.ca
        SMTP/HV-SRV-EXCH-02

DNS servers are set manually in ECP, and on the TransportService and FrontEndTransportService. I also added the IP and hostnames (NetBIOS and fqdn) of both Exchange servers in the hosts file

I used Kerberos debug log to check for errors, and all I got is this, which seems fine :

A Kerberos Error Message was received:
 on logon session VSG.QC.CA\hv-srv-exch-02$
 Error Code: 0x19 KDC_ERR_PREAUTH_REQUIRED

Example logs for the same session, sending an email from a mailbox in Exchange 2007, to the test mailbox in Exchange 2013

From the FrontEnd receive log (hv-srv-exch-01 is the Exchange 2007 server) :

2015-05-06T12:25:40.535Z,HV-SRV-EXCH-02\Default Frontend HV-SRV-EXCH-02,08D2555C60FC73C7,46,192.168.1.76:25,192.168.1.23:15456,<,X-EXPS EXCHANGEAUTH,
2015-05-06T12:25:40.535Z,HV-SRV-EXCH-02\Default Frontend HV-SRV-EXCH-02,08D2555C60FC73C7,47,192.168.1.76:25,192.168.1.23:15456,*,SMTPSubmit SMTPSubmitForMLS SMTPAcceptAnyRecipient SMTPAcceptAuthenticationFlag SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender BypassAntiSpam BypassMessageSizeLimit SMTPSendEXCH50 SMTPAcceptEXCH50 AcceptRoutingHeaders AcceptForestHeaders AcceptOrganizationHeaders SendRoutingHeaders SendForestHeaders SendOrganizationHeaders SendAs SMTPSendXShadow SMTPAcceptXShadow SMTPAcceptXProxyFrom SMTPAcceptXSessionParams SMTPAcceptXMessageContextADRecipientCache SMTPAcceptXMessageContextExtendedProperties SMTPAcceptXMessageContextFastIndex SMTPAcceptXAttr SMTPAcceptXSysProbe,Set Session Permissions
2015-05-06T12:25:40.535Z,HV-SRV-EXCH-02\Default Frontend HV-SRV-EXCH-02,08D2555C60FC73C7,48,192.168.1.76:25,192.168.1.23:15456,*,VSTGEORGES\HV-SRV-EXCH-01$,authenticated
2015-05-06T12:25:40.535Z,HV-SRV-EXCH-02\Default Frontend HV-SRV-EXCH-02,08D2555C60FC73C7,49,192.168.1.76:25,192.168.1.23:15456,>,235 <authentication response>,

From the FrontEnd Send log :

2015-05-06T12:25:45.558Z,Inbound Proxy Internal Send Connector,08D2555C60FC73C8,51,192.168.1.76:42824,192.168.1.76:2525,>,X-EXPS EXCHANGEAUTH SHA256 ,
2015-05-06T12:25:45.558Z,Inbound Proxy Internal Send Connector,08D2555C60FC73C8,52,192.168.1.76:42824,192.168.1.76:2525,>,<Binary Data>,
2015-05-06T12:25:50.566Z,Inbound Proxy Internal Send Connector,08D2555C60FC73C8,53,192.168.1.76:42824,192.168.1.76:2525,<,454 4.7.0 Temporary authentication failure,
2015-05-06T12:25:50.566Z,Inbound Proxy Internal Send Connector,08D2555C60FC73C8,54,192.168.1.76:42824,192.168.1.76:2525,>,QUIT,

And from the Hub Receive log :

2015-05-06T12:25:45.558Z,HV-SRV-EXCH-02\Default HV-SRV-EXCH-02,08D2555EA1F7C246,51,192.168.1.76:2525,192.168.1.76:42824,<,X-EXPS EXCHANGEAUTH,
2015-05-06T12:25:45.558Z,HV-SRV-EXCH-02\Default HV-SRV-EXCH-02,08D2555EA1F7C246,52,192.168.1.76:2525,192.168.1.76:42824,*,,Inbound ExchangeAuth negotiation failed because of UnexpectedExchangeAuthBlob
2015-05-06T12:25:45.558Z,HV-SRV-EXCH-02\Default HV-SRV-EXCH-02,08D2555EA1F7C246,53,192.168.1.76:2525,192.168.1.76:42824,*,,User Name: NULL
2015-05-06T12:25:45.558Z,HV-SRV-EXCH-02\Default HV-SRV-EXCH-02,08D2555EA1F7C246,54,192.168.1.76:2525,192.168.1.76:42824,*,Tarpit for '0.00:00:05' due to '454 4.7.0 Temporary authentication failure',
2015-05-06T12:25:50.566Z,HV-SRV-EXCH-02\Default HV-SRV-EXCH-02,08D2555EA1F7C246,55,192.168.1.76:2525,192.168.1.76:42824,>,454 4.7.0 Temporary authentication failure,
2015-05-06T12:25:50.566Z,HV-SRV-EXCH-02\Default HV-SRV-EXCH-02,08D2555EA1F7C246,56,192.168.1.76:2525,192.168.1.76:42824,-,,Local

