Exchange Server 2010 Unleashed

Rand H. Morimoto, Ph.D., MVP, MCITP, CISSP, has been in the computer industry for more than 30 years and has authored, coauthored, or been a contributing writer for dozens of books on Windows, Security, Exchange, BizTalk, and Remote and Mobile Computing. Rand is the president of Convergent Computing, an IT-consulting firm in the San Francisco Bay area that has been one of the key early adopter program partners with Microsoft, implementing beta versions of Microsoft Exchange Server 2010, SharePoint 2010, and Windows 2008 R2 in production environments more than 18 months before the initial product releases. Michael Noel, MCITP, CISSP, MVP, is an internationally recognized technology expert, bestselling author, and well-known public speaker on a broad range of IT topics. He authored multiple major industry books that have been translated into more than a dozen languages worldwide. Significant titles include SharePoint 2010 Unleashed, Exchange 2007 Unleashed, SharePoint 2007 Unleashed, Windows Server 2008 R2 Unleashed, ISA Server 2006 Unleashed, and many more. Currently a partner at Convergent Computing (www.cco.com) in the San Francisco Bay area, Michael’s writings and extensive public speaking experience across six continents leverage his real-world expertise helping organizations realize business value from Information Technology infrastructure. Chris Amaris, MCSE, CISSP/ISSAP, CHS III, is the chief technology officer and cofounder of Convergent Computing. He has more than 20 years experience consulting for Fortune 500 companies, leading companies in the technology selection, design, planning, and implementation of complex Information Technology projects. Chris has worked with Microsoft Exchange since the early beta days of version 4.0. He specializes in messaging, security, performance tuning, systems management, and migration. A Certified Information Systems Security Professional (CISSP) with an Information System Security Architecture Professional (ISSAP) concentration, Certified Homeland Security (CHS III), Windows 2003 MCSE, Novell CNE, Banyan CBE, and a Certified Project Manager, Chris is also an author, writer, and technical editor for a number of IT books, including Network Security for Government and Corporate Executives, Windows Server 2008 Unleashed, and Microsoft Operations Manager 2005 Unleashed. Chris presents on Messaging, Operations Management, Security, and Information Technology topics worldwide. Andrew Abbate, MCITP, is a 16-year veteran of consulting and IT with a wealth of practical knowledge on Exchange and Active Directory. Starting with his first migration of MS Mail to Exchange 4.0 through early adopter migrations to Exchange 2007, Andrew worked with some of the largest and most complex Exchange environments in North America. In addition to his Exchange background, Andrew has written several other books covering topics such as Windows 2003, Active Directory, and Information Security. Andrew currently enjoys the position of principal consultant and partner at Convergent Computing where he continues to consult with both large and small clients to help improve their IT practices. Mark Weinhardt, MCSE, has worked in various aspects of the computing industry for more than 20 years. With a background in military communications, Mark understands the importance of maintaining a reliable and secure infrastructure and has preserved that mentality with his transition to the private sector. Mark worked as a consultant with Convergent Computing for more than 11 years and is currently a senior exchange engineer at Yahoo! Inc., working with a fantastic team. With an infectious enthusiasm for technology, Mark has performed Windows and Exchange designs and implementations for companies throughout Northern California.

Introduction 1

Part I: Microsoft Exchange Server 2010 Overview

1     Exchange Server 2010 Technology Primer     5

What Is Exchange Server 2010?      5

What’s New in Exchange Server 2010?      13

Understanding Exchange Server 2010 Server Roles and Mail Flow     26

Understanding the Importance of Active Directory for an Exchange Server 2010 Environment     31

Installing and Migrating to Exchange Server 2010     32

Managing and Administering Exchange Server 2010     33

Summary     34

Best Practices     34

2     Planning, Prototyping, Migrating, and Deploying Exchange Server 2010     37

Initiation, Planning, Testing, and Pilot: The Four Phases to the Upgrade      38

Initiation Phase: Defining the Scope and Goals      40

Initiation Phase: Creating the Statement of Work     46

Planning Phase: Discovery     51

Planning Phase: Creating the Design Document     53

Creating the Migration Document     57

The Prototype Phase      62

The Pilot Phase: Deploying Services to a Limited Number of Users      65

The Production Migration/Upgrade      67

Summary     68

Best Practices     69

 

