7 Best Practices for Physical Servers Hosting Hyper-V Roles

Before setting up a physical server to host the Hyper-V role, download, read, and understand information included in the white paper “Performance Tuning Guidelines for Windows Server 2008”. Three sections in this white paper that can have a significant impact on the performance of the physical server discuss tuning the server hardware and setting up the networking and storage subsystems. These are especially critical for Hyper-V because the hypervisor itself sits on top of the hardware layer as described earlier and controls all hardware in Windows Server 2008. The operating system itself essentially runs in a virtual machine, better known as the Parent Partition.

Here are seven best practices for physical servers hosting the Hyper-V role.

Avoid Overloading the Server
Determining the number of virtual machines that will be hosted on the Hyper-V server and the workloads they will be handling is critical. The version of the operating system that will be installed on the physical server can help in this regard, so the first “best practice” is to consider using Windows Server 2008 Datacenter x64 with Hyper-V. The Datacenter x64 edition supports up to 64 processors, 2 terabytes of physical memory, and 16 failover cluster nodes for Quick Migration scenarios and allows unlimited virtual machines to be run in Hyper-V. Selecting a Server Core installation provides added benefits, including enhanced security and lower maintenance.

Ensure High-Speed Access to Storage
For storage, consider using a storage area network (SAN) that is configured with highspeed (10,000 rpms or greater) drives (SATA or SAS) that support queued I/O and Raid 0 +1 configurations. You can use either Fibre Channel or iSCSI SAN hardware.

Install Multiple Network Interface Cards
For networking, be sure to have more than one network card installed on the physical server and dedicate one network interface to Hyper-V server administration. This means no virtual networks in Hyper-V will be configured to use this NIC. For high-workload virtual machines, you might want to dedicate a physical network adapter on the server to the virtual network the virtual machine is using. Ensure virtual machines that share a physical adapter do not oversubscribe to the physical network. Use the Reliability And Performance Monitor to establish a performance baseline for the load and then adjust NIC configurations and loads accordingly.

If you have only a single NIC in the machine that you are configuring the Hyper-V role on and you are doing the configuration remotely (say, in an RDP session) if you choose to bind the Virtual Switch Protocol to the single NIC in the machine, you will be disconnected from your session and a reconnection might not be possible until the newly created virtual network adapter has been properly configured.

Avoid Mixing Virtual Machines That Can Use Integration Services with Those That Cannot
Do not mix on the same physical server virtual machines that can take advantage of Hyper-V Integration Services with those that cannot. Virtual machines that cannot use Integration Services must use legacy network adapters to gain access to the physical network. To accommodate legacy network adapters, you might need to disable some high-end features on the network interface, which can unnecessarily limit the functionality of the synthetic devices. Additionally, using emulated devices places an extra workload on the Hyper-V server.

Configure Antivirus Software to Bypass Hyper-V Processes and Directories
If you are running antivirus software on the physical server, you might want to consider excluding the Vmms.exe and Vmswp.exe processes. Also, exclude the directories that contain the virtual machine configuration files and virtual hard disks from active scanning. An added benefit of using pass-through disks in your virtual machines is that you can use the antivirus software running on the physical server to protect that virtual machine.

Avoid Storing System Files on Drives Used for Hyper-V Storage
Do not store any system files (Pagefile.sys) on drives dedicated to storing virtual machine data.

Monitor Performance to Optimize and Manage Server Loading
When running multiple high-workload virtual machines on a Hyper-V server, ensure a proper aggregate performance baseline is obtained over a specified period of time (say, five days during normal working hours) to ensure the hardware configuration for the physical server is optimal to support the load being placed on it by the virtual machines. If adding more memory, processors, or higher performing storage is not possible, you might need to migrate the virtual machines to other Hyper-V servers.

exchange server 2010

Microsoft reached the RTM (Release To Manufacturing) milestone for Exchange Server 2010 on October 8, 2009, and was officially launched on November 9, 2009;.^[18] A 120 day trial is downloadable from Microsoft.^[17] Exchange Server 2010 is available in two server editions; Standard edition and Enterprise edition.
Major changes from previous versions of Exchange Server include:

