Archive for January, 2013

ITPro Private Cloud Camp (or Belgrade, here I come again)

Saturday, January 26th, 2013

After very successful Windows Server 2012 ITCamp that I delivered in December 2012 in Microsoft Serbia, we scheduled another event, this time with Private Cloud as main topic. This whole day event will be held in Microsoft Serbia on Feb 11. Beside myself, my colleagues Ljubomir Ivanis and Predrag Jelesijevic will also participate in delivering content.
We plan to talk about following topics:

  • Windows Server 2012 as a private cloud platform
  • Hyper-V 3.0
  • VMM 2012 SP1 – private cloud virtualization management
  • System Center 2012 family – enabling private cloud

I’m sure we’ll deliver great content and have a great feedback from participants, like we did last time!

See you in Belgrade!

Configuring Domain Security on Exchange Server 2013

Thursday, January 24th, 2013

A need to protect SMTP traffic is not uncommon. In general, you can’t always protect it. Inside your organization, it’s pretty easy – you can easily implement digital signatures or encryption for emails, but if you want to go outside, things are becoming more complicated. You can still use digital signing (S/MIME) on emails, but if your certificate is issued by your internal PKI, it probably won’t be trusted on recipient side. That will not prevent functionality of digital signature, but will affect trust.

If you want to send encrypted emails outside your organization, things are even more complicated. If you want to use just built-in Outlook features for message encryption, you will need to have public key of any recipient that you want to send encrypted message to. Inside your organization, this is not an issue as you can publish certificates in AD DS. However, outside, on the Internet this is not an easy job. Sure, there are some third party tools for this, but let’s see what we can do without them.

Domain Security is a feature of Exchange Server (both 2010 and 2013) that can secure SMTP traffic between two Exchange organizations. It is implemented on server level, and it works without configuring any options on user (sender or recipient) side. Domain Security uses mutual TLS authentication to provide session-based authentication and encryption. Mutual TLS authentication is different from TLS as it’s usually implemented. Usually, when you implement TLS, client will verify the server certificate, and authenticate the server, before establishing a connection.

With mutual TLS authentication, each server verifies the connection with the other server by validating a certificate that’s provided by that other server, so clients are not included at all. We establish secure SMTP channel between two Exchange Servers, usually over the Internet.
Clients, Outlook and Outlook Web App, will be aware that Domain Security is established. Green icon with check mark will be shown on each messages exchanged between servers on which Domain Security is implemented.

Capture1

As you can see, Domain Security can be applied between two (or more) known Exchange organizations. Still, it can’t protect whole SMTP traffic that comes and goes from your Exchange organization, but it can efficiently protect SMTP traffic between partner organizations.

Let’s see how to configure it. I’ll show the procedure for Exchange Server 2013, but most of it can be applied to Exchange Server 2010 also. Let’s assume that we want to establish Domain Security between two Exchange organizations named adatum.com and treyresearch.net (Yes, I’m using domain names from Microsoft Learning courses, but since I write these courses, I just get used to that Smile)

1. Establish certificate trust between organizations

As said before, Domain Security relies on certificates. Because of this, you should first establish certificate trust between two organizations where you want to implement Domain Security. You can do it on several ways. If both organizations are using publicly trusted certificate on Exchange servers, you are good to go. If that’s not the case you will have to cross-import Root CA certificates on both sides. Alternatively, you can also issue certificates for SMTP for both Exchange organization from a single trusted RootCA. Anyway, the point is that each Exchange server must trust the certificate installed (and assigned to SMTP service) on another Exchange server. Achieve this in any way you like. Besides establishing trust, make sure that certificate common name is same as the name that Exchange server provides in HELO/EHLO conversation.

However, it’s important to notice one thing here. In Exchange Server 2010, you would be doing this on Edge Transport server or if you didn’t deploy one, on Hub Transport server. Since these two roles are no more in Exchange 2013, these certificates should be installed on CAS servers which, in Exchange Server 2013, host FrontEnd Transport Service. Also, it is important that certificate you want to use for Domain Security is assigned to SMTP (it can be assigned to other services as well)

Capture2

2. Configure Domain Security

As both sides/companies will be sending and receiving emails, following procedure should be done on both sides, but domain names should be used vice-versa.

First, open Exchange Management Shell and execute this cmdlet :

Get-TransportConfig | FL

You will get whole list of transport settings but we want two of them : TLSReceiveDomainSecureList and TLSSendDomainSecureList. If you were not configuring Domain Security so far, you will have these two values empty. To use Domain Security we must populate these parameters with appropriate values.
TLSReceiveDomainSecureList – specifies the domains from which you want to receive domain secured email by using mutual Transport Layer Security (TLS) authentication
TLSSendDomainSecureList – specifies the domains from which you want to send domain secured email by using mutual TLS authentication

If we are on adatum.com side, we will execute following:

Set-TransportConfig -TLSSendDomainSecureList adatum.com and
Set-TransportConfig –TLSReceiveDomainSecureList treyresereach.net

After this, when you run the Get cmdlet again you should have these values:

Capture3

Logically, on treyresearch side we will issue same commands but domains will be inverted. If you have more than one company with requirement for Domain Security, you can provide their domain names too. This cmdlet accepts multivalued parameters.