Hi,

I have new testing lab to play around with which is starting to drive me insane. I have exchange 2013 and outlook 2013. I can receive emails from external domains but I am unable to send emails internally or externally!

Now I would know what to look at if I couldn't send externally, But not being able to send internally has completed confused me!

anyone got any tips where to start troubleshooting for not being able to send internal mail? Once internal mail works I should then be able to get external mail working as well....

Thanks

Hello all

I am running Exchange 2013 CU8. I have two AD sites, and two DAG's.  5 mailbox servers in each DAG, and 4 CAS servers in each AD site.  Environment looks similar below.  The picture shows 4 CAS, however i have 8. What i want to know is it best practice to route smtp email through the CAS servers ? what is the advantage to using FrontendProxyEnabled ?

Bulls on Parade

Hello all,

I am doing a lab at home... and i installed and partially configured Exchange 2013.

Now i have second problem when sending a e-mail:

"The message is pending in the queue 'SERVER\Unreachable'. The last error was 'A matching connector cannot be found to route the external recipient'."

I send message to my self ( localy on server... So basicly i send from email@domain.com to email@domain.com .

And it said that error in message trace...

Why does exchange trying to send External e-mail since i sent it internally? Is there any connections with networking or DNS / DHCP?

Thanks in advance for answers!

For some strange reason we cannot use the EmailAddressPolicyTemplate %1g%s@contoso.com (jsmith@contoso.com) for a particular emaildomein on our Exchange 2013 server. If we create the address policy and apply it, it gives us the error:

"Failed to generate proxy address. Additional information: General Error."

The strange thing is, that any other domain works correctly with %1g%s@. Any other format for domain contoso.com works like it should.

Our environment has a forest trust with AD domain Contoso.com for a upcoming crossforest migration.

I already recreated the accepted domain (internal-relay) and the send connector for this domain.

Because of this error, the cross forest mailbox moverequests fail at finalizing, that they cannot update the mailbox in the target environment.

If we set the EmailAddressPolicyEnabled to $false, the moverequest completes, but the mailbox is not updated to the correct mail address. I tried to find extra logging for what is happening but can't find any options.

Last lines of the moverequest report:

5/7/2015 10:42:53 AM [DSMxxxx] Target mail user 'Testuser12' was loaded
from domain controller 'DSMxxxx.Constoso.com.
5/7/2015 10:42:53 AM [DSMxxxx] Fatal error
UpdateMovedMailboxPermanentException has occurred.

Why is only policy %1g%s@contoso.com not working?

%2g%s@contoso.com works

%1g%s@MSFTraders.com works

Help would be appreciated.

Hi All,

We have Exchange 2013 SP1 infrastructure on top of Windows Server 2012 R2. We have a DAG and CAS NLB clusters.

Anyone can relay Emails from my SMTP to all users within my domain without authentication.However no one can send emails outside my domain (external Emails without authentication).

All these emails are sent through Default Front end Receive Connector, and we cannot Disable Anonymous Users from connector security settings as by doing this we will not receive emails from External World. Please refer the attached snapshot.

Need your suggestion to implement SMTP security to restrict Unauthorized SMTP Relay.

Thanks

VN

Hi,

This one has me stumped.. after working with MSX in one form or another since 5.5, I haven't seen anything like it.

Essentially we have one mailbox user on an Exchange 2013 mailbox server. Whenever you send them a meeting request, it shows up in their own mailbox, along with someone else's mailbox. In the info panel it reads:

'Received for USERNAME'

Where username is the actual person you invited to the meeting, and the other mailbox is just that, another mailbox. USERNAME doesn't have any rules to forward to the other mailbox.

Does anyone have any suggestions for why this might happen? It only happens with meetings sent to USERNAME, other email and etc.. works fine. I am also not aware of anyone else having this problem.

Thanks!

