Monitoring Exchange Server 2007 Performance: Perfmon counters and thresholds

Monitoring mission-critical services such as email is a necessity in most organizations. Whereas monitoring software like Microsoft SCOM can use Exchange monitoring expertise and rules encoded in Management Packs, and many third-party monitoring solutions ship with some embedded knowledge, if you're setting up a monitoring system or creating a home-grown app to do so, you need to know what to monitor.

I was fortunate enough to (sort of) take a course on Exchange performance monitoring at my previous employer, and get a lot of input on the subject from some great minds in the business. The resulting fondness for performance monitoring and performance counters is probably understandable.

If you share my enthusiasm for performance monitoring, here's some documentation and guidance you may find very useful:

- Monitoring Common Counters
- Monitoring Mailbox Servers
- Monitoring Hub Transport Servers
- Monitoring Client Access Servers
- Monitoring Unified Messaging Servers with System Center Operations Manager

Released: New Whitepapers on Continuous Replication and Planning for Large Mailboxes

New whitepapers have been released today on TechNet.

Whitepaper: Continuous Replication Deep Dive
- written by Ross Smith IV and Scott Schnoll

This whitepaper discusses the different components of Continuous Replication— used by LCR, CCR and SCR, how replication works, backups and log file truncation, what happens during scheduled and unscheduled outages, and how Continuous Replication compares with other replication solutions.

The whitepaper is available here.

Whitepaper: Planning for Large Mailboxes with Exchange Server 2007
- written by Tom Di Nardo

This whitepaper discusses planning and operational issues faced when dealing with large mailboxes, including planning storage, long database backup and online/offline maintenance times.

The whitepaper is available here.

Exchangepedia turns 4!

Yes, Exchangepedia Blog is 4 years old today! Exchangepedia saw its first posts in June 2004. Hundreds of posts, 1 major Exchange release and 2 service packs (Exchange Server 2003 SP2 and Exchange Server 2007 SP1) later, it's great to look back at some of the stuff I've enjoyed writing, and some posts that got great feedback.



Feedback?
Feedback about the content and other aspects of Exchangepedia is always welcome and valued. Sorry, I'm unable to reply to each comment and cannot respond to each question, I do read all of them.

With that in mind, if you have any feedback on the posts, screenshots, "screencasts", scripts, design, content, topics, etc., please leave a comment.

- Has it been useful for you?
- Is it interesting to read?
- Do the posts here help you resolve any deployment/operations issues or clarify a concept?
- Are there additional topics you'd like to see covered here?
- Would you like to see any changes to anything on the blog - the content, the design, anything? (Except for adding a Search box, which is on the top of my list... )?

In the 5th year of its existence, I do intend to finally move Exchangepedia off the Blogger platform, and no— it being a Google product really has nothing to do with it. I love Wordpress, and would like to play with Joomla! or Community Server as well— time permitting. Migrating all the content, comments, and keeping existing URLs is a bigger and more complicated project than I thought.

Finally, the traffic has been rising steadily, and the existing server that's been hosting this blog since day 1 seems to be limiting. I would really love to move off the 400-Mhz. Pentium 3 box that's been serving this site (and quite a few other web sites, including some Wordpress ones)— maybe to a Windows Server 2008 web server running inside a Hyper-V virtual machine. If my tests with Wordpress on Windows 2008 go well, I will hopefully be able to do that soon.

Meanwhile, if you know of a "Migrate This" button I can click on to migrate all posts, comments and URLs from Blogger to Wordpress, please email me!

Save XP, Rick Mercer Style

It's June 30th! I had the date marked because of two reasons. The first one has to do with Windows XP, and if you haven't heard enough already, CBC's Rick Mercer has his own view of how to save Windows XP. Caution: May not be entirely work-safe for some.



The second reason's coming up in a post after the break, and it has absolutely nothing to do with Windows XP or Windows Vista!

Released: Windows Server 2008 Hyper-V

While I was away yesterday, Windows Server 2008 Hyper-V made its public debut (RTMed in Microsoftese). I know what you're thinking: Let the Microsoft PR storm begin, VMWare has a better virtualization product, and other unbloggable thoughts... :).