3. Configure connectors

Now, we will create dedicated connectors for Domain Security. Let’s first create the send connector. You can use Exchange Admin center for this. Navigate to mail flow, click Send connectors and add new one. In a wizard, type the name of the connector and select Partner type. Don’t use the smart host, but leave MX record as a method to send mail. For connector address space, type the domain name from other Exchange organization. If you are on Adatum.com side, you will type treyresearch.net. On the source server page of wizard, select Mailbox server that you want to use as a source. It doesn’t matter which one you will choose since we will configure connector to proxy through CAS. When you create the connector, double click it and then enable options “Proxy through client access server”. You can also configure maximum message size for this connector if you want, and enable protocol logging.

Capture4

Now back to Exchange Management Shell,and execute :

Get-SendConnector –identity ConnectorName | FL

Look for the value of parameter DomainSecureEnabled. It should be True. If it’s not you can easily set it with Set-SendConnector –identity ConnectorName –DomainSecureEnabled:$true

Let’s now configure Receive connector. Back to EAC, click mail flow and then click receive connectors. In Select server drop-down list choose your Client Access server.

Select Partner for connector type, configure receiving IP address if you want (or just leave all available) but on remote network settings page, you should configure only the IP address assigned to another organization Exchange server. This should be (public) IP from which partner’s Exchange server sends email. After you create the connector double click it, and click on security tab. Make sure that authentication options are set like on following screenshot.

Capture5

4. Test the Domain Security

Easiest way to test this is to just send email from one organization to another from Outlook. If you get the message with green check mark, you are all set. If not, then you’ll need some troubleshooting. You can enable protocol logging by executing :

Set-ReceiveConnector Internet -ProtocolLoggingLevel Verbose, and

Set-SendConnector Internet -ProtocolLoggingLevel Verbose

to verify TLS channel. If message doesn’t arrive to recipient but doesn’t come back as NDR, you should check queue.

Or you can just wait for my next blog post, where I will discuss some troubleshooting Smile.

Microsoft Learning is considering exams reports changes

Monday, January 21st, 2013

If you ever took a Microsoft exam of any kind then you’re probably familiar with score report that you get at the end of exam. It hasn’t been changed for years, and now MSL is thinking about changing it. If you want to influence that, Born to Learn blog site has published an article about that with a link to the survey. You can participate, survey is open to everyone. Here.

Mobile devices, certificates and Exchange Server

Sunday, January 20th, 2013

Few days ago I tried to import my personal certificate (by Verisign) to Windows Phone 8 device. I exported it as .pfx, sent to my self in a email and then opened it on device. It worked. Sort of. I mean, WP did import the certificate but didn’t provide any clue what I can do with it. I tried to find option to digitally sign or encrypt email, but with no luck. Next thing that came up on my mind was certificate based authentication to Exchange Server. Then I’ve found this article. It seems like WP8 now fully supports certificate based authentication against Exchange Client Access Server. However, my personal certificate issued by Verisign, will not be of any use here as it is not issued by my internal PKI. Will have to get new one and put it on device, and then I will try this.

This seems to be very useful option for authentication to CAS. I think that besides WP8, Android and iOS also support cert based authentication. I will try all three platforms and will post results here. And, it will be nice if WP8 has some certificate management implemented – now when you import the certificate, it’s like in a black hole, no way you can find or manage it (or I didn’t find a way to do it).

(off topic)–New page for students and math lovers

Sunday, January 20th, 2013

As said in title, this is off topic post, but since I’m also mathematician (although not working with math for quite a long time), I want to give some visibility to the project that my wife Manuela (who’s a professional mathematician) started recently.

She decided to start a web page primarily to help students prepare for exams in math subjects that she teaches on Faculty of Science (Math department) in Sarajevo. She already published quite a few practices and exam examples, as well as some of her work.

I sincerely hope that more teachers from faculties and schools will take this path also.

If you want to take a look at the page, or just give some more visibility to this project, here is the link to Manuela’s angle.

