An Inside View of Microsoft Exchange 2010 SP2

An Inside View of Microsoft Exchange 2010 SP2
11/23/ :46 AM EXL304 An Inside View of Microsoft Exchange 2010 SP2 Jeff Mealiffe Sr. Program Manager Microsoft Corporation © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Agenda Some facts, figures and otherwise interesting info about Exchange 2010 SP2 and our servicing process Four new features in SP2 Mini version of Outlook Web App Hybrid Configuration Wizard Address Book Policies Impact on our hosting/multi-tenant strategy OWA Cross Site Silent Redirection The latest from our update rollups Recoverable items versioning

Exchange SP2 Facts Exchange is a very complex product
~20 million lines of code (over half is test code) Every release we produce goes through a very large battery of automated testing as well as targeted hands-on testing in various forms We’re constantly working to improve quality and efficiency SP2 was released ~6 months ago 3 rollup updates have been released since then

Exchange SP2 Facts Service packs these days are about bugs AND features New features are generally reserved for service packs (vs. update rollups) Features often require schema updates SP2 contained ~600 bug fixes in addition to 4 new features Every bug is triaged for risk, cost and applicability (i.e. how many customers will benefit) Bugs that simply make us look bad are frequently not fixed We can take it and deserve to sometimes

Mini Version Of Outlook Web App
11/23/ :46 AM Mini Version Of Outlook Web App © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

OMA? No, Introducing OWA Mini!
What you previously knew as OMA is back in SP2 This feature was driven by demand from markets where browser phones still rule Simple to administer via EMS This is a complete re-write, none of the 2003 code was re-used It is built as a set of OWA forms, rather than as a separate application – hence OWA Mini

Managing OWA Mini Enabled and disabled using Set-OWAMailboxPolicy
Set-OWAMailboxPolicy Name -OWAMiniEnabled:$True OWA Mini is an alternative view of OWA OWA mailbox policies and segmentation are inherited Any unsupported features (IRM for example) in the policy are secure by default – i.e. disabled for OWA Mini ActiveSync policies are not applied to OWA Mini Access to fully supported features such as calendar & contacts can be managed via policy Works in all OWA languages

How Does OWA Mini Work? New v-dir /owa/oma created, points to same path as /owa v-dir Similar to the /owa/Calendar v-dir Basic auth configured instead of FBA App runs in the OWA app pool When ASP.NET app starts on that v-dir, it detects path and creates an OWA Mini application (different forms that “normal” OWA) Same common codebase throughout OWA, but forms are specific to this device type

Hybrid Configuration Wizard
11/23/ :46 AM Hybrid Configuration Wizard © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Hybrid Configuration Wizard
TechReady13 11/23/2018 Hybrid Configuration Wizard Wizard plus cmdlets for setting up on-premises Exchange and O365 to work together properly – in Hybrid mode Vastly simpler process than the previous SP1 manual experience What once took ~49 steps, now takes 6 (your mileage may vary) >80% reduction for the administrator Interested in more? EXL303 – Configuring Hybrid Exchange the Easy Way © 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Address Book Policies 11/23/2018 10:46 AM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

First, Some History Of GAL Segmentation
By default in Exchange, the Global Address List contains every mail enabled object GAL Segmentation means dividing up the GAL and Address Lists Why would you want to do this? Legal or compliance reasons – people are not allowed to see each other in the GAL Optimization reasons – you have a huge GAL but operate in smaller logical units Hosting reasons – you want to host multiple organizations on one platform and don’t want them seeing each other

Some History… In the Exchange 2000 timeframe a KB that was released that outlined to how carve up your GAL but we pulled it when HMC was created For 2003, no such paper, but many support cases For 2007, a new whitepaper was born For 2010, we decided to engineer the solution into the product fully It enables us to systematically test the solution It allows CSS to fully support the solution And because customers asked for it

How Did The Previous Solutions Work?
Based on a combination of methods Using ACLs on GALs and ALs (Outlook and EAS) Requires security group membership and all ACLs to be evaluated (scale limits) MsExchQueryBaseDN (for OWA but not needed since SP1) Specify per user the base OU the user can search from (this means the OU hierarchy is rigid) Per-user OAB assignment Specify per-user the OAB the user can access Obviously many ways for things to break Need to script provisioning operations to avoid mistakes Not really well-integrated with the core design of Exchange OU hierarchy dependency didn’t work for many customers

Introducing Address Book Policies
New in SP2: Address Book Policies (ABPs) enable you to achieve GAL Segmentation in Exchange 2010 ABPs work on the principal of direct GAL and Address List assignment rather than allowing or denying access to all available lists ABPs only apply to users with mailboxes on Exchange 2010 as they plug in to the Address Book Service on the 2010 SP2 CAS role Any request that comes through the Address Book Service on CAS is evaluated against the ABP assigned to the user