I've been using Hyper-V for a few months now, and all I can say is— it's been a great experience way before RTM, and I am impressed! Of all things Hyper-V that impress me, I'm blown away by the performance - it flies! This, on a desktop class machine (one that meets the CPU and other requirements, of course, but poorly-configured to be used as a server/Hyper-V box that's running quite a few virtual machines).

Next, the simplicity and ease-of-use. As InfoWorld's Randall C. Kennedy puts it:

As with most Server 2008 "roles," enabling Hyper-V was a simple matter of ticking a check box in Server Manager and picking a NIC for use by the virtual network manager.

Read more of Randall's review in Test Center review: Microsoft's Hyper-V does the trick.

Scott has a post with plenty of links to Hyper-V resources and blog posts— Hyper-V has RTM'd and is Available!

As Scott mentions in the post, Microsoft will have a support statement about Exchange Server and virtualization 60 days from Hyper-V RTM. This was announced at TechEd IT Pro in Orlando little over 2 weeks ago.

Exchange Quick Audit: mailboxes created in last 7 days

I remember writing plenty of scripts to report on different things such as user accounts created every week/month, user accounts modified, accounts disabled, etc. for SOX compliance. Some of those scripts used to be rather long, and in hindsight— involved a lot more lines of code than an administrator should have to write. Although I had a lot of fun (and still do... albeit with PowerShell), I would totally understand if you said you never wanted to hear about things like Wscript, VBScript, WSH, COM objects, ADSI, and WMI ever again.


Let's take a look at how the shell (EMS) makes it so easy.

In this examnple, we need to get a list of all accounts created in the last 7 days. When a user account is created, its whenCreated attribute gets stamped with the time of creation. Here's how it can be used:

Get-User -resultsize unlimited | where {$_.WhenCreated -gt (get-date).adddays(-7) | ft Name,whenCreated -Autosize

Similarly, when an AD object is changed, it's whenChanged attribute gets stamped with the time the change was made. This makes it easy to determine which objects were changed in a given period, a useful tool for auditing/reporting as well as troubleshooting. In the following example, we determine if any Receive Connectors were changed in the last 7 days.

Get-ReceiveConnector | where {$_.whenChanged -gt (get-date).adddays(-7)}

Another frequently required and requested report— how do I get a list of mailboxes that haven't been accessed in the last X days. Let's use 100 days as the value here:

Get-MailboxStatistics -resultsize unlimited | where {$_.LastLogonTime -lt (get-date).AddDays(-100)} | ft displayName,lastlogontime,lastloggedonuseraccount,servername

Or mailboxes that have never been logged on to:

Get-MailboxStatistics -resultsize unlimited | where {$_.LastLogonTime -eq $null | ft displayName,lastlogontime,lastloggedonuseraccount,servername

Note, you can filter mailboxes by Database or ServerName to restrict the results to a more manageable size.

Next, let's list mailboxes disabled in the last 14 days:

Get-MailboxStatistics | Where {$_.DisconnectDate -gt (get-date).AddDays(-14)} | ft displayName,ServerName,DatabaseName,TotalItemSize -Autosize

Released: Transporter Suite v08.02.0053

An updated version of the Transporter Suite— a set of tools for interoperability and migration from Lotus Domino and generic POP/IMAP servers to Exchange Server 2007, has been released.

Download Transporter Suite v08.02.0053 from here.
Updated release notes are here.

If you're getting started on an interop or migration project, take a look at Resources for Interoperability and Migration from Lotus Domino.

Modifying Display Templates and additional attributes

Recently got a question about customizing the GAL and my previous post that talks about it: "HOW TO: Modify Display Template to make default email address appear in Address Book/GAL".

The new Details Template Editor in Exchange 2007 (in EMC | Tools) makes it much easier to modify templates and give your GAL the kind of look you want (short of adding that 5 Mb. purple bitmap file as a background and an extra-large company logo perhaps... :). Screenshots and more information about Details Templates can be found in Managing Details Templates.

So, you're trying to customize the properties pages of your address lists and want to add an attribute such as ipPhone. You don't see the attribute you're looking for. Can you add additional attributes to the list? Or should you? Dave Goldman explains in Adding attributes to the Exchange details templates.