Hi,

We're having trouble getting our employees to BCC all distributions lists in our company.
Problem resides in everyone clicking 'Reply to All' to reply which, much sooner than later, always floods everyone's mailbox and creates a lot more traffic than necessary on our Exchange servers.

I tried setting up a rule in ECP using a collector mailbox as follows:

-If the message is sent to a specific DL
-And is received from inside the organisation
-Set audit severity level to 'High'
-and blind carbon copy (bcc) the message to that same specific DL
-and redirect the message to BCC (a mailbox we created)
-stop processing more rules

With these settings, it doesn't seem to work.
Mails keep coming in as being sent by myself instead of from BCC (as I suspect the proper rule should do).
Any ideas?

Hello There,

Could you guys Help me?

We have an external app hosted on a vendor Webserver. They need to send e-mails to our Exchange Environment, authenticating the e-mail.

To allow that, I understand that:

1 - I need to create a receive connector

2 - Scope the Receive connector to the External IP Address of the vendor's website

3 - Configure the Exchange User authentication mode.

Is that correct? I know that some applications need to allow the Anonymoys Authentication checkbox and also allow the relay through the Add-Adpermission cmdlet, but I guess that this is not the case. The application has a secure Method and uses a username and password that we created. Or Am I understanding this incorrectly? All e-mails that users send using another applications that not Outlook, ActiveSync of OWA are automatically classified as "Anonymous" even if they use a Username, Password?
The Application uses the New System.Net.Mail.MailAddress method on Visual Studio.

And, if you guys can answer another quick question that I cannot find the answer, it would be great: IF I have a load balanced solution for my CAS servers and create a receive connector in just One server, will the sender bounce if the connection is balanced to another CAS that does not have the receive connector?

THANKS!

Greetings,

We're trying to roll out TLS 1.2 in our test environment and can't seem to get Exchange to work with the protocol.

We've been using this method to enable TLS 1.2 (and disable the other protocols - TLS1.0, SSL2.0, SSL3.0, PCT1.0): http://www.adminhorror.com/2011/10/enable-tls-11-and-tls-12-on-windows_1853.html

We originally tried using Exchange 2010 on 2008 R2, but then I ran across this article saying that it is not supported: http://support.microsoft.com/kb/2709167/en-us

We've since tried to set it up with Exchange 2013 on Server 2012. Still no luck. The only time Exchange wants to work is when TLS1.0 is enabled.

I suspect that TLS1.1 and TLS 1.2 are also not supported on Exchange 2013, or that I'm changing the wrong registry keys, but I wanted to find confirmation. I've searched extensively and can't find any documentation leading me to believe one way or the other if it's supported.

Any help or insight would be greatly appreciated. Thanks!

--Aric

Hello,

I'm running an exchange 2013 system and we have an issue that if users sent Encrypted emails they show up on older versions of Outlook and mobile phones as ATT00001 and ATT00002.bin. It doens't matter from what client we sent it. And it is not an issue for Outlook 2013 and newer mobile phones like Vlackberry 10 or iOS8 devices, but on older devices it doesnt display correctley, and in OWA it is un readable (with S/MIME extention installed). When I look at the header it says|:

Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary

And this is weird as I have TNEF turned off :

RunspaceId                           : 9dce606b-5c50-45bb-ab6e-a092b3a97f37
DomainName                           : *
IsInternal                           : False
TargetDeliveryDomain                 : False
ByteEncoderTypeFor7BitCharsets       : Use7Bit
CharacterSet                         : iso-8859-1
NonMimeCharacterSet                  : iso-8859-1
AllowedOOFType                       : External
AutoReplyEnabled                     : False
AutoForwardEnabled                   : False
DeliveryReportEnabled                : True
NDREnabled                           : True
MeetingForwardNotificationEnabled    : False
ContentType                          : MimeText
DisplaySenderName                    : True
PreferredInternetCodePageForShiftJis : Undefined
RequiredCharsetCoverage              :
TNEFEnabled                          : False
LineWrapSize                         : Unlimited
TrustedMailOutboundEnabled           : False
TrustedMailInboundEnabled            : False
UseSimpleDisplayName                 : False
NDRDiagnosticInfoEnabled             : True
MessageCountThreshold                : 2147483647
AdminDisplayName                     :
ExchangeVersion                      : 0.1 (8.0.535.0)
Name                                 : Default
DistinguishedName                    : CN=Default,CN=Internet Message Formats,CN=Global Settings,CN=DOMAINCOM,CN=Mi
                                       crosoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com
Identity                             : Default
Guid                                 : 64165533-258a-4c3a-b167-153b48c04eeb
ObjectCategory                       : cdomain.com/Configuration/Schema/ms-Exch-Domain-Content-Config
ObjectClass                          : {top, msExchDomainContentConfig}
WhenChanged                          : 7-5-2015 11:38:29
WhenCreated                          : 29-4-2015 15:56:38
WhenChangedUTC                       : 7-5-2015 09:38:29
WhenCreatedUTC                       : 29-4-2015 13:56:38
OrganizationId                       :
OriginatingServer                    : dc.domain.com
IsValid                              : True
ObjectState                          : Unchanged

