Have an annoying virus in your MB DB? send it for Microsoft for analysis :)

Pretty nifty, just send email to this email address submit_virus@fss.microsoft.com


To prepare an archive file that contains the files that you want to submit, follow the steps in the "How to prepare files for submission" section. Attach the archive file to the e-mail message. When you submit the file, make sure that you include the following data.

Your name, e-mail address, and telephone numberMicrosoft will send all responses to the e-mail address that you use to submit the files. When you submit the archive file, Microsoft processes the file and then sends a determination of the files that is based on the current Microsoft malicious software definitions. If it is necessary, adjust your incoming mail filters to make sure that you receive this message.

Sample typeIf the submission includes files that you believe were incorrectly determined to be malicious software, add the words "False Positive" to the e-mail Subject line. Otherwise, the files will be assumed to be malicious software.

Support case number (optional)A support case number is not required to submit files for analysis. However, if a support case is already open for this submission, you can include this case number on the message Subject line.

Other information to include

The names of any scan engines that you are using.

Forefront Security products that you are using. For example, these might include Forefront Security for Exchange Server or Forefront Security for SharePoint.

Platform information. For example, this might be Windows Vista, Windows Server 2003, Windows 2000, or another version of Windows.

Description of the virus activity.


How to prepare files for submission:

1.In Windows Explorer, open the folder that contains the suspected malicious software files.
2.Right-click a blank area in the window, point to New, and then click Compressed (zipped) Folder.
3.Type malware.zip to name the new archive file, and then press ENTER.
4.Drop the suspected malicious software files into the archive file as you would drop them into a typical Windows folder.
5.Double-click the archive file.
6.On the File menu, click Add a Password.
7.In the Password box, type infected.
8.In the Confirm Password box, retype infected, and then click OK.

Mail flow doesn't work if Exchange 2007 Installed on Server 2008 with certain routers

Windows vista and windows Server 2008 have the TCP autotuning setting enabled by default, so if the router is small or outdated maybe it doesn't support that feature, so we have to disable the feature on Server 2008 to make that work, but beware that this will decrease the server performance

Symptom:
Mail flow doesn't work if Exchange 2007 Installed on Server 2008 with certain small routers


Cause:
That's if the router doesn't support TCP autotuning settings in Windows Server 2008.

Resolution:
open RUN==CMD== and type this command

netsh interface tcp set global autotuninglevel=disabled

this will disable the feature and we back in business

here is more info about parameters for that command from MS sites:


The following autotuning settings are available if a router supports TcpWindowScaling:

Disabled: Fix the receive window at its default value.

Highly Restricted: Allow the receive window to grow beyond its default value, but do so very conservatively.

Restricted: Allow the receive window to grow beyond its default value, but limit such growth in some scenarios.

Normal: Allow the receive window to grow to accommodate most scenarios.

Experimental: Allow the receive window to grow to accommodate extreme scenarios.

Help! Forefront Engines update timed out while downloading updates and keep logging Errors !.

Well, I had this problem myself a while before, when i was awaiting updates to be downloaded and get installed on the Forefront Server Security For Exchange, i found that many engines updates are not applied and error message in the application log stating that it's just timed out ..

the mystery behind that is the default time out value is 5 minutes, which is fine with many organizations, and everything is cool, but sometimes with some latency and network problems it just don't allow the updated to be graped in that assigned time .. so what we will do here is modifying the registry and increase that time.. and don't worry it don't need any restart to your server or services. just do it right !

open RUN and type RegEdit go to this path:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server

and make a new DWORD there with the name of EngineDownloadTimeout , right click the key and choose Modify and put there the required value, let's say we will make it 10 minutes, so write there 600 ( it's counted in seconds) and voila it's done

Just note that this is still applicable on Forefront for sharepoing still with the same Reg path but with changing Exchange by sharepoint ..


Good Luck

Event ID 1002, Source: MSExchangeSetup , and Error: Process execution failed with exit code 5, when uninstalling Exchange 2007

Symptom:

Event ID 1002

Source: MSExchangeSetup

Error: Process execution failed with exit code 5

when uninstalling Exchange 2007

Cause:

This happen for the DiagnosticCmdletController.dll file is not registered (it supposed to be but maybe not registered for any crazy reason)

Resolution:

make a search for the DiagnosticCmdletController.dll file, and go for each location where that file is, and reregister it again by regsvr32 command, for example:

C:\C:\Program Files\Microsoft\Exchange Server\bin\Monitoring\x86\regsvr32.exe DiagnosticCmdletController.dll

DllRegisterServer in DiagnosticCmdletController.dll succeeded.