Exchange Server 2007: Listing Exchange ActiveSync users and device information

In How to get a list of Exchange ActiveSync users we list EAS users on Exchange 2007. Some users may have more than 1 device, or perhaps the user simply got a new smartphone and the old device partnership has not been removed.

Output from Get-ActivesyncDeviceStatistics -mailbox foo@somedomain.com:

FirstSyncTime : 12/22/2007 1:34:10 AM
LastPolicyUpdateTime : 12/22/2007 1:34:43 AM
LastSyncAttemptTime : 1/14/2008 7:45:15 AM
LastSuccessSync : 1/14/2008 7:45:15 AM
DeviceType : PocketPC
DeviceID : *******************************
DeviceUserAgent :
DeviceWipeSentTime :
DeviceWipeRequestTime :
DeviceWipeAckTime :
LastPingHeartbeat :
RecoveryPassword : ********
DeviceModel : WIZA100
DeviceIMEI : ************21900
DeviceFriendlyName : Pocket_PC
DeviceOS : Windows CE 5.2.19134
DeviceOSLanguage : English
DevicePhoneNumber : 1650*******
Identity : foo@somedomain.com\AirSync-PocketPC-*******************************

The * characters in the Identity field are for the DeviceID.

Here's a a quick code snippet (it can probably be scrubbed up a little... ) that will list users and all their devices, along with first sync and last successful sync times:

$mbx = get-casmailbox | where {$_.hasactivesyncdevicepartnership -eq $true -and $_.identity -notlike "*CAS_{*"} ; $mbx | foreach {$name = $_.name; $device = get-activesync devicestatistics -mailbox $_.identity; $device | foreach {write-host $mbx.name, $_.devicemodel, $_.devicephonenumber, $_.deviceid, $_.FirstSyncTime, $_.LastSuccessSync} }

Related posts and links
- Cmdlet: Get-ActiveSyncDeviceStatistics
- Cmdlet: Get-CasMailbox

Community content in Exchange docs: the wikization begins!

Microsoft recently started allowing community content (annotations/links) in Exchange documentation on TechNet. Initially available for Exchange 2003 documentation, this feature was recently expanded to Exchange 2007 documentation as well.

At the bottom of each page in Exchange documentation (on TechNet) you'll see the links to add community content.


Figure 1: Links to add community content in Exchange documentation pages on TechNet

This is a great way to share your Exchange expertise and add more value to Exchange documentation - you can add your code snippets, undocumented scenarios, tips & tricks, links to relevant content on web sites/blogs— yes, links to your blog posts too!

The wiki-zation of Exchange documentation has begun!

For an example of what this looks like, check out the Messaging Records Management (MRM) docs:
1) How to Create Managed Content Settings
2) How to Apply a Managed Folder Mailbox Policy to User Mailboxes

Registration required. Here's the code of conduct, and answers to some frequently asked questions are in this faq.

What it's not...
This is not a place to post product feedback or new feature requests. You can provide new feature requests by email to exwish at microsoft. It's also not a place to post requests for help with any issues— that's better handled in Exchange newsgroups and TechNet Forums, where you can get assistance from expert IT Pros, including MVPs, and Microsoft folks.

ISA 2006 SP1: Support for SAN certs, and new features

When ISA Server 2006 SP1 rolls out this summer, there will be some cool new features to look forward to, including support for SAN certificates.

Having started using Proxy Server 1.0 (I know... hold on to your comments for now.. :) back in the days, I turned away from ISA's predecessor(s) for a few years to engage with what I thought were better options at that time— "dedicated" hardware firewalls. Not too long ago, I started using ISA again, and became a convert with ISA 2006. It made "publishing" (am I the only one who finds the phrase "publishing to the internet" amusing?) Exchange services such as OWA, EAS, Outlook Anywhere, and SMTP secure and relatively effortless.

If you have ISA 2006 deployed with Exchange Server 2007, you're probably looking forward to SP1 as well for its SAN certificate support. Check out the other cool features in this post on the ForeFront TMG (ISA) team blog: ISA Server 2006 Service Pack 1 Features.

