Certificate Authority – Certificate with Subject Alternative Name – Web Server Template STATUS Unavailable

If You are using Local Certificate Authority more the often there is a need to enrol Certificate with Subject Alternative Name. Buy when we open Certificate MMC Snap-in the only template we can use to request Certificate is Computer.

The Work around this problem is quite simple we just need to assign Server account ritght to enrol certificate using Web Server template.

Assign Web Server Template to Computer Account

1. Logon to Certificate Authority Server and open Certificate Authority management.

2. Click on Certificate Templates and form Action menu select Manage

3. Next find Web Server and form context menu select properties.

4. In Security Tab add Computer Account (remember to select object type Computers) and assign Read and Enroll rights

Now assigned computer have rights to Enroll certificate using Web Server Template.

Generate Certificate for computer using Web Server Template with Subject Alternative Name

1. Now let’s get back to Computer that is in need for Certificate with Subject Alternative Name and open Certificate MMC Snap-in for Computer Account.

2. Let’s Request new Personal Certificate

3. Now we will be able to Select Web Server Template and configure its properties.

4. The bare minimum we need to fill is:

    Common name (CN=) – The default Name of Computer

    DNS (DNS Name=) – All the Subject Alternative Names You need.

And the Last thing is to assign Certificate to Bindings and restart the IIS.

Cheers,

Maciej Jędryszek

Reklama

Quick Guide – Migration Exchange 2007 on Windows 2003 to Exchange 2013 on Windows 2012 R2 – Part 1

Scenario is simple. We have one server with Exchange 2007 installed on Windows Server 2003 Standard. We added new server to domain with Windows 2012 Standard R2 to be our new Exchange 2013 Server. The plan is to Install Exchange 2013 and migrate mailboxes from old server. New Server is installed and up to date.

1.Install Prerequisite

1.1 Update Exchange 2007 Server to latest Rollup. Rollup list you can find HERE

1.2 On New Exchange 2013 Server Install:

▪ Unified Communications Managed API 4.0 Runtime

▪ Microsoft Office 2010 Filter Packs

▪ Service Pack 1 for Microsoft Office Filter Pack 2010 (KB2460041) 64-bit Edition

▪ Install required Windows Features and Roles

You can also download my simple PowerShell script that will install all required Roles and Features. Available HERE It is just a simple example of PS>Install-WindowsFeature. You can read more about it on Technet.

2.Prepare Domain

2.1 Now let’s prepare Active Directory. Just remember to check Organization Name. You can do that by running on Exchanage 2007 Server Management Shell following command.

Get-OrganizationConfig |select Name

2.2 Go to Exchange 2013 server and open command prompt. Insert or mount Exchange 2013 media and go to it.

Use this command to prepare AD just remember to change Organization to appropriate.

.\setup /PrepareAD /OrganizationName: consto /IAcceptExchangeServerLicenseTerms

3.Install Exchange 2013

3.1 Now it is time to install Exchange 2013. Run setup form Exchange media and fallow the wizard. I think good practices to store Exchange Installation and Mailboxes on 2^nd Partition and Logs on 3^rd. Just for clear view.

▪ Accept the License

▪ Don’t use recommended settings

▪ Select Server Roles

▪ Specific Install Directory

▪ Disable malware scanning – No

▪ And if no Warring’s or Errors will display install Server. (If you get warring’s or errors refer to links in prerequisite check)

▪ You can now update the Exchange 2013 Server but just in case don’t go further than Exchange Server 2013 Service Pack 1 (SP1 aka CU4). This is quite important and often missed in other guides. CU5 change ipv6 and may generate communication problems with old server a specially if You are using Windows 2003 or implementation takes place in small environments where DC is same Server as Exchange. Cumulative Updates for Exchange 2013 list can be found HERE.

4.Configure Exchange 2013

4.1 Create Exchange 2013 Admin Account. If your current Exchange account have Mailbox on Exchange 2007 You will not be able to connect to ECP using this credentials. That is why create new Exchange Admin Account f.e. ExAdm that will be member of Exchange Admins and Exchange Organization Administrators.