Please don't repeat this process for each location where that file is

Good Luck

Configure Autoreply to messages in exchange 2007

I has been requested once to configure autoreply to messages sent to helpdesk in exchange 2007, imemdiatly i told the customer if OOF is accepted he denied that and he need a autoreply one

well, here is how i made that

it's in two parts, from server side (Exchange 2007 HUB Role) and from outlook side

A- From server Side:
Exchange 2007 by default will block autoreplies and auto forward messages, hence we need to configure this to allow this-like messages
1- open EMC and go to organization configuration
2- navigate to Hub transport and remote domains tab
3- click properties of the remote domains and go to Message format tab
4- check the check box there that allow auto reply (and auto forward if needed) and OK

B- From OUTLOOK
1- Open Outlook.
2- Click Tools, and click Rules and Alerts.
3- Click New Rule, select "Start from a blank rule", select "Check messages when they arrive" and click Next.
4 - Select "Send only to me" and click Next.
5- Select "have server reply using a specific message".
6- In the bottom box, click "a specific message", enter the Subject and body for the autoreply message and click "Save and close".

Now test it by sending a message to the configured account and you will get an autoreply

Outlook anywhere keep prompt for a password even NTLM authentication is selected

Outlook anywhere keep prompt for a password even NTLM authentication is selected


that occure if value of the Server attribute is set incorrectly for the EXPR OutlookProvider object

run this command on all CAS Servers

Set-OutlookProvider EXPR -Server $null
and restart IIS will resolve the issue

How to recover the trust between parent and child domain if Access is denied between them happened

that's becasue the TDO ( trusted domain object) has been corrupted as i have been informed once from Microsoft

Busbar, one of the Experts out there, blog that wonderfull post and i wanted to share it with you

http://busbar.blogspot.com/2008/03/what-to-do-parentchild-domain-trust-is.html

when you send digitally signed message through exchange 2007 edge server, the message cannot be verfied on the destination

as the address say, when you send digitally signed message through exchange 2007 edge server, the message cannot be verfied on the destination, that has been raised for a while, by escalation case by myself, and after further investigation on that subject working with the support team whom they made a lot of work ( and me as well) i managed to fix that, it was a bug !

a bug in which when you send email from outlook in HTML format, it will reach the destination in unverfied format, and a red arrow in the front of head of the message, and that's only happen when you send HTML messages with attachement in it, that's also mean when you send HTML messages in HTML format without attachement it WILL be verified, so the problem came in sending attachement

sawing saw, i disabled the attachement filter on the edge servers, and voila ! it woked fine..

i reported that to Microsoft and hopefully a fix will be available on rollup update 2 for exchange SP1

btw, you still can use remove-attachementfilterentry cmdlet but i didn't tested that actually

Good luck with your implementation

Dr.Kernel

______________________

Edited:

Install Rollup update 2 for exchange 2007 SP1 and that will fix the issue
http://support.microsoft.com/kb/949703/

Regards

Remote Server Administration Tools (RSAT) Beta is now available!

This is something that of you have been waiting for a while now! Remote Server Administration Tools (RSAT) is essentially the WS08 version of the "Admin Pack". RSAT allows you to install many of the WS08 management tools on a Vista SP1 computer so you can remotely manage WS08 servers (full servers and server core). Some of the tools included in RSAT can also be used to manage WS03 servers as well.
More details about RSAT are pasted below.

=========================================

Microsoft® Remote Server Administration Tools enables IT administrators to remotely manage roles and features in Windows Server® 2008 from a computer running Windows Vista with Service Pack 1. It includes support for remote management of computers running a Server Core or Full Server installation of Windows Server 2008. This feature has been requested by customers as a replacement for the Windows Server 2003 Administration Tools Pack.

To test the Remote Server Administration Tools Beta and obtain customer feedback, Microsoft offers a Feature Focus program for this update, starting November 28, 2007 on the Microsoft Connect site. By participating in the program, you have the opportunity to try the new Remote Server Administration Tools, and provide feedback directly to the product team. The download is available as part of the Windows Beta program

CENTRO = SMALL BUSINESS SERVER SBS 2008

Centro" = Windows Essential Business Server

Essential Business Server combines Windows Server 2008, Exchange Server 2007, System Center Essentials, Forefront Security for Exchange, the next version of ISA and SQL Server 2008 (in Premium Edition) into an "all-in-one" solution. But the product is truly more than the sum of its parts and delivers new technology above and beyond the component products. Essential Business Server provides a single point of management for all of the components and workloads, as well as third party software applications, and incorporates an incredible amount of best practices. We estimate set up will require 75% fewer steps than what is required today, for example. In addition, it has a single server license and a single client access license, as well as features to help IT track, manage and re-assign licenses.

Microsoft hardware partners that are already planning to support Essential Business Server include Fujitsu Siemens, HP, IBM and Intel. Software partners already developing or planning on creating "Add-Ins" for the Essential Business Server console include CA, Citrix, FullArmor, McAfee, Quest, Symantec and Trend Micro. Microsoft applications will add-in, too, of course.