Managing OAB in Exchange Server 2013

The Exchange team blog article OAB in Exchange Server 2013 introduced the new Offline Address Book (OAB) generation and distribution architecture in Exchange Server 2013. Take a few moments to visit the article if you haven’t seen it yet or re-visit it for a quick refresher.
The OAB management and administration is different in Exchange 2013 because of architecture changes. Additionally, the new Exchange Admin Center does not currently have options for managing OABs. This means that, at this time, you will need to use Exchange Management Shell for OAB-related tasks.
This article takes you through commonly performed tasks in OAB administration and has a couple of real life scenarios to help understand the tasks better.

Note: If you are in multi-forest Active Directory domain environment, make sure the Shell session has ViewEntireForest is enabled, else some of the commands in the article won’t return any output.

Command to enable ViewEntireForest:

Set-ADServerSettings -ViewEntireForest $true

Source :- http://blogs.technet.com/b/exchange/archive/2013/01/14/managing-oab-in-exchange-server-2013.aspx

Creating a new OAB

Creating a new OAB in Exchange 2013 no longer uses the -Server parameter. In order to create a new OAB, you should only specify the address lists to be required.
The following example creates OAB for address list named “Global Address List FAB”

New-OfflineAddressBook -Name OAB-FAB -AddressLists "Global Address List FAB"

Identify the OAB generation server(s)

The arbitration mailboxes in Exchange Server 2013 are assigned certain “Persisted capability” that defines the purpose/function of the arbitration mailbox.
An arbitration mailbox with Persisted Capability “OrganizationCapabilityOABGen” is responsible for OAB generation. We will refer this mailbox as “Organization Mailbox” throughout the article.
Exchange Server 2013 mailbox server hosting the Organization Mailbox will generate all OAB’s defined in the environment.
For a non-DAG environment, use following command to identify the OAB Generation servers:

Get-Mailbox -Arbitration | where {$_.PersistedCapabilities -like "*oab*"} | ft name,servername

For a DAG environment, identifying OAB generation server(s) is a two-step process.
Step1: Identify the mailbox database hosting organization mailbox with OAB Gen capability.
Use the following command to list the arbitration mailboxes with persisted capability of OABGen and database on which this mailbox is hosted:

Get-Mailbox -Arbitration | where {$_.PersistedCapabilities -like "*oab*"} | ft name,database

Step2: Identify the mailbox server where the database hosting organization mailbox is mounted
Use following command to identify active copy of mailbox database:

Get-MailboxDatabaseCopyStatus db1

The server where database status is “mounted” is the current OAB generation server.

Change the OAB generation server

There are two methods of changing the OAB generation server.

Move mailbox

Move the organization mailbox to a mailbox database on a server intended to be designated as OAB Generation server.
Example:
DB1 is a single copy database present on the server Exch1 and hosts the organization mailbox. DB2 is mailbox database present on Exch2.
The following command can be used to move the organization mailbox to DB2 and make Exch2 the OAB generation server.

Get-Mailbox -Arbitration -database db1| where {$_.PersistedCapabilities –like “*oab*”} | New-MoveRequest -TargetDatabase db2

This method is more suited for environments that have single copy of mailbox database hosting the Organization Mailbox.

Activate the mailbox database on another server

This method is suited for environments that have multiple copies of the mailbox database hosting Organization Mailbox.
Example:
DB1 hosts the Organization Mailbox and has copies on servers Exch1 and Exch2. DB1 is currently active on Exch1.
The following command can be used to activate DB1 on Exch2 and therefore make it the OAB generation server:

Move-ActiveMailboxDatabase DB1 -ActivateOnServer Exch2

Note: Review guidelines mentioned in “Placement of Organization Mailbox” below before changing the OAB Generation server.