Part II: Planning and Designing an Exchange Server 2010 Environment

3     Understanding Core Exchange Server 2010 Design Plans     71

Planning for Exchange Server 2010      71

Understanding AD Design Concepts for Exchange Server 2010      76

Determining Exchange Server 2010 Placement      80

Configuring Exchange Server 2010 for Maximum Performance and Reliability     83

Securing and Maintaining an Exchange Server 2010 Implementation     86

Summary     87

Best Practices     87

4     Architecting an Enterprise-Level Exchange Server Environment     89

Designing Active Directory for Exchange Server 2010     89

Determining Hardware and Software Components     92

Designing Exchange Server Roles in an Exchange Server Environment     93

Designing Exchange Server Infrastructure      97

Integrating Client Access into Exchange Server 2010 Design      99

Summary     100

Best Practices     101

5     Integrating Exchange Server 2010 in a Non-Windows Environment     103

Synchronizing Directory Information with Forefront Identity Manager (FIM)      104

Managing Identity Information Between LDAP Directories and Exchange Server 2010     109

Using Services for UNIX to Integrate UNIX Systems with an Active Directory/Exchange Server 2010 Environment     111

Understanding the Identity Management for UNIX Components     118

Administrative Improvements with Windows Server 2008     121

Summary     122

Best Practices     123

6     Understanding Network Services and Active Directory Domain Controller Placement for Exchange Server 2010      125

Domain Name System and Its Role in Exchange Server 2010      125

Outlining the Types of DNS Servers     128

Examining DNS Components      129

Using DNS to Route SMTP Mail in Exchange Server 2010     137

Understanding DNS Requirements for Exchange Server 2010      138

Configuring DNS to Support Exchange Servers      144

Troubleshooting DNS Problems     144

Global Catalog and Domain Controller Placement     148

Examining the Role of Domain Controllers in AD     150

Defining the Global Catalog     152

Exploring DSAccess, DSProxy, and the Categorizer      159

Understanding AD Functionality Modes and Their Relationship to Exchange Server Groups     163

Summary     166

Best Practices     167

 

Part III: Implementing Exchange Server 2010 Services

7     Installing Exchange Server 2010     169

Understanding the Exchange Server 2010 Server Roles     170

Understanding the Prerequisites for Exchange Server 2010     171

Understanding High Availability and Site Resilience in Exchange Server 2010      174

Exchange Server 2010 Hardware Requirements     175

Understanding the Active Directory Requirements for Exchange Server 2010      176

Understanding Role Based Access Control     186

Planning Your Exchange Server 2010 Installation     188

Deploying Active Directory from Scratch       190

Preparing Your Environment for Exchange Server 2010      199

Installing Exchange Server 2010      206

Finalizing the Deployment     209

Summary     210

Best Practices     211

8     Implementing Edge Services for an Exchange 2010 Environment      213

Installing and Configuring the Edge Transport Server Components      214

Utilizing the Basic Sender and Recipient Connection Filters      222

Utilizing SenderID on an Edge Transport Server     231

Using Content Filtering to Isolate Inappropriate Content     237

Fine-Tuning Content Filtering     243

Using Content Filtering to Allow and Reject Domain-Level Content     245

Filtering Content in a Message Attachment      247

Using Sender/IP Reputation to Filter Content      250

Using Address Rewriting to Standardize on Domain Address Naming for an Organization     252

Using EdgeSync to Synchronize Active Directory Information to the Edge Transport Server     255

Implementing Safelist Aggregation for Outlook 2003 and Outlook 2007     259

Managing and Maintaining an Edge Transport Server      261

Forefront Online Security for Exchange Server 2010     265

Summary     266

Best Practices     266

9     Using Windows PowerShell in an Exchange Server 2010 Environment     269

What Is Windows PowerShell     269

Introducing the Exchange Management Shell     272

Understanding the Exchange Server Task Model     275

Starting the Exchange Management Shell      276

More on How PowerShell and EMS Work Together      280

Understanding the EMS Syntax     281

Creating Your Own Scripts      285

Managing Cmdlets     288

Introducing the Windows PowerShell Command Log      289

Using EMS to Do Administrative Mailbox Tasks     290

Using EMS to Do Reporting     295

Finding Other Resources     297

Summary     298

Best Practices     298

 

