Exchange 2013 unable to send email.

After we changed ISP our exchange server was unable to sent emails to some recipients. The error message it get from other servers was "421 Refused. Your reverse DNS entry does not resolve.". The problem was that ISP does not wrote PTR records in their DNS servers. When DNS records was ok. Problem was still there.
Short investigation show that we had 2 IP adresses on routers WAN interface, and default IP was not the same as dns record points to. The solution is to add NAT rule on the router so that source IP of the exchage server was changed to correct IP.

Exchange 2013 how to change banner message

get connectors list:

Get-Receiveconnector

set connector banner:

Set-Receiveconnector "connector name" -Banner "220 mail.domain.com"

check banner:

Get-Receiveconnector "connector name" | fl

delete banner:

Set-Receiveconnector "connector name" -Banner $null

Asterisk. Issue with IVR. DTMF not properly detected.

Asterisk routes all incoming calls, received through chan dongle, to IVR, where callers should press '1', '2' or '3'. Depends on selection made in IVR call is routed to different destination.
When call comes from mobile operator everything works fine, but when call received from landline(actually it was from alcatel pbx) it is impossible to choose destination in IVR.
Affter turning on DTMF logging and playing a little with IVR from landline, log looks like:

[Apr 18 07:56:28] DTMF[1787]: channel.c:4062 __ast_read: DTMF begin '1' received on Dongle/dongle0-0100000000
[Apr 18 07:56:28] DTMF[1787]: channel.c:4066 __ast_read: DTMF begin ignored '1' on Dongle/dongle0-0100000000
[Apr 18 07:56:30] DTMF[1787]: channel.c:4062 __ast_read: DTMF begin '2' received on Dongle/dongle0-0100000000
[Apr 18 07:56:30] DTMF[1787]: channel.c:4066 __ast_read: DTMF begin ignored '2' on Dongle/dongle0-0100000000
[Apr 18 07:56:30] DTMF[1787]: channel.c:4062 __ast_read: DTMF begin '3' received on Dongle/dongle0-0100000000
[Apr 18 07:56:30] DTMF[1787]: channel.c:4066 __ast_read: DTMF begin ignored '3' on Dongle/dongle0-0100000000

It means that asterisk detected DTMF, but duration is of DTMF is too short. To resolve this issue edit dongle.conf file. Find the section [dongleX] where 'X' dongle's number, which receives call, and add or edit parameter mindtmfduration=0. Restart asterisk and make test call. Log file should look like:

[Apr 18 10:35:02] DTMF[2014]: channel.c:4062 __ast_read: DTMF begin '1' received on Dongle/dongle0-0100000002
[Apr 18 10:35:02] DTMF[2014]: channel.c:4066 __ast_read: DTMF begin ignored '1' on Dongle/dongle0-0100000002
[Apr 18 10:35:02] DTMF[2014]: channel.c:3977 __ast_read: DTMF end '1' received on Dongle/dongle0-0100000002, duration 63 ms

It means that asterisk received DTMF code and accepted it(because it shows the duration in the log). After that increase mindtmfduration parameter until you find that asterisk do not accept DTMF signals like it was before. Then decrease duration to last working value.

Exchange 2013. Meeting invitations get stuck in a poison queue.

After meeting invitation arrives from external domain, and user accepts meeting. Meeting acceptance message some how crushes transport service and meeting initiator do not get confirmation about meeting acceptance.
The same scenario takes place when user trying to send meeting invitation from my organization to external. Transport service stops and then restarts.

Searching the web did not bring a lot of info, so I started to digging in event logs.
In the event log I found error 10003:

Event 10003, MSExchangeTransport
The transport process failed during message processing with the following call stack: System.ArgumentException: codePage is not detectable...

That probably happens because regional settings on server was set to "Lithuanian".
Check exchange configuration:

Get-RemoteDomain -Identity * | fl

CharacterSet and NonMimeCharacterSet on my server was set to iso-8859-13.
Change it to iso-8859-1("Western European ISO"):

Set-RemoteDomain -Identity * -CharacterSet iso-8859-1 -NonMimeCharacterSet iso-8859-1

after that users can send and accept invitations without any problems.