Creating a new Organization Mailbox

Administrators can create additional Organization Mailboxes for fault tolerance or for serving users in a geographically disbursed Exchange deployment.
Creating a new Organization Mailbox is a two step process:
Step1: Create a new arbitration mailbox

New-Mailbox -Arbitration -Name "OAB Seattle" -Database DB2Seattle -UserPrincipalName oabs@contoso.com –DisplayName “OAB Mailbox for Seattle”

Step2: Enable OABGen capability

Set-Mailbox -Arbitration oabs -OABGen $true

Note: Review guidelines mentioned in “Placement of Organization Mailbox” below before creating additional organization mailboxes.

Changing the OAB Generation Schedule

The OAB Generation till Exchange Server 2010 was based on a “Schedule” set on OAB properties. You might see a “Schedule” defined when viewing properties of Exchange 2013 OAB. But, the Exchange Server 2013 OAB generation does not take place according to the “Schedule” defined on OAB properties:

Instead, Exchange Server 2013 OAB Generation takes place according to OABGeneratorWorkCycle and OABGeneratorWorkCycleCheckpoint properties configured at the Mailbox Server.
Example:

The values in the above screenshot mean OAB is generated once every day.

Which Mailbox Server processed the OAB download request?

The Exchange Server 2013 CAS role proxies the OAB download request to an appropriate Mailbox role server. The CAS role maintains log of each request it handles in the log files, present in folder %ExchangeInstallPath%\Logging\HttpProxy\OAB\
These log files are an excellent tool to identify which mailbox server the CAS chose to serve the request.
Information of some important fields from the log file:

Field	Description
UrlStem	Useful to identify the OAB being downloaded and also if this was a full download or incremental download
AuthenticatedUser	Name of the User requesting the OAB
AnchorMailbox	DN of Organization Mailbox identified as the closest to serve the OAB request
ServerHostName	CAS Server Name handling the request
HttpStatus	Status code for Proxy action
ProxyAction	Action CAS Server performed for the request, it will be mostly “Proxy” for Exchange 2013 OAB
TargetServer	Name of Mailbox role server to which request was proxied

The log file can be imported in Excel for better readability.
Example:

Forcing the OAB Generation

The Exchange Server 2013 OAB generation can be forced to start immediately by two methods.

Method 1: Update-OfflineAddresBook

Below command will force OAB generation of an OAB named "Default Offline Address Book" across all organization mailboxes.

Update-OfflineAddressBook "default offline address book"

Note: This command initiates an RPC request to each mailbox server hosting an active organization mailbox.

Method 2: Restart the Mailbox Assistant service.

The Microsoft Exchange Mailbox Assistant service on Mailbox Role is responsible for generating OAB. Restarting this service generates all OAB’s defined in the environment on a specific mailbox server, if it’s hosting an active organization mailbox.

Placement of Organization Mailbox

Exchange Server 2013 CAS role proxies the OAB download request to a “nearest” mailbox server hosting an active Organization Mailbox. It can proxy the request in round robin fashion if it finds more than one organization mailbox active in same AD site. Prior to CU5, this will result in frequent full OAB downloads and is therefore, not recommended.
Hence, current guidance is to plan organization mailbox placement such that you will have one organization mailbox active in an AD site. This applies to creating a new organization mailbox as well as to creating copies of mailbox database that hosts an organization mailbox.
Prior to CU5, customers should only deploy a single OAB generation mailbox per Exchange organization to prevent users from accessing different OAB generation mailboxes and requiring a full OAB download.  With CU5 and later, customers can assign OABs to specific OAB generation mailboxes and not have to worry about accidentally triggering full OAB downloads due to accessing different OAB generation mailboxes.  For more information, please see the article, OAB Improvements in Exchange 2013 Cumulative Update 5.

Scenarios

The following scenarios discuss a real life situation to further explain the new OAB management methods.