Part IV: Securing an Exchange Server 2010 Environment

10     Client-Level Secured Messaging     301

Microsoft’s Trustworthy Computing Initiative      301

Securing Your Windows Environment      302

Exchange Server 2010 Client-Level Security Enhancements     311

Securing Outlook 2007      312

Protecting Against Spam     317

Securing Outlook Web App      322

Summary     324

Best Practices     325

11     Server and Transport-Level Security      327

Considering the Importance of Security in an Exchange Server 2010Environment     327

Components of a Secure Messaging Environment      331

Exchange Server-Level Security Features      344

Transport-Level Security Defined      350

Exchange Server 2010 SMTP Connectors     352

Edge Transport Server Connectors      359

Securing Windows for the Edge Transport Server Role     364

Summary     366

Best Practices     366

12     Integrating Certificate-Based Public Key Infrastructure (PKI) in Exchange Server 2010     369

Understanding Public Key Infrastructure     370

Installing a Windows Certification Authority Server     376

Server Certificates in Exchange Server 2010      378

Implementing Secured Email Communications with Exchange Server 2010     383

Using Outlook to Send and Receive Digitally Signed and Encrypted Emails     388

Summary     394

Best Practices     394

13     Securing Exchange Server 2010 with ISA Server     397

Understanding the Internet Security and Acceleration (ISA) Server 2006      398

Outlining the Need for ISA Server 2006 in Exchange Server Environments      398

Outlining the Inherent Threat in Exchange Server HTTP Traffic     401

Securing Exchange Outlook Web App with ISA Server 2006     403

Securing POP and IMAP Exchange Server Traffic      412

Managing and Controlling Simple Mail Transfer Protocol (SMTP) Traffic     414

Logging ISA Traffic     417

Monitoring ISA from the ISA Console     420

Summary     425

Best Practices     425

14     Understanding Exchange Policy Enforcement Security     427

What Is Exchange Policy Management in Exchange Server 2010     428

Understanding Relevant Governmental Regulations for Policy Enforcement     428

Using Transport Agents in Exchange Server 2010      439

Understanding the Hub Role Transport Agents in Exchange Server 2010     440

Implementing Transport Agent Policies on the Edge      446

Creating Messaging Records Management Policies      448

Summary     453

Best Practices     453

 

Part V: Migrations and Coexistence with Exchange Server 2010

15     Migrating from Active Directory 2000/2003 to Active Directory 2008     455

Understanding What Needs to Be Migrated to Windows Server 2008      455

Understanding the Benefits to Upgrading Active Directory     458

Beginning the Migration Process     460

Big Bang Migration      463

Phased Migration      467

Multiple Domain Consolidation Migration     479

Summary     489

Best Practices     490

16     Transitioning from Exchange Server 2003/2007 to Exchange Server 2010     491

High-Level Guide for Transition from Exchange Server 2003 to Exchange Server 2010      492

 High-Level Guide for Transition from Exchange Server 2007 to Exchange Server 2010      493

 Understanding How to Transition to Exchange Server 2010      494

Understanding What’s New and What’s Different with Exchange Server 2010      497

Deploying a Prototype Lab for the Exchange Server 2010 Transition Process      502

Transitioning to a Brand-New Exchange Server 2010 Environment     504

Transitioning from Exchange Server 2003 to Exchange Server 2010     505

Transitioning from Exchange Server 2007 to Exchange Server 2010     520

Summary     521

Best Practices     521

17     Implementing Client Access and Hub Transport Servers     523

Understanding the Client Access Server      524

Installing the Client Access Server      544

Understanding the Hub Transport Server      546

Transport Pipeline     550

Installing the Hub Transport Server      553

Test Cmdlets for CAS and Hub Transport Servers     555

Summary     561

Best Practices     561

 

