“Delivery has failed to these recipients or distribution lists:
 
Jane Doe
Your message wasn’t delivered because of security policies…”

In our case, Jane Doe was no longer an employee and her account was disabled. The sender of the message was requesting a meeting with someone who had Jane as his admin, so he had her as a Delegate for his Calendar. Once we removed her from his Outlook’s Delegate list, there were no more errors.

Pretty simple, but they’ve moved Delegate Access in Outlook 2010, now you go to File > Account Settings > Delegate Access

For Outlook 2007 and earlier, go to Tools > Options > Delegates tab.

With that came a convoluted configuration that probably resulted in more support calls to Microsoft than anything else involving the then-new Exchange Server 2003 product. And I always found it puzzling that Microsoft didn’t create a wizard to automate this configuration, as they did for Small Business Server 2003, which included Exchange Server. (This was addressed in the later Exchange Server releases, 2007 and 2010.)

In any case it always seemed like a miracle was preformed when RPC over HTTPS finally did work. Fast-forward seven years and there are web pages and tutorials aplenty. In my recent search, the MSExchange article I found was the most straight-forward for a single system, Exchange Server 2003 deployment. One key element upon completion of the feature install and changes to the registry, is to make sure you reboot any Domain Controllers that were updated after the work is complete.

The reboot is necessary to complete the Global Catalog port mapping of 6004. In fact, you should be able to telnet to ports 6001 and 6002 on the Exchange Server, and 6004 on the Global Catalog server that was updated.

And as always, there is the über-useful Exchange Remote Connectivity Analyzer to aid with troubleshooting (that’s how I found out the Global Catalog needed a reboot).

Change Printer Spooler Service Recovery options to Restart
sc failure spooler reset= 60 actions= restart/600/restart/600/restart/600

Backing up an MSDE Database
osql -E -Q “BACKUP DATABASE mdss TO DISK= ‘C:\BB_DB_Backup\mdss.bak’”

Copy Database and then Appending with Date
copy t:\plandata.mdb C:\PlanDataBackup /Y

For /F “Tokens=1-8 Delims=.:/ ” %%a In (‘Echo %Date%’) Do (Set All=%%d-%%b-%%c)
@For %%a in (“plandata.mdb”) do rename %%a “%%~na-%All%.mdb”

Deleting Old OWA Logs
forfiles -p “C:\inetpub\logs\LogFiles\W3SVC1″ -c “cmd /c echo del \”@FILE\” & del \”@FILE\”" -d -21

The method for upgrading the policy is to fire up the Exchange Command Shell and run the following command:
Set-EmailAddressPolicy “Default Policy” -IncludedRecipients AllRecipients

You may recieve the following error: Set-EmailAddressPolicy:The recipient policy “Default Policy” with mailbox manager settings cannot be managed by the current version of Exchange Management Console. Please use a management console with the same version as the object.

This is typically caused by a Mailbox Management Policy being applied to the Default Policy.

To address this: Open Exchange 2003 System Manager, go to Recipients, Recipient Policies and right-click the Default Policy, select Change property pages…, and uncheck Mailbox Manager Settings.

Now run the upgrade script above and get on with removing that last legacy server.

The fix is to delete the ActiveSync profile on the phone (and maybe on the server, I did this via Outlook Web Access just to be sure) and then create a new one. There is a security policy on the CAS server end which gets set up when a new device connects, our theory is that if the phone doesn’t make a new connection to the Exchange 2007 server, that security policy never gets pushed to the client and the server will refuse to download attachments to the phone.

You also have to allow attachments in the Default ActiveSync Client-access profile on the server (but this is enabled by default).

So, if you have users who say they get errors when downloading attachments to an ActiveSync phone, nuke the profile on the phone and recreate the association, it should then start working once again.

Add-AvailabilityAddressSpace -ForestName Contoso.com -AccessMethod PublicFolder

Soon we’ll be without a mixed 2003/2007 environment, I look forward to that day.

Mailbox Role Prerequisites
Failed

Error:
An unexpected ‘(‘ character is found in the ‘purportedSearch’ attribute of the Recipient Policy ‘firstdotlast’, it will cause setup to fail. Please remove it and rerun setup. Current value: (&(&(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(!(homeMDB=*))(!(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=contact))(objectCategory=group)(objectCategory=publicFolder)(objectCategory=msExchDynamicDistributionList) )))).

I did numerous searches on the web and I found nothing conclusive; that’s when I decided to burn one of the two Support Incidents I get with my TechNet subscription. The Microsoft tech knew right away what the issue was and how to get around it. It seems the old recipient policy in LDAP form needs to be converted to OPATH during an Exchange 2003 to 2007 migration and I hadn’t done that…really, who knew? I hadn’t read this in any of my numerous Exchange 2007 books or saw it on any website, but maybe I missed it.

The workaround was to open the ADSI editor(adsiedit.msc) and browse over to the recipient policy in question, copy and save the contents to a text file, then clear the value.
Here’s the path for the ADSI editor: Configuration -> CN=Configuration,DC=company,DC=com -> CN=Services -> CN=Microsoft Exchange -> CN=Company -> CN=Recipient Policies -> CN=custom policy

Once that was done, I re-ran the Exchange 2007 Mailbox role installation and it went perfectly. Next was to reopen the ADSI editor and take the data from the text file and repopulate the purportedSearch value.

The Microsoft tech was very helpful and pointed me to a TechNet article regarding the conversion from LDAP to OPATH Recipient Policies. Now why wasn’t this addressed in the Exchange 2007 installer? It would have been a simple script to do this in the background, or at the very least how about a real clue from the installer stating the actual problem. In any case, it is all working now.

Try it out here: Exchange Remote Connectivity Analyzer

This is an intra-organization migration replacing a single Exchange 2003 server. Part of this is getting the prerequisites out of the way. TechNet has a couple of great articles, Preparing AD and Domains and Installing Exchange 2007 Prerequisites on Windows Server 2008.

So far so good. I’m also making use of Jim McBee’s great book Exchange 2007 Implementation and Administration as well (this book assumes that you have experience with Exchange, Windows Server and Active Directory).

I’ll post more as the project progresses.

I fault the 3rd party hardware and software manufacturers with the many compatibility issues that have plagued Vista, when they had a FIVE YEAR window for development (HP Photo printer anyone?), but to have Microsoft come late to the party with Windows server and Exchange management tools is just lame. Do they want the MS tech crowd on their side or not?

In any case, better late than never.