Scenario 1: Create a new Organization Mailbox

Contoso has Exchange Server 2013 Mailbox & CAS role servers deployed at Dallas and Seattle sites. John, the Exchange Admin for Contoso, analyzes the http proxy log files on CAS servers and finds the OAB download request for Seattle users is going to Dallas servers. On further investigation, John finds he has just one Organization Mailbox present in Dallas, hence OAB download requests of all the users are going to Dallas server.
He decides to create a new Organization Mailbox at Seattle site with following commands:
Step1: Create a new Arbitration Mailbox

New-Mailbox -Arbitration -Name "OAB Seattle" -Database DB2Seattle -UserPrincipalName oabs@contoso.com –DisplayName “OAB Mailbox for Seattle”

Step2: Enable the Arbitration Mailbox with OABGen capability

Set-Mailbox -Arbitration oabs -OABGen $true

Scenario 2: Customize OAB Generation Schedule

Ben is an administrator of Exchange 2013 deployment at Tail Spin Toys. The default OAB generation schedule does not suit them and they want to generate OAB approximately every fourth hour of the day.
Ben will use following command to change properties of the mailbox servers that will be hosting the Organization Mailbox.

Set-MailboxServer Exch1 -OABGeneratorWorkCycle 01.00:00:00 -OABGeneratorWorkCycleCheckpoint 04:00:00

After a couple of days, John analyzes Event ID 17002 in application log and makes sure the OAB is generated every four hours.

Hopefully, you find this post useful! Let us know your feedback below!

How offline Address books works in Exchange 2013

What is a Offline Address book ?

For Users where Outlook is in Cache mode, They got to have their Outlook Address book Updated ,when they can access the latest Address book while they go offline.
If Outlook is left running constantly in Cached Exchange Mode, it updates the Offline Address Book automatically about once a day, depending on Address Book updates on the server running Exchange. To initiate these updates manually, do the following:

1. On the Tools menu, point to Send/Receive, and then click Download Address Book.
2. Under Information to download, click Full Details or No Details.

So that they can use their updated address book when they are offline.
Earlier Exchange 2010 Version. Outlook Connects to the Client Access Server for MAPI Connectivity.
But From Exchange 2013 Outlook Connects to the Client Access Server
And the requests are proxied to the Mailbox Server
Lets See what is happening in the Background
In my Case all Roles are installed on the Same Server
Offline Address book Generation Server will be a Mailbox Server.
You can find a OAB Virtual Directory in IIS – in the Client Access Server
The Request to the Client Access (OAB Virtual Directory) Proxies the request to the “Exchange Back End” (OAB Virtual Directory) which is a Mailbox Server Containing OAB Files where client downloads the OAB Files


Offline Address Book Storage Location
Offline Address book Stores its files to a “System Mailbox” Which is called as “Organizational Mailbox” Where if the database fails the Organization Mailbox can failover using Database availability Group.
where the request from the Client doesn’t fail . It looks the database which owns the Organization Mailbox and OAB files are copied over to the Disk in the appropriate Mailbox Server and it has been to the Client.
Where OAB is no more a single point failure in Exchange 2013
To See which Organizational Mailbox is storing OAB files –

Get-Mailbox –Arbitration | where-Object {$_.PersistedCapabilities –Like "*OabGen*"} | FL Name,Persisted*

You can see – “OrganizationCapabilityOABGen”

Then Its Copied over to the disk in the Form of LZX files
Default Location: (Differs if you install Exchange on a Different Drive)
C:\Program Files\Microsoft\Exchange Server\v15\ClientAccess\OAB

They will be copied to the disk in the Form of LZX files

How to find the Offline Address book url , which is used for OAB Downloads
From Outlook 2007 ,Outlook 2010 and So on , Outlook Downloads Offline Address book using the OAB Url Web-Based (IIS)

Get-OabVirtualDirectory | FL Name,*Url*

You got to Specify the External Url if you are going to use Outlook Anywhere
using Set-OabVirtualDirectory Cmdlet

To Find which OAB a User Downloads
Go to a Client Machine
Hold your Ctrl Key and Right Click on the Outlook icon – Click on Test Email AutoConfiguraion

Now Using AutoDiscover , You can see the Offline Address book URL as listed below with the Correct Guid Value

To Find the GUID Value of the Offline address book

Get-OfflineAddressbook | FT Name,Guid

Client will Download their Own OAB depends upon their “Client Settings in Database Properties”
If its not specified – By Default they will download the “Default Offline address book”

Or
If they have address book policies applied They would Download their own OAB respective to the Policy