Part VI: Exchange Server 2010 Administration and Management

18     Administering an Exchange Server 2010 Environment     563

Introduction to Role Based Access Control     563

Administrative Tools      570

Performing Common Tasks      584

Recipient Configuration      604

Understanding Journaling      611

Understanding Archiving      616

Using the Exchange Server 2010 Toolbox     618

Exchange Server Coexistence      627

Server Administration     628

Summary     631

Best Practices     632

19     Exchange Server 2010 Management and Maintenance Practices      633

Proper Care and Feeding of Exchange Server 2010      633

Maintenance Tools for Exchange Server 2010      636

The Exchange Control Panel     640

Auditing the Environment      647

Best Practices for Performing Database Maintenance     656

Prioritizing and Scheduling Maintenance Best Practices     658

Post-Maintenance Procedures     663

Reducing Management and Maintenance Efforts     664

Summary     665

Best Practices     665

20     Using Operations Manager to Monitor Exchange Server 2010     667

OpsMgr Exchange Server 2010 Monitoring      668

What’s New in OpsMgr R2      670

Explaining How OpsMgr Works      671

Outlining OpsMgr Architecture     674

Understanding How to Use OpsMgr      677

Understanding OpsMgr Component Requirements      680

Understanding Advanced OpsMgr Concepts     681

Securing OpsMgr     686

Installing Operations Manager 2007 R2     689

Installing Edge Transport Monitoring Certificates     697

Summary     703

Best Practices     704

21     Remote Administration of Exchange Server 2010 Servers     705

Certificates, Trust, and Remote Administration     706

Using the Exchange Management Console Remotely     707

Using the Remote Exchange Management Shell      707

Using the ECP Remotely     710

RDP with Exchange Server 2010      710

Summary     724

Best Practices     725

22     Documenting an Exchange Server 2010 Environment     727

Benefits of Documentation     728

Exchange Server 2010 Project Documentation     730

Exchange Server 2010 Environment Documentation      741

Exchange Server 2010 Administration and Maintenance Documents     744

Disaster Recovery Documentation      747

Performance Documentation      749

Security Documentation     750

Training Documentation      752

Summary     752

Best Practices     753

 

Part VII: Unified Communications in an Exchange Server 2010 Environment

23     Designing and Implementing Mobility in Exchange Server 2010    755

Understanding Mobility Enhancements in Exchange Server 2010     755

Enabling ActiveSync in Exchange Server 2010      757

Securing Access to ActiveSync with Secure Sockets Layer Encryption     760

Securing Access to ActiveSync Using Internet Security and Acceleration (ISA) Server 2006      764

Working with ActiveSync Policies      768

Working with Windows Mobile Pocket PC and Smartphone Editions      770

Summary     774

Best Practices     775

24     Designing and Configuring Unified Messaging in Exchange Server 2010     777

Unified Messaging Features      777

Unified Messaging Architecture     783

Unified Messaging Installation     797

Monitoring and Troubleshooting Unified Messaging     811

Unified Messaging Shell Commands     825

SIP Protocol      828

Summary     831

Best Practices     831

25     Collaborating Within an Exchange Server Environment Using Microsoft Office SharePoint Server 2007     833

Understanding the History of SharePoint Technologies     833

Identifying the Need for MOSS 2007      837

Exploring Basic MOSS Features     838

Exploring End-User Features in MOSS      845

Customizing and Developing MOSS Sites     851

Summary     854

Best Practices     854

26     Integrating Office Communications Server 2007 in an Exchange Server 2010 Environment     857

Understanding Microsoft’s Unified Communications Strategy     858

Installing OCS 2007 R2     861

Exploring Office Communications Server Tools and Concepts      876

Installing and Using the Communicator 2007 Client     879

Web Conferencing      880

Summary     881

Best Practices     881

 