HTC Touch Diamond: Cure for iPhone Envy?

While I was out at TechEd last week, the new 3G iPhone was announced. From the previous announcement, we knew it'll have EAS support. While many await the new EAS-capable, 3G iPhone, and yet many debate on whether it'll make inroads in the enterprise, there's something else on the horizon that's quickly becoming the object of desire for many folks. Yes, I'm talking about HTC's Touch line of Windows Mobile phones, and the HTC Touch Diamond.

Looks like an exciting new version of Windows Mobile? It's actually the current version of WinMo— v6.1. With HTC's own shell on top called HTC TouchFLO™ 3D. Yes, you can touch, swipe, shake, rattle, and roll. :)

A glance at the features:
- 2.8" LCD
- HSDPA connectivity
- 3.2 Megapixel camera
- 4Gb memory
- Integrated GPS

To top it all, the dimensions— it's 11.35 mm thin and weighs all of 110g, with batteries!

More info about the Touch Diamond on the HTC web site.

Engadget reports spotting the Touch Diamond at CompUSA. I'm waiting to get my hands on one of these.

Update: Available on CompUSA.com, unlocked, for $779.

Starting Task Manager in RDP or VM sessions

You have a RDP (Terminal Services) session or a Virtual Machine session open, where the CTRL-ALT-DEL key combination fires up the Windows Logn/Security dialog on the host computer rather than the RDP or VM session you have open.

Getting to the Task Manager involves some mouse-clicks in such situations— Start -> Windows Security -> Task Manager (works in both RDP and VM sessions) or clicking on the appropriate shortcut in the VM client software. Hyper-V has a short-cut on its menu bar that makes it a single mouse click, but still not quick enough. It's actually annoying if you are happily pounding away at the keyboard for most part... and now need to lift your hand to grab a mouse and... you know where we're going with this!

Shorcuts exist - if you're at the cmdline, you can simply type taskmgr.exe (or Start -> Run -> type taskmgr.exe). Alternatively, you can create a desktop shortcut and point it to taskmgr.exe. If you simply want to remain at the cmdline and not bother with the GUI at all, use TaskList. You can filter the output in a number of ways - use tasklist /? to see all the options.

If you're on an Exchange 2007 box or have Windows PowerShell installed, it gets event better. Get-Process and Stop-Process commands are your friends here. You can filter by process name or PID, and also pipe the output from Get-Process to Stop-Process. For example:

Get-Process -Name svchost
Get-Process -Name MSExchange* | ft Id,Name,Handles,PM -AutoSize
Get-Process | ft Name,Company,ProductVersion,FileVersion -Autosize
Stop-Process -ID 6064
Get-Process mmc* | where {$_.Handles -gt 1000} | stop-process

Released: Exchange Management Shell | Powershell on Steroids

The first of the three free web chapters of "Exchange Server 2007: The Complete Reference" was released last week on the book's companion web site.

I also found out about the numerous electronic editions of the book— yes, the Acrobat eBook, MobiPocket Reader, Microsoft Reader and Kindle editions are now available!

Thanks to all of you who stopped by at the book signing at TechEd last week.

Quick antispam report or status check?

Having received an annoyingly higher proportion of spam in my Inbox this morning, I wanted to quickly check what the antispam agents are doing. Here's a quick cmdlet (besides the ones to check whether the antispam agents are enabled, checking the Content Filter SCL thresholds, etc.).

Get-AgentLog -StartDate "6/16/2008" | group action | ft name,count -Autosize

What you get back:

Name Count
---- -----
RejectCommand 520
AcceptMessage 39
RejectMessage 163
QuarantineMessage 11
DeleteMessage 21

The filters are still working. Perhaps it's one of those days when you wake up to high volume of spam.

Note to self: Create a quick monitoring script that provides more information from agent logs, antispam configs, and perfmon counters.

Related posts:
- Keeping tabs on Antispam filters: A few handy scripts in Exchange Server 2007
- Exchange Server 2007: How are RBLs performing?
- Exchange Server 2007: Managing And Filtering Anti-Spam Agent Logs