Get-Mailbox "Mailbox Name" | FL Name,AddressBook*

How Often Offline Address book Updates itself
** This Updates the Items only on the Mailbox Server – Stores in the “Organization Mailbox” as explained earlier

Get-Offlineaddressbook | FL Name,Schedule

Now Depends on the Update Time “Organization Mailbox” will get updated on the Mailbox Server.
**Offline Address book data are saved first only on the Organization Mailbox**  Then Once its got Updated it Serves the latest data to the Clients
How to Force update the Offline Address book

Get-OfflineAddressbook "Default Offline Address book" | Update-OfflineAddressBook

To Verify
**Property Last Touched Time Gets updated**

Get-OfflineAddressbook | FT Name,LastTouch*

or
You can Restart
Microsoft Exchange Mailbox Assistant Service
As that’s the service does all the job in the background

Restart-Service MsExchangeMailboxAssist*

Additional Info –
Type of Distribution used in Exchange 2013
Exchange 2013 Uses only One Type of Distribution –Web-Based Distribution
1 .Web-Based distribution

2. Public Folder distribution (Removed in Exchange 2013)
Earlier
Earlier Version Like Outlook 2003, Offline address book are Downloaded via Public Folders,
Offline Address Book Version In Exchange 2013
For Outlook 2010, Outlook 2007 clients it uses OAB version 4

Get-OfflineAddressbook

Great !!
You Learnt How Offline Address book works in Exchange 2013

Exchange 2010 Edge Transport Server: Configuring EdgeSync

The Edge Subscription is a relationship between an Edge Transport server and an Active Directory site, and allows the Edge Transport server to receive information about the Exchange organization such as recipients, domain names, and safelists/blocklists for anti-spam.
This information is synchronized at regular intervals through a process called EdgeSync.

Firewall Ports for Exchange Server 2010 Edge Transport Servers

 

Source :- Exchangeserverpro.com

For EdgeSync and mail flow to work there are a few network ports that need to be open on the firewall between the Internet, the Edge Transport server, and the internal Hub Transport server.

Edge Transport Server Network Ports for EdgeSync

• Secure LDAP (TCP 50636) from the Hub Transport server to the Edge Transport server

Edge Transport Server Network Ports for Mail Flow

• SMTP (TCP 25) from the Internet to the Edge Transport server
• SMTP (TCP 25) from the Edge Transport server to the Hub Transport server
• SMTP (TCP 25) from the Hub Transport server to the Edge Transport server
• DNS (UDP 53) from the Edge Transport server to a DNS server capable of public DNS lookups (ie to look up MX records)

 

Creating the Edge Subscription for Exchange Server 2010 Edge Transport Servers

With the firewall access all configured correctly the next step is to configure the Edge Subscription itself.
On the Edge Transport server open the Exchange Management Shell and run the following command using the New-EdgeSubscription cmdlet.

[PS] C:\>New-EdgeSubscription -FileName C:\edgesubscription.xml

Confirm
If you create an Edge Subscription, this Edge Transport server will be managed via EdgeSync replication. As a result,
any of the following objects that were created manually will be deleted: accepted domains, message classifications,
remote domains, and Send connectors. After creating the Edge Subscription, you must manage these objects from inside
the organization and allow EdgeSync to update the Edge Transport server. Also, the InternalSMTPServers list of the
TransportConfig object will be overwritten during the synchronization process.
 EdgeSync requires that this Edge Transport server is able to resolve the FQDN of the Hub Transport servers in the
Active Directory site to which the Edge Transport server is being subscribed, and those Hub Transport servers be able
to resolve the FQDN of this Edge Transport server. You should complete the Edge Subscription inside the organization in
 the next "1440" minutes before the bootstrap account expires.
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y

There are two important things to be aware of here:

• You must complete the next step of the Edge Subscription process within 1440 minutes (24 hours), otherwise you’ll need to generate a new Edge Subscription again
• The Hub Transport servers in the Active Directory site that will be subscribed must be able to resolve the FQDN of the Edge Transport server. You can either add DNS records manually or use a HOSTS file entry.