A Picture Says A Thousand Words
Microsoft Exchange Connections A Picture Says A Thousand Words Address Book Policy A Address Lists AL1 AL2 AL5 AL6 Address Book Policy Assignment Address Book Policy A Default Address List GAL1 Room Address List RM AL 1 User Offline Address Book OAB B Effective Filter = GAL1 Address Lists AL 1 AL 2 AL 3 AL 4 AL 5 AL 6 Offline Address Books OAB A OAB A = AL1 + AL3 + AL4 OAB B OAB B = AL1 + AL2 + AL5 + AL6 + GAL1 Global Address Lists GAL 1 GAL 2 GAL 3 GAL 4 Room Address Lists RM AL 1 RM AL 2 Updates will be available at

What Kind Of Actions Are Impacted?
ABPs work for any client that goes through CAS for directory and: Opens the address list picker Tries to resolve a name or an alias Adds a room resource to a meeting request Searches the GAL Searches the directory from Outlook Voice Access Queries the directory from a mobile device Views someone’s DL memberships, or views the members of a DL Yes – if a user in a DL is outside the scope of your ABP, you won’t see them This prevents GAL mining by surfing up and down the member/memberof properties in some scenarios This does mean you might be sending to more people than you think you are… and that MailTips might (apparently) not be telling the truth…

ABP Deployment Scenarios Two Independent Companies
Fabrikam Inc. Tailspin Inc. Users and DL’s Users and DL’s Address Lists AL-FAB-Users-DL’s AL-FAB-Rooms AL-FAB-Contacts Default Address List GAL-FAB Room Address List Offline Address Book OAB-FAB Address Book Policy ‘Fab’ Address Lists AL-TAIL-Users-DL’s AL-TAIL-Rooms AL-TAIL-Contacts Default Address List GAL-TAIL Room Address List Offline Address Book OAB-TAIL Address Book Policy ‘TAIL’ AL-TAIL-Users-DL’s AL-FAB-Users-DL’s Room Mailbox Contacts Contacts Room Mailbox AL-FAB-Contacts AL-FAB-Rooms AL-TAIL-Contacts AL-TAIL-Rooms GAL-FAB OAB-FAB GAL-TAIL OAB-TAIL

ABP Deployment Scenarios Two Companies Sharing One CEO
Fabrikam Inc. Tailspin Inc. Big Boss Address Lists AL-TAIL-Users-DL’s AL-TAIL-Rooms AL-TAIL-Contacts Default Address List GAL-TAIL Room Address List Offline Address Book OAB-TAIL Address Book Policy ‘TAIL’ Address Lists All The AL’s There Are Default Address List Default GAL Room Address List Default All Rooms Offline Address Book Default OAB Address Book Policy ‘Boss’ Address Book Policy ‘Fab’ Users and DL’s Users and DL’s Address Lists AL-FAB-Users-DL’s AL-FAB-Rooms AL-FAB-Contacts AL-FAB-Users-DL’s AL-TAIL-Users-DL’s Default Address List GAL-FAB Room Mailbox Contacts Contacts Room Mailbox AL-FAB-Rooms AL-FAB-Contacts AL-TAIL-Rooms AL-TAIL-Contacts Room Address List AL-FAB-Rooms Offline Address Book OAB-FAB GAL-FAB OAB-FAB GAL-TAIL OAB-TAIL

ABP Deployment Scenarios Education
Faculty Principal Address Lists AL-Class A AL-All Teachers AL-All Groups Default Address List GAL-Class-A Address Book Policy ‘Student Class A’ Address Lists AL-Class A AL-Class B etc AL-All Teachers AL-All Students AL-All Groups Default Address List GAL-Principal Address Book Policy ‘Principal’ Teacher A Teacher B Class A Class B Student 1 Student 2 Everyone Class A - All Class B - All All Teachers All Students All Groups Where attribute y = ‘teacher’ or ‘principal’ Where attribute z = ‘student’ Where object type = group Address List Class X Scope All students in a specific class (one per class) Class B - All Everyone Faculty 2 4 3 DL Object Class A - All Members Class B - All Everyone Faculty 3 5 DL Object Class A - All Members

ABP Deployment Considerations
Deploying ABPs successfully is all about planning and understanding what they can, and cannot do ABPs alone do not result in ‘true’ separation – smart users can usually figure out ways to get around them or expose some data As an example: Transport will send to the real members of a DL – it ignores ABPs Don’t try and use ABPs alone to ‘fake’ multi-tenancy, it’s more complex than that ABPs are better suited to providing optimized address lists for discrete groups of users that do not share resources

Anything Else We Need To Know?
ABPs cannot prevent anyone directly connecting to AD and bypassing ABP logic So any LDAP clients, for example Outlook Mac/Entourage using LDAP will not work with ABPs You can’t use ABPs if Exchange is installed on a GC In that case, NSPI is provided by AD rather than the Address Book Service If you span DLs over ABPs you need to disable Group Management in ECP as ECP uses Get-Group which ignores ABPs Don’t try and mix and match ABPs and ACLs (unless migrating) or use QBDNs

What About ABPs and Office 365?
Making ABPs work in Office 365 is part of our long term plan but it’s not as easy as just putting the new code there Tenant admins cannot today create or manage ALs, GALs or OABs so they wouldn’t be able to create very useful ABPs  We would need to allow creation and enforce throttling Lync and SharePoint have their own directory access methods, and so do not respect ABPs We would also need to add dirsync capability to make the feature easy to manage for hybrid customers