4.2 Prepare Database Path and Log location – ref. to my previous post

4.3 Setup Virtual Directories External URL – go to ECP -> Servers -> Virtual Directories and setup external URL for each Virtual Directory

▪ Autodiscover

▪ ECP

▪ EWS

▪ Microsoft-Server-ActiveSync

▪ OAB

▪ OWA

4.4 Configure Outlook-Anywhere – go to ECP -> Servers ->Servers -> [Exchange2013ServerName] -> Outlook Anywhere

4.5 Configure Send and Receive Connectors (if there is no major change in your environment you can leave it as it is)

4.6 Configure Certificates (If You are using other CA (local or public) replace self-singed certificate with the appropriate one and assign it to Services)

▪ New-ExchangeCertificate – generate request

▪ If You are using local CA generate certificate using request and Web Server template

▪ Import-ExchangeCertificate – import new certificate

▪ Enable-ExchangeCertificate – assign services

4.6 At this point we should have environment with 2 Exchange Servers within same Organization. This should be a time to start thinking about migration. First lest migrate Administrator Account to Exchange 2013 (if you Admin already have mailbox on Exchange 2007 else use other account to test environment) I’m choosing Admin account because I don’t want to test it on new clean mailbox and admin account is one mailbox that usually contains just spam and some reports (nothing major – at least in my case)

4.7 Create Migration Batch. Got to ECP -> Recipients -> Migration.

▪ Add user to Migration

▪ Name migration Batch

▪ Specific destination mailbox database

▪ Specific who will receive migration report

▪ Run Migration Batch

And wait till it is finish. By default there is zero tolerance for bad items but if your mailbox is corrupted browse corrupted items and either save it via outlook or accept it lose and run migration batch with appropriate bad items limit.

4.8 Login first to OWA first and see if everything is ok. Then start Outlook and if ask reopen it again.

4.9 If everything is ok Congratulation you can now create new batch with more users.

5.END of Part 1

Things that are still on schedule is Public Folder migration (and this can be tricky since in Exchange 2013 Public folder is way different and evolved into Public Folder Mailboxes) and removing Exchange 2007 from old server. I will cover this in Part 2.

If You encounter any problems please let me know I will try to help if I can.

Cheers,

Maciek

IIS and Exchange – Log Retention

Let’s start with that log files retention should be handle by backup mechanisms. But sometimes backup is handle by different layer (f.e. Virtualization) and You still want to manage your logs.

There are few suggestions how to handle it and one of those is via PowerShell Script. Today I wanted to provide You with my variation of Log Purge script and how to set it up in Task Scheduler.

You can download the scrip over here LogPurge4.ps1

Script base on 2 parameters .

First is Integer that provide number of days between 0 and 365 that sets log files maximum age.

Second is path to text file that contains list of folders with log files. (Example to download – this example have default path to IIS and Exchange log files, remember to check if yours are not redirected)

So if we want to call script from PowerShell that will Purge f.e. IIS logs older than 30 days we need to provide text file that will have just one line (if You store IIS log files in default path o.c.)

Example.txt

C:\inetpub\logs

And call it from PowerShell

    .\LogPurge4.ps1 30 Example.txt

This will check all the subfolders from C:\inetpub\logs and search for files with extension *.log or *.blg that are older than 30 days and delete it. It will also generate report file with list of all processed folders and files and name it LogPurge-FileList.txt

This is quite neet. Now if u want to schedule it in TaskSheduler, You have to remember few things.

1. Call Powershell just in case and provide script as parameter.
2. And if u provide full path to Folders list file or script use quote ” so string will be interpreted as one parameter
3. Always good to provide start in folder.

Here is Example of Action in task.

LogPurge4.ps1 and TargetFoldrer.txt are in C:\Scripts\Log\

Action:        Start Program

Program:    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Arguments:    C:\Scripts\Log\LogPurge4.ps1 30 TargetFolder.txt

Star in:         C:\Scripts\Log\