Part VIII: Client Access to Exchange Server 2010

27     Getting the Most Out of the Microsoft Outlook Client      883

Outlook over the Years      883

Highlighted Features in Outlook 2007     885

Security Enhancements in Outlook 2007      893

Implementing Outlook Anywhere      900

Deploying Outlook 2007      903

Using Outlook 2007     905

Using Cached Exchange Mode for Offline Functionality     914

Summary     919

Best Practices     920

28 Leveraging the Capabilities of the Outlook Web App (OWA) Client      921

Understanding Microsoft’s Direction on OWA      922

What’s New in OWA 2010?      924

Understanding Available Versions and Security Options      927

Using OWA 2010     931

Using the Calendar in OWA      947

Using Tasks in OWA     952

Using Contacts in OWA     953

Using Keyboard Shortcuts     953

The Options Page     954

Signing Out of OWA 2010     967

Configuring OWA and IM Integration     967

Summary     972

Best Practices     972

29     Using Non-Windows Systems to Access Exchange Server 2010     973

Understanding Non-Windows--Based Mail Client Options     974

Outlook Express      977

Mac Mail, iCal, and Address Book     982

Configuring and Implementing Entourage for the Mac     984

Remote Desktop Connection Client for Mac     987

Understanding Other Non-Windows Client Access Methods      991

Summary     993

Best Practices     993

30     Deploying the Client for Microsoft Exchange Server 2010     995

Outlook 2007 Auto Account Setup      995

Understanding Deployment Options     999

Planning Considerations and Best Practices      1003

Preparing the Deployment      1005

Installing the Outlook Client for Exchange Server     1012

Pushing Outlook Client Software with Group Policies     1015

Deploying with Microsoft System Center Configuration Manager 2007      1023

Managing Post-Deployment Tasks     1025

Summary     1026

Best Practices     1026

 

Part IX: Data Protection and Disaster Recovery of Exchange Server 2010

31     Database Availability Group Replication in Exchange Server 2010     1027

Understanding Database Availability Groups      1028

Deploying a Database Availability Group      1030

Comparing and Contrasting DAG Versus CCR/SCR/SCC     1050

Load Balancing in Exchange Server 2010      1052

Summary     1057

Best Practices     1057

32     Backing Up the Exchange Server 2010 Environment     1059

Understanding the Importance of Backups      1059

Establishing Service Level Agreements     1061

Supporting Backups with Documentation     1063

Logging Daily Backup Results and Evaluation     1066

Roles and Responsibilities     1066

Developing a Backup Strategy      1067

What to Back Up on Exchange Servers      1071

The Need for Backups with Database Availability Groups      1074

Backing Up Windows Server 2008 and Exchange Server 2010      1075

Backing Up Specific Windows Services      1078

Summary     1081

Best Practices     1082

33     Recovering from a Disaster in an Exchange Server 2010 Environment     1085

Identifying the Extent of the Problem      1086

What to Do Before Performing Any Server-Recovery Process      1090

Preparing for a More Easily Recoverable Environment      1091

Recovering from a Site Failure     1094

Recovering from a Disk Failure     1098

Recovering from a Boot Failure      1100

Recovering from a Complete Server Failure     1101

Recovering Exchange Server Application and Exchange Server Data      1103

Recovering from Database Corruption     1105

Recovering Internet Information Services     1109

Recovering Windows Server 2008 Domain Controllers     1109

Recovering Active Directory      1110

Summary     1112

Best Practices     1113

 

Part X: Optimizing Exchange Server 2010 Environments

34     Optimizing an Exchange Server 2010 Environment     1115

Examining Exchange Server 2010 Performance Improvements     1116

Analyzing Capacity and Performance      1119

Optimizing Exchange Server 2010 Servers     1122

Monitoring Exchange Server 2010      1131

Analyzing and Monitoring Core Elements      1131

Properly Sizing Exchange Server 2010      1137

Optimizing Exchange Server Through Ongoing Maintenance      1146

Monitoring Exchange Server with System Center Operations Manager     1146

Summary     1147

Best Practices     1147

35     Designing and Optimizing Storage in an Exchange Server 2010 Environment     1149

Defining the Technologies     1150

When Is the Right Time to Implement NAS and SAN Devices?     1152

Designing the Right Data Storage Structure for Exchange Server 2010      1154

Adding in Fault Tolerance for External Storage Systems      1160

Recommendations for SAN and NAS Solutions      1161

Making the Best Use of SAN/NAS Disks with Exchange Server 2010     1163

Summary     1167

Best Practices     1168

Index      1169