Office 365 public folders reject emails

Since two days mails to Office 365 (and probably MS hosted exchange too) are rejected.

The error message returned by the server have this error in them:

Remote Server returned '550 5.7.1 RESOLVER.RST.AuthRequired; authentication required [Stage: CreateMessage]'

 It seems that MS did change some policy/settings in the public folder management and did forgot to inform users and sys admins.

In non-hosted exchange environments, you had to set the CreateItem right on the email enabled public folders which should be able to receive (external) emails.
In office365 this was not required until a few days ago.

There are two ways to set the corresponding rights. For me, the way via Outlook did not work, since I did not see the ACL on the public folders in question.
But the way via PowerShell works just fine.

Do it the easy way (if it works)

Just open outlook and go to your email enabled folder(s) and do add the CreateMessage right for Anonymous access, as show in the following two printscreens.

If this does not work (or you have a lot of email enabled public folders), then you have to ressort to PowerShell

Do it via PowerShell

1. Start powershell as administrator (Only required if you need to change the execution policy )
2. Set the execution policy to allow signed remote code

Set-ExecutionPolicy RemoteSigned

3. Enter credentials for office365

$LiveCred = Get-Credential

4. Make a connection to office365

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection

5. Import the cloud commands in your local powershell

Import-PSSession $Session –AllowClobber

6. Now set the CreateMessage right on all public folders recursively

Get-PublicFolder "\" -Recurse | Add-PublicFolderClientPermission -User Anonymous -AccessRights CreateItems
  
This changes the rights for all public folders. If you wish to set the right only for one public folder, thenyou can do it the same way, but instead of using the command in setp 6, you speicfy this command:

Add-PublicFolderClientPermission <path-to-folder> -User Anonymous -AccessRights createitems

Outlook 2010 does not send emails with exchange server

Outlook 2010 and 2013 have a realy nasty bug.

The effect when connected to a exchange server shows up in the inability to send out emails.
Incomming mails in cached mode just work fine, and outlook tells us in the status bar "Connected to server".

When you write a mail, it just gets stuck in the outbox and tells us about a communication error with error code 0x8004011D, meaning that the server is not available.
Just plain rubish, otherwise we would not have incomming mails and in the status bar it would not show "Connected to server"

When you create a new profile for the user, it works a few days, until again it blocks at this point.
When you create a profile without cached mode, it will work with no problems as well, but that's not the intention to have a cached mode.

The solution to this mistery are linked mailboxes.
When you create a profile and add the linked mailboxes as independent account's in outlook, you will get in troubles. It looks like outlook internally adds the linked mailboxes to the profile too, and then has double accounts and messes up things.

The solution is simple: Just remove the additional mailboxes from the outlook profile and mails will be sent out just as you would expect.

SMTP SSL in Exchange 2007/2010

In exchange 2007 and higher, the default connector are configured to accept passwords only when using a secured connection (Like SSL or TLS).
A good idea
, but...

The SSL option is only available for POP and IMAP, on SMTP you miss this option, here you can only configure a TLS secured connection.

Not a problem.... do you think?
When you still have users accessing your mail server via POP3/SMTP with MS Outlook 2003 (Not uncommon these days) then they don't have the option to use SMTP with TLS, only SMTP with SSL is available...

Other products from the same company not offering SMTP with TLS are: Outlook Express, Windows Mail....

So you will either have to upgrade all clients to a new MS Office version, or downgrade security on your exchange server and allow the SMTP connector to also accept password over unsafe connections.

Or, probably the best thing to do: Just switch to a real mail user agent like thunderbird.....

Migration of MS SBS 2003 to MS SBS 2011

Microsoft has a good document about the steps to migrate a SBS 2003 server to SBS 2011.
It is normally easy and well documented. But as always, there are things not working es expected or documented.

Here a few things:

Migration fails when joining the domain (dcpromo)

• When installing the new server it should automatically join the old domain
• If that join fails, then the migration wizard shows a fatal error and tells you to restart with the whole installtion. (Of course at this point you already had waited about 1-2 hours)
• When you google (or bing) arround, you will see that a "recovery" of the setup process is still possible. Look here for more details.
• One problem might be, that your migration account (usually the Administrator) is using a weak password, one not meeting 2008R2 complex password rules
• Another might be, that your migration user is not member of all required groups

DHCP reservations are not migrated

• Yep, can occure, sometimes it works, sometimes not
• In that case export the leases from the old server and then either add them manually on the new server. See here how to do it almost automatically

After mailbox migration to the new server, the mailboxes are not available and/or the owa shows just a empty screen after login

• Make sure the all required exchange services are running (For example the "MS Exchange RPC Client" is one to not correctly autostart after a server reboot

Other potential MS exchange migration issues

• Access to smtp, pop and imap is no longer allowed with plain text passwords. So you should confiure your clients to use either POP/IMAP with (start)tls or/and with SSL
• IMAP and POP3 connectors are not started by default, you have to enable these services in the service manager
• For external SMTP access to your server (for non-outlook users) it is best to create a SMTP connector on Port 587 (Submission port), that way you can prevent problems when your ISP blocks connections to the standard smtp port
  

Fax migration

• You still have to configure the fax service on the new server before doing the fax migration

Allow SMTP users to send emails in Exchange 2010

When you need to integrate normal email clients in a exchange 2010 environment, you probably get problems with sending mails to the outside world.

To solve this you normaly do the following:

1. Create SMTP connector your users will use for sending mails
2. This connector must require user authentication

So in normal environments this would be enough to start sending mails.
But unfortunally Exchange does still return a error message like:

"550 5.7.1 Client does not have permission to send as this sender"

To solve this, you have to allow all authenticated users to send mails via this connector.
This can be done via the Exchange shell with this command:

Add-AdPermission -Identity "MySMTPConnector" -User "NT AUTHORITY\Authenticated Users" -ExtendedRights ms-Exch-SMTP-Accept-Any-Sender

Unfortunally non-english servers just won't find the corresponding group, since it is named differently (Read localized)
To find out the correct group name you can use this command:

Get-Adpermission -Identity "MySMTPConnector" | format-table -view identity

For a german installation the corresponding group is "NT-AUTORITÄT\Authentifizierte Benutzer"

So the final command for the german exchange server is:

Add-AdPermission -Identity "MySMTPConnector" -User "NT-AUTORITÄT\Authentifizierte Benutzer" -ExtendedRights ms-Exch-SMTP-Accept-Any-Sender