Copy the “edgesubscription.xml” file to the Hub Transport server. Launch the Exchange Management Console and navigate to Organization Management/Hub Transport.
In the Actions pane click on New Edge Subscription.

Browse and select the Active Directory site to be subscribed, as well as the XML file that you copied from the Edge Transport server.

Click the New button to complete the wizard.
After the Edge Subscription has been created you will see two Send Connectors configured for your organization.

It can take up to an hour before the first Edge synchronization process runs, but you can run it manually if you need to. On the Hub Transport server launch the Exchange Management Shell and run the following command using the Start-EdgeSynchronization cmdlet.

[PS] C:\>Start-EdgeSynchronization -Server esp-ho-ex2010a

RunspaceId     : b7415ae2-f763-449e-bb36-20a6a18759cd
Result         : Success
Type           : Configuration
Name           : esp-ho-ex2010e
FailureDetails :
StartUTC       : 5/7/2011 1:27:39 PM
EndUTC         : 5/7/2011 1:28:07 PM
Added          : 290
Deleted        : 0
Updated        : 0
Scanned        : 295
TargetScanned  : 0

RunspaceId     : b7415ae2-f763-449e-bb36-20a6a18759cd
Result         : Success
Type           : Recipients
Name           : esp-ho-ex2010e
FailureDetails :
StartUTC       : 5/7/2011 1:27:39 PM
EndUTC         : 5/7/2011 1:28:08 PM
Added          : 401
Deleted        : 0
Updated        : 0
Scanned        : 401
TargetScanned  : 0

After the initial Edge synchronization has occurred you will be able to see the Send Connectors and Accepted Domains configured on the Edge Transport server.

Exchange Server 2013 vs. 2010 vs. 2007 – Quick Comparison Notes (New Features & Concepts)

Here is a quick reference table for Exchange Admins of what’s new or improved in successive versions of Exchange, from 2007 through 2013.

For a more general comparison, please visit here.

Exchange 2007	Exchange 2010	Exchange 2013
Exchange Server Roles	DAG	Cut down of Exchange Roles
64-bit Architecture	RBAC	No Edge – Included in SP1
Autodiscover	Shadow redundancy
Exchange Management Shell, EMC Console & Public Folder Management Console	CAS Array	No EMC – Exchange Admin Center
High Availability for Mailbox(LCR, SCR, CCR and SCC) and Hub server	Archive mailbox
		Public Folder mailbox
	Mail tips	In-place e-Discovery and In-place Hold. Integrated with Lync and SharePoint.
Database portability	Moderated delivery
	hybrid deployment
OWA with improved features (smart calendar scheduling, improved search, web ready document viewing)	Federation trust – Organization relationship – Sharing policies	OWA Offline Access and Apps.
		DAG – Auto-reseed and Managed Store (Multiple store-exe process)
Transport Rules/ Connectors Anti-spam filters	e-Discovery and Litigation Hold Mailbox move request
		Data Loss policy and Policy tips
	More transport rules	Load balancing CAS (No CAS array) All clients connect through RPC-over-https – No MAPI connections
New Exchange Services Accepted domain and email address policy	Address Book Policy OWA mailbox policies
	Manages certificates from EMC Manage mobile devices from EMC Reset virtual directories
		Exchange Workload Management
		Anti-Malware scanning
	Single Item recovery/Dumpster version 2.0
	Exchange Control Panel

Datacenter Activation Coordination Mode ( DAG DAC Mode )

One of the topics I receive a lot of questions about is Datacenter Activation Coordination Mode, or DAC Mode for short. Here is an excerpt from Deploying and Managing Exchange Server 2013 High Availability that covers this topic in more detail.


Credit Goes to exchangeserverpro.com.