I've tryed changing the MIME types and message encoding options but keep getting the same result,

Is there maybe some setting that overrides the exchange conversion, that I'm overlooking?

Hi all,

An interesting one for you out there. We have a law firm as a customer and they would like to delay all emails sent so that there can be a final check before emails leave that confidential material is not going to the wrong person.

Does anyone know if it's possible to configure Exchange 2013 to automatically delay all messages for all users in their outbox. I know it can be done per message but what about globally for all messages.

Alternatively, any other options to achieve what they want?

Thanks,

Richard

Hi There,

We have 4 sites (A,B,C & D) ,all connected to site A with an MPLS connection.Exchange server resides on site A and clients from all sites access emails through Outlook.Request your guidance on issues we come across;

  1. Some of the clients keep getting an authentication popup (Even on Site-A).Restarting outlook may solve the issue.

  2. A particular user on Site-B repeatedly complaints about  a non response from outlook and when we try OWA ,It says "Mailbox           Un-available ".But it re-instate to normal after a while .

Request your advice on both matters.

Thanks In Advance,

Ratheesh Nambiar

Hi,

We have an very strange issue with Exchange 2013 (CU8, issue was the same with CU7) and receive connector on CAS. We have 1 CAS server,1 Edge and 2 Mailbox servers. This started to happen when 2010 was uninstalles/removed. Everything worked before 2010 was removed. 

We have a seperate Receive connector for mail relay from scanner/software etc. If we try to send to external addresses (user@external.com) we got this response:

"451 4.7.0 Temporary server error. Please try again later. PRX1"

If we send with internal address (user@internal.com) its works. Anonymous access is configured. The strange thing is that when we test and send a test-message with both internal and external address (user@internal.com; user@external.com), both is delivered OK. 

Used this commands to test:
This command works:
Send-MailMessage -From test@internal.com -To user@external.com,user@internal.com -Subject TestMail -SmtpServer serverip

This command gives errorcode:
Send-MailMessage -From test@internal.com -To user@external.com -Subject TestMail -SmtpServer serverip

Send-MailMessage : Error in processing. The server response was: 4.7.0 Temporary server error. Please try again later.
PRX1
At line:1 char:1
+ Send-MailMessage -From test@internal.com -To user@external.com -Subject Te ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.Mail.SmtpClient:SmtpClient) [Send-MailMessage], SmtpExcept
   ion
    + FullyQualifiedErrorId : SmtpException,Microsoft.PowerShell.Commands.SendMailMessage

We have created an case with Microsoft, but the response from MS is very bad/nothing.

Anyone that have seen this behavior?

Thanks

Lars Erik

Hi Exchange Server Expert,

Our company is using Exchange 2010. Each of the mailbox has been configured to have default quota of 3GB. When it reaches 3GB quota, the send/receive will be prohibited.

My question is:

1. if there are senders are sending email to specific user whereby his/her mailbox has reach quota, will the sender receive any bounced back message?

2. If he/she clean up their mailbox, will those bounced back email being flushed back to their mailbox or the sender need to re-send again?

3. Will the user know that there are senders that sending email to her but he/she can't receive because he/she has reached quota?

Thanks.

Regards,

Hello,

When sending mail from exchange 2013 to exchange 2007 using SMTP relay to mailbox delivery group, mails stuck in queue with the error:

 [{LRT=5/12/2015 6:03:24 AM};{LED=451 4.4.0 Primary target IP address responded
 with: "235 00000734YIIFYgYJKoZIhvcSAQICAQBuggVRMIIFTaADAgEFoQMCAQ6iBwMFAAAAAACjggQJY
 YIEBTCCBAGgAwIBBaEOGwxDT01WRVJTRS5DT02iLjAsoAMCAQKhJTAjGwdTTVRQU1ZDGxhVUy1ETlYtTUJYM
 i5jb212ZXJzZS5jb22jggO4MIIDtKADAgEXoQMCAQKiggOmBIIDop6UphxXPkD6/d/XwUsUhRj5/X2JXeFxo
 0EmvOhRJ+G5xb4tHnHk0R9m0vyKgbYT9FqOeMjcMw75E6P2SDNsLbpRbG9JwfJQtfhN+R5qNnFh1fhDFOT/x
 JgPCZSUizubYaEDB+eJoeppedCXNwfoAm24EAjPKMAi6kp+G0FbjBHQIT/HN5d6AHP76kOWZg9w0gk89Chmy
 1WGZ4GwraDr02S6AYBLKlrBWsNxo1Hdj0ZeKyD20kEukTxrpTbDxbU7Mtw8y1wMCrjTiO7mgS4EeUrUEJWCp
 fBiR3aOfvP+PDHBCNIb3djENseRhdBHCx6zi4N0mjuy1K11o6P1w6YoSe+GF3YrIAJT3yYHYLfY1b6xr6g50
 RH5wSNqnmUtPaWJidXXgNvPUZtZBKiTwCZs2TsuzEYoYT944prLHvL4KUekMFzMEA2oyb4RkrvBjBckQ0kHj
 4YGR7YYaFBs16arMrI7ZJiB+PYCdDOFfZb3A0WyMeCfcl26GAKFVq38LlKl0DyybkTIS4S3eVCTf7ji+APZX
 iG1P1BicwKPscbkhyPNBOGqnnIog9dCHqfjT3hiU6CX+iW8HzBAkrAyH02rU80ftCpoei+D2ZVYkWtExVDgJ
 LsBc3ix5MPX52djmZR86l1G6FiNVhGhNBq3yzNG2Dqi3CgFVVjmX8z6+YqaYeMjQUKyaCLxsh+buuXBmbWVX
 h0JfYOyOMymwZS32eTeZGRLP2czHMOlPZ1i45MPQW8qxwDHVZo8rJkqz1A6U2FYbjR8/4l/2U5NkWuADMe/n
 953Ow8Y3WAMvAIr2mISxLCh19lgCUvN1ogRNMjlgyoE0QSqDf7Ww0IT4kYTa84a0ZpIZhc5cBIUzHLDqwPbv
 EDdzyKaJcYNJ3ZWtwqdHmts6GwNy3SqMuYEYuDL0CinXl6Q/M92BLqeEaOmpXbQe+Nmd1pHnnPujciGAmnX1
 scPw0DC1ihr8rXGPmOhhs29OAO8bg8XBThYWqwtfPjNu5iZPb1HrvLEVdtBPZEkohNd8GtX0G3Qm7r1xvhq1
 y6oAt8CmEgv/BnD7bqkO/oum+1a4Qpl0XlnzwfISNIJ/aP0nZH01KgHcWFe472KkjubzJscARmoOponEsRzT
 dWMWfCuB/cip/J3dBc7KjJCJQsrudvGTvkr24ilFENQsrYQOpegPe7QlfiV81/4WGAc9TQjZ5a5Uin4NfQoW
 nD7zx77xk9Q349SOY/8wplvxJh9xK8FS6SCASkwggEloAMCAReiggEcBIIBGO9tALYtk9VDfo+h8LzRHPA+k
 N1SsEXqDooPcZEIpgNw+6stqoAVRc4GLb9IC13x27GAFYTzeTo8hNRDeawXGAaBxvfaVH2NNgEoOxqREUEf7
 Q+77HGxJQjqcnvU/UCMM1UomvNG3JPAhu/Xje56yY5Ijl+WTjY0PfZCepkzdIqT+IBt3INwCWZnvj8znNPrD
 5BdSRFwqqkKxtAAcoK6oJolX0MXdhqIiwwdtiTBFTK8gN/Yt7PdG6Qu/AFeLHIXNR0QcGmLVMVdq3zG3ydgM
 3j65sLK6L/9nTwUqEk66kTZzKI5h+Vm0ta4DV5fesH2qP7+78a2+9KiEoVx8s5ShiQy7QMY2Iyp8psD9hxkn
 j91OjhnVTE1G9E=0000002CBHN0baxt/4Fec5gQa3hWkqr4BEVcGS/iLwNbL4ZETcc=." Attempted
 failover to alternate host, but that did not succeed. Either there are no alternate
 hosts, or delivery failed to all alternate hosts. The last endpoint attempted was....

I tried to telnet exchange 2007 and had no problems...

What is this?