Exchange 2013 MSDiagnostics Error 1006

Error exist from exchange 2013 RTM to 2013 CU3
Error look like:

The performance counter ‘\\SERVER\LogicalDisk(HarddiskVolume1)\Free Megabytes’ sustained a value of ’0,15′, for the ’10′ minute(s) interval starting at ’8/20/2013 7:21:00 AM’. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:exchndb1

It is not clear what does this error means, because 50% of hard drive space is free.
You can disable this notification. To do this edit configuration file:

C:\Program Files\Microsoft\ExchangeServer\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe.config

Change “ExchangeJobs.Triggers.DatabaseDriveSpaceTrigger” from “True” to “False”. After making changes do not forget to restart exchange diagnostic service.

How to enable and configure spam filter on exchange 2013

In Microsoft Exchange Server 2013, the following anti-spam agents are available in the Transport service on Mailbox servers, but they are not installed by default:

• Content Filter agent
• Sender ID agent
• Sender Filter agent
• Recipient Filter agent
• Protocol Analysis agent for sender reputation

You can install these anti-spam agents on a Mailbox server using a script in the Exchange Management Shell.

1. Instalation

Use the shell to run Install-AntispamAgent.ps1 script

& $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

Then close power shell, restart Transport Service and open power shell again.

Specify SMTP servers of your organization

Set-TransportConfig -InternalSMTPServers @{Add="<ip address1>","<ip address2>"...}
example:

Set-TransportConfig -InternalSMTPServers @{Add="10.0.1.22","10.0.1.23"}

check servers list:

Get-TransportConfig | Format-List InternalSMTPServers

InternalSMTPServers : {10.0.1.22, 10.0.1.23)

to clear list set it to $null

Set-TransportConfig -InternalSMTPServers $null

to remove item from list:

Set-TransportConfig -InternalSMTPServers @{Remove="10.0.1.23"}

2. Sender filtering configuration

2.1 Sender block list

Set-SenderFilterConfig -Enabled $true

senders can be blocked on tree different block lists

• blocked senders
• blocked domains
• blocked domains and subdomains

Set-SenderFilterConfig -BlockedSenders @{Add="spammer@domain.com",spammer2@domain.com} -BlockedDomains @{Add="spammers.com"}

check bloked senders list

Get-SenderFilterConfig | fl BlockedSenders, BlockedDomains

you should get somthing similar to:

BlockedSenders : {spammer@domain.com, spammer2@domain.com}
BlockedDomains : {spammers.com}

2.2 Empty sender blocking

Set-SenderFilterConfig -BlankSenderBlockingEnabled $true

this is usually used to block NDR, received from internet.

 

3. Recipient filtering

Set-RecipientFilterConfig -Enabled $true

Then enable feature of recipient filter config

Set-RecipientFilterConfig -BlockListEnabled $true

Populate blocked recipients list

Set-RecipientFilterConfig -BlockedRecipients @{Add="internal@domain.com", "internal2@domain.com"}

Check that list populated:

Get-RecipientFilterConfig | fl BlockedRecipients

BlockedRecipients : {internal@domain.com, internal2@domain.com}

3.1 Block recipients that is not listed in global address book.

Set-RecipientFilterConfig -RecipientValidationEnabled $true

that blocks all mails to non existing users, but it could expose all directory emails for spammers that use directory harvesting. To protect from directory harvesting we can set delay between send email requests.

get list of receive connectors:

Get-ReceiveConnectors

get tarpit interval of connector:

Get-ReceiveConnector "WIN2012-TEST\Default Frontend WIN2012-TEST" | fl tar*

TarpitInteval : 00:00:05

Set interval to 6 seconds

Set-ReceiveConnector "WIN2012-TEST\Default Frontend WIN2012-TEST" -TarpitInterval 00:00:06

How to install telnet client from cli in windows server 2012

Open cli and type following command:

pkgmgr /iu:"TelnetClient"