Datacenter Activation Coordination (DAC) Mode is a property of DAGs that is designed to prevent split brain conditions from occurring by enabling a protocol called Datacenter Activation Coordination Protocol (DACP).
In addition, DAC Mode enables the use of three PowerShell cmdlets for site-resilience:

• Stop-DatabaseAvailabilityGroup
• Restore-DatabaseAvailabilityGroup
• Start-DatabaseAvailabilityGroup

Without those cmdlets any datacenter switchover or failover scenario involves using other combinations of Exchange and cluster management tools. These site resilience cmdlets make datacenter switchovers and failovers much easier to manage.
A split brain condition can occur in a multi-site DAG when one datacenter goes offline entirely. It can also occur in a single-site DAG in some network failure situations. Let’s take a look at an example of a multi-site failure where the benefits of DAC mode become clear.
In this example the Sydney and Melbourne datacenters each host two DAG members, with Sydney also hosting the file share witness server. To keep this example simple a single database exists in the DAG, currently active on a Sydney DAG member.

The Sydney datacenter has a power failure that takes the entire site offline. With two DAG members and the FSW offline in Sydney, and just two DAG members online in Melbourne, quorum can’t be maintained and the database goes offline.

The administrators activate the alternate file share witness in Melbourne to restore quorum, and bring the database online in Melbourne to restore service.

Eventually the datacenter in Sydney has power restored and the Sydney DAG members and file share witness come back online. However, the WAN connection remains offline, preventing the DAG members in each site from communicating with each other.

The two Sydney DAG members and file share witness have enough votes to achieve quorum, so the database is brought online in Sydney.

At this stage the problem should be apparent. Both Sydney and Melbourne have an active copy of the same database because the DAG members in each site were not able to communicate with each other. A split brain condition has occurred.
DAC and DACP prevent this behavior by requiring a DAG member to check with other DAG members before it is allowed to bring database online.
DACP exists as a bit (a 0 or 1) that is stored in memory. When DAC mode is enabled each DAG member starts up with a DACP bit of 0. Until it can communicate with a DAG member that has a DACP bit of 1, or alternatively it can communicate with every other member of the DAG, it will not attempt to activate its database copies even if it can achieve quorum with some of the DAG members.
To demonstrate this let’s go back in the example scenario above to the stage where the Sydney datacenter was coming back online again.
When DAC Mode has been configured in advance the Sydney DAG members start up with a DACP bit of 0 and are unable to communicate with the Melbourne DAG members because the WAN link is still offline.
Therefore they do not bring the database online in Sydney, preventing a split brain condition.

When the WAN connection is restored the Sydney DAG members are able to communicate with the Melbourne DAG members. Their DACP bit is set from 0 to 1 and, because they now realize that the database is already active in Melbourne, their database copies become passive copies.

For more on DAC mode and other features of database availability groups check out the

Lync 2013 SE Install - Service Control Manager error

So, ran into a little issue in my lab that I thought I'd share...

So, I was trying to install a Lync 2013 Standard Edition server as the first server in my Lab.  The server name was Lync1 (lync1.adatum.com).  While going through the Lync Topology Builder, I got to the question about what the Pool name would be.  Not giving it a ton of thought, I entered "lyncpool.adatum.com".  I then finished configuring everything in Topology Builder that I needed and went to Publish Topology.  The publish failed with it complaining:
Error: Cannot open Service Control Manager on computer "lyncpool.adatum.com".  This operation might require other privileges.
At the time, I was doing the install as the Enterprise Administrator...it has all the rights in the world, what permissions could be missing?  Or is something blocking an Enterprise Admin from doing this in Lync 2013 .
I tried uninstalling SQL Express, making sure lyncpool.adatum.com was in DNS, re-running the setup of the Configuration Manager, tried setting up and using a service account instead of the Enterprise Administrator account...all to no avail.  I searched Technet as well as our internal Microsoft Knowledge Bases...everything I found said it was a permissions issue.
Finally, it dawned on me...Standard Edition pool names MUST be the server name.  Only with Enterprise Edition can you create a separate pool name.
I went back into Topology Builder and changed the pool name to lync1.contoso.com (the SE server's hostname) instead..., I was able to publish.
I think (I haven't gone back and verified) that Lync 2010 Topology Builder checked (or prevented you) from using a different name for a Standard Edition server.