How Does This Relate To /Hosting Mode?
Exchange 2010 “/Hosting” mode is a setup option which deploys a multi-tenant Exchange system We have announced that /Hosting mode is deprecated There will be no /Hosting mode in the next major release of the product, and there will be no additional feature adds in Exchange 2010 within /Hosting Mode Instead of using /Hosting mode, customers can deploy a hosting Exchange solution using SP2 (without /Hosting mode) and our published guidance, in collaboration with one of our 3rd party solution vendors We require using ABPs to handle GAL segmentation within the context of a multi-tenant hosting solution

Deploying A Multi-Tenant Solution
Key takeaway: Don’t use /Hosting mode* Check out our partner solution site: Site contains approved, supported solutions which use the product group’s guidance to achieve multi-tenancy within Exchange 2010 SP2 You’ll also find detailed information from the product group on supportability guidelines for solutions of this type as well as scale guidance * /Hosting mode continues to be supported within the support lifecycle of Exchange 2010

OWA Cross-Site Silent Redirection
11/23/ :46 AM OWA Cross-Site Silent Redirection © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Why You Want This Feature (And You Will)
Pre Exchange 2010 SP2, if you try to use OWA on a CAS in the ‘wrong’ AD site, CAS has a decision to make It can proxy or redirect the connection to the target site If there is no ExternalURL in that site, we proxy, the mailbox opens and the user gets access If the target site has an ExternalURL we show the user a page with a link to click The user clicks the link, and logs in again, and gets access The user has to log in twice We are removing the need to click the link For some scenarios this results in a Single Sign On experience

Additional Detail On Silent Redirect
It is disabled by default This means that out of the box, cross-site “manual redirection” still occurs Can be a single sign-on experience when the source and target OWA virtual directories leverage Forms-Based Authentication Is only available for intra-org cross-site redirection events

How Do I Enable This Feature?
You enable Cross-Site Silent Redirection on your Internet Facing CAS, on a per OWA virtual directory basis Set-OWAVirtualDirectory -Identity “CAS1\owa (default web site)" -CrossSiteRedirectType Silent When you enable silent redirection you will be informed that: The target CAS must have an ExternalURL that leverages HTTP SSL protocol Single sign-on experience may not be possible if FBA is not enabled Let’s see this in action!

and After Experience, Before Cue Applause….

How It Works If OWA determines that a cross-site silent redirect is possible and should be performed… Same logic from legacy (Exchange 2007) SSO redirect Rather than sending a redirect response, send HTML to browser with 200 OK response HTML contains dynamically generated login form content with appropriate location for form submission JavaScript OnLoad() method submits the form

The Latest In Exchange 2010 SP2 Update Rollup (RU) 3
11/23/ :46 AM The Latest In Exchange 2010 SP2 Update Rollup (RU) 3 © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Update Rollups In addition to our normal cycle of bug fixes, update rollups often include some significant improvements Based on feedback from customers & partners (and our own experience in Office 365) we are constantly tuning how things work Many of these “tune-ups” are discussed on the Exchange Team Blog

Recoverable Items Versioning Changes
Some background Single item recovery and litigation hold enable versioning of content in the mailbox Item changes result in copy-on-write (COW) behavior within the Recoverable Items Store Copy-on-write triggered based on specific changes, Drafts exempt Primary Mailbox Inbox … Deleted Items Recoverable Items Store 2.0 Recoverable Items Versions Purges

Recoverable Items Versioning Changes
Problem scenario: calendar item with attachment Open item, open attachment Outlook auto-save (3 min interval) results in copy-on-write for the item as well as the attachment(s) In SP2 RU3, we’ve been able to reduce the versions generated for this scenario to only include the message changes (which include the attachment(s)) End result is reduced space consumption, potentially a dramatic reduction…

Related Content Breakout Sessions
EXL305: Microsoft Exchange Server 2010 SP2 Tips & Tricks 3PM) EXL303: Configuring Hybrid Exchange the Easy Way

Track Resources Exchange Team Blog: Exchange TechNet Tech Center: Geek Out with Perry Blog: MEC Website and Registration:

Resources Learning TechNet http://northamerica.msteched.com
Connect. Share. Discuss. Microsoft Certification & Training Resources TechNet Resources for IT Professionals Resources for Developers

Complete an evaluation on CommNet and enter to win!
Required Slide Complete an evaluation on CommNet and enter to win!

MS Tag Scan the Tag to evaluate this session now on myTechEd Mobile

11/23/ :46 AM © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. © 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/23/ :46 AM © 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

An Inside View of Microsoft Exchange 2010 SP2

Similar presentations

Presentation on theme: "An Inside View of Microsoft Exchange 2010 SP2"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

An Inside View of Microsoft Exchange 2010 SP2

Similar presentations

Presentation on theme: "An Inside View of Microsoft Exchange 2010 SP2"— Presentation transcript:

Similar presentations

About project

Feedback