Why Brain Dumps Are Bad–from Born to Learn

Tuesday, January 15th, 2013

I think it’s a valuable reading. As I  run CPLS (and Prometric testing center), from time to time I see people who obviously pass exams with brain dumps used before that. To all of them, and to others that think that way, I recommend this article on Born to Learn site. I ‘ll extract just one sentence from there: “I won’t tell you how we know when someone has used a brain dump to pass an exam, but we know.” Smile

My session on tomorrow’s MSCommunity meeting–Exchange Server 2013 Transport services

Tuesday, January 15th, 2013

Tomorrow we will have MSCommunity Bosnia meeting, with two sessions. One session will be delivered by our colleague Ana Mihalj, about SQL Server 2012 HA technologies. Another session will be delivered by myself, and most of it will be actually based on this picture (taken from MS Technet):

MailFlow

In fact, I will be talking about transport services in Exchange Server 2013. Unlike Exchange Server 2010, Exchange Server 2013 does not have dedicated Hub and Edge Transport server roles. During my session, I will help you understand how transport services now works on new Exchange Server 2013 role architecture. We will also take a look at the new EAC interface and some other cool features of new Exchange.

See you tomorrow at Logosoft Edukacija classroom @6pm.

MSNetwork 3.0–Call for content is open!

Monday, January 14th, 2013

3022_msn3_jpg-550x0

It’s great to announce that MSNetwork 3.0 call for content is now open. You can submit your sessions by using online form at this link.

If you didn’t catch that before, third Bosnian Microsoft conference will be held in Banja Vrucica hotel complex in place near Teslic (around 180 km from Sarajevo), on 3rd and 4th April 2013.

I’m one of the content owners, and I’m really looking forward to see some great sessions. As last year, I will be managing ITPro and Community Experts tracks. This year we renamed Community track to Community Experts to emphasize the type of sessions we expect to have there. So, if you were thinking that Community track is kind of degraded comparing to others, think twice – we expect this to be premier track for experts, and hope to have Level 400 sessions there.

Beside these two tracks we will also have Business and Developer tracks, managed by my colleague Enis Sahinovic. One more thing is new this year – we have one new track called Learning Solutions. In this track we will try to present some learning solutions built on MS platforms. It will be great to see what Microsoft partners from Bosnia and Herzegovina have to offer in this field.

If you are not the speaker, keep your eye on www.msnetwork.ba – registration for attendees will be opened soon. We also expect to have MSNetwork 3.0 Windows Phone app available soon.

For more details about conference (for speakers) I recommend that you visit MSDN BIH Blog on this link.

See you soon in Teslic!

Exchange Server 2013 MOC courses–soon in Logosoft

Sunday, January 13th, 2013

Next month, Stanley Reimer and myself will deliver two brand new MOC courses about Exchange Server 2013. The courses are 20341A:Core Solutions of Microsoft Exchange 2013 and 20342A:Advanced Solutions of Microsoft Exchange 2013. Both courses are currently in development, and both Stan and myself work as authors on these courses. You can find details on these courses on Microsoft Learning portal. We tried to to keep up with same (or better) quality level as with 10135 and 10233 courses, and I think we made good and interesting courses.

As before, first teaching of new MOC courses is available under discounted price for those who register early enough. We will also try to provide few seats for community members.

On each of these courses we will award one student with Windows Phone 8 device Smile. For more information about registration please contact Logosoft Edukacija.

System Center 2012 Service Manager Cook Book–giveaway!

Saturday, January 12th, 2013

Anyone interested in System Center Service Manager 2012, is likely to find interesting new Service Manager Cookbook, published by Packt Publishing and written by several MVPs and MCT, the experts in this field. Since Service Manager 2012 is much more than just another product from the System Center family, and you definitely can’t just click it through, it is more than advisable to consult the literature of this type before entering the stage of planning and deployment. The book therefore begins with the story of a rather non-technical ITSM Framework and processes, ITIL, Asset Management, Service Request, Incident and Problem Management and the IT Service Desk processes and operations. The first chapter ends with a discussion of service level management, which is a very important component. The rest of the book is divided into 11 chapters and two appendices, deals with the administration and configuration of Service Manager 2012, from the standpoint of its individual components and resources they manage, but also on the processes that are carried out within a manageable IT infrastructure. It ends with a chapter on the automation of processes through the Service Manager which is probably what everyone aspires. Very valuable source of information, I recommended this!

Microsoft System Center 2012 Service Manager Cookbook

I’m very pleased to announce that I have teamed up with Packt Publishing and are organizing a give away especially for readers of by blog. All you need to do is just comment below the post and win a free copy of Microsoft System Center 2012 Service Manager Cookbook. Two lucky winners stand a chance to win an e-copy of the book. Keep reading to find out how you can be one of the Lucky One.

How to enter drawing?

Simply post your expectations from this book in comments section below. You could be one of the 2 lucky participants to win the e-copy.The contest will close on 18/01/13 . Winners will be contacted by email, so be sure to use your real email address when you comment!