Exchange 2016 Hybrid Deploy Check - Username or Password Invalid

These days, it seems every Microsoft product comes with its own unique set of head scratchers. Microsoft Exchange Server is no exception to this. I was installing Exchange 2016 earlier today, to be used as a hybrid configuration server for Office 365 (no local mailboxes). I downloaded the self depackaging executable from Microsoft, and attempted to install it. If you currently have a hybrid configuration (which we did, with Exchange 2010), the Exchange 2016 installer will detect this and run some tests to verify that the Office 365 tenant is ready for Exchange 2016 (more info here: https://technet.microsoft.com/en-us/library/ms.exch.setup.hybridconfigurationstatuspage(v=exchg.160).aspx). You’ll be prompted for Office 365 credentials (the user must have the Organization Management role). Seems simple enough, right? Wrong.

After typing in the username and pasting the password into the password field, setup came back with an error message stating the username or password was wrong. I then clicked the back button, and it crashed. I ran through this process a few more times, all with the same outcome. I even rebooted the server, which (in my opinion) should never be the resolution to a software problem. I looked through setup logs and found no indication of what the problem could be…



It was on the fourth try that I typed in the password, and this seemed to work. I didn’t receive any error messages about the credentials being wrong. The Exchange setup seemed to continue on successfully. However, it then failed with a different error:



I again looked through the setup logs and found that this error happened anytime setup tried to run the “Get-OrganizationConfig” cmdlet. After troubleshooting for a little while, and no resolution in sight, I turned to Google. One of the posts I came across said that this is a bug in the Exchange installer, and to try and use the Cumulative Update installer instead. Apparently, with Exchange 2016, the Cumulative Update installer’s include all of the Exchange binaries, not just the updated binaries. I downloaded the installer for CU7 (all 6 gigabytes of it…) and successfully installed Exchange 2016. Hope this helps anyone out there struggling with this.

Enable SNMP in ESXi 6.5 via SSH

I was trying to enable SNMP on a few stand-alone ESXi 6.5 hosts the other day. Unfortunately, when attempting to enable this service using the vSphere Host Client, I received a very unhelpful error:

 



I wasn't able to find any helpful information in the logs that could help identify the cause. Interestingly enough, enabling the service through SSH worked. Here's how I did it. First, you'll need to connect to your host via SSH (you will need to enable the SSH daemon first).

Once connected, type in "esxcli system snmp get" to see the current snmp configuration.



To enable SNMP, we first need to configure the community strings. To do that, type in "esxcli system snmp get --communities=<community strings>". Then, enable the service by typing in "esxcli snmp set --enable=true".

You can then verify the new configure by typing in "esxcli system snmp get" again.



Now refresh the vSphere Host Client, and the service should be running.

Auditing Exchange Online Transport Rule Use

I recently came across a transport rule being unnecessarily used in Exchange Online. The transport rule in question was used for DLP, and encrypted messages based on the content. It searched message bodies for strings of characters matching credit card numbers, SSN's, etc.  I was surprised to see that there was no way to easily audit transport rule usage with Powershell, so I checked the Exchange Control Panel. There is an option for auditing in each of the transport rules:



So, what does this checkbox actually do?

Enabling this checkbox will cause this rule to appear in Message Trace logs when it is applied to a message. 

Let's look at an example:

Here we have a transport rule in Exchange Online that appends "Outbound" to the subject line of all messages sent to external recipients:



 

After sending a message to an external recipient, we can see the rule working:



Let's take a look at the message trace:



We can see two entries in the message trace log. The first is for applying the transport rule, and the second entry is for setting the audit severity level. I haven't found a good explanation of the audit severity levels, other than you can filter by them when doing a message trace.

If you know of any other use for the audit severity levels, leave a comment below!