• The high availability options for Mailbox Databases (SCC: Single Copy Clustering, CCR: Clustered Continuous Replication and LCR: Local Continuous Replication) and site resiliency functionality (SCR: Standby Continuous Replication) have been replaced by Database Availability Groups (DAGs) in Exchange Server 2010. Major DAG benefits include providing database level high availability (as opposed to server level), support for up to sixteen (16) copies of each database, and flexible configuration (databases copies may be added / removed at will without requiring major server reconfiguration). Each server that runs the Enterprise edition of Exchange Server 2010 can host up to 100 database copies.
• High availability for the Client Access Server role in Exchange Server 2010 is provided by using Client Access Server (CAS) arrays. A CAS array can contain multiple Client Access Servers in an Active Directory site and provide a single name endpoint for client connections. CAS arrays cannot span multiple Active Directory sites.
• In Exchange Server 2007, a clustered mailbox server could not be combined with any other roles. In Exchange Server 2010, the Mailbox Server Role may be combined with the Client Access Server and/or Hub Transport roles, regardless of whether or not the mailbox server participates in a Database Availability Group. (However, since Database Availability Groups utilize Windows Failover Clustering, and Microsoft does not support the combination of Windows Failover Clustering and Windows Network Load Balancing on the same server, a multi-role deployment will require the use of a 3rd party load balancer to provide load balancing and fault tolerance for the Client Access Server role).
• With the introduction of the RPC Client Access service, all Outlook clients access their mailbox database through the Client Access Server role. This abstraction layer allows for improved load balancing and redundancy and minimal client impact in the event of a database level *-over ("switchover" or "failover") event.
• Exchange Server 2010 provides cost savings in required hardware. Storage performance requirements (measured in IOPS: Input/Output operations Per Second) have been reduced by approximately 70% over Exchange Server 2007, and by approximately 90% over Exchange Server 2003. According to a case study, Microsoft IT was able to reduce hardware costs by 75% during the migration from Exchange Server 2007 to Exchange Server 2010.
• Exchange Server 2010 extends the large mailbox support introduced in Exchange Server 2007, and also introduces a Personal Archive feature to allow messages to be retained longer without the need for a 3rd party archival system. The Personal Archive is implemented as a secondary mailbox for archive-enabled users, and in Exchange Server 2010 Service Pack 1, the Personal Archive may be located on a different database than the primary mailbox, which may reside on a different disk if desired.
• The compliance and legal search features have been enhanced. What was formerly known as the "Dumpster" in previous versions of Exchange (a special storage area for messages which have been deleted from the Deleted Items folder or "permanently deleted" from a regular folder, such as the Inbox) has been evolved into the Recoverable Items folder in Exchange Server 2010. If configured appropriately, the Recoverable Items folder allows for a "tamper proof" storage area (users cannot circumvent the Recoverable Items folder to bypass legal discovery), which also provides a revision history of any modified items.
• Administration delegation can now be performed at a granular level due to Exchange Server 2010's implementation of Role Based Access Control (RBAC). Users and administrators can be given extremely fine grained abilities for functions provided both within the Exchange Management Console or Exchange Management Shell and in Outlook Web App. For example, a compliance officer may be given the ability to perform cross mailbox discovery searches within Outlook Web App; a help desk technician may be granted the ability to set an Out Of Office message for other employees within the company, or a branch administrator in a remote office may be granted the permission to perform specific Exchange Management Shell commands that pertain only to the Exchange server in their branch office.
• Outlook Web App includes improvements (including, for example, the ability for users to track their sent messages and printable calendar views) and the "Premium" experience is now available across multiple browsers (including Safari and Firefox).
• Distribution groups can now be "moderated", meaning that distribution groups can now be configured to allow users to join at will or only with a group moderator's permission, and individual messages sent to distribution groups can now be approved or denied by a moderator.
• Exchange Server 2010 introduces a transport concept called "Shadow Redundancy" which protects e-mail messages while they are in transit. If a Hub Transport server or an Edge Transport server fails after it has received a message for processing, but before it was able to deliver it to the next "hop" server, the server which sent the message to that transport server is now able to detect the failure and redeliver the message to a different Hub Transport or Edge Transport server for processing.

In January 2011, Microsoft Exchange Server 2010 won InfoWorld's 2011 Technology of the Year Award for Best Mail Server.

[edit] Clustering and high availability

Exchange Server Enterprise Edition supports clustering of up to 4 nodes when using Windows 2000 Server, and up to 8 nodes with Windows Server 2003. Exchange Server 2003 also introduced active-active clustering, but for two-node clusters only. In this setup, both servers in the cluster are allowed to be active simultaneously. This is opposed to Exchange's more common active-passive mode in which the failover servers in any cluster node cannot be used at all while their corresponding home servers are active. They must wait, inactive, for the home servers in the node to fail. Subsequent performance issues with active-active mode have led Microsoft to recommend that it should no longer be used.^[19] In fact, support for active-active mode clustering has been discontinued with Exchange Server 2007.
Exchange's clustering (active-active or active-passive mode) has been criticized because of its requirement for servers in the cluster nodes to share the same physical data. The clustering in Exchange Server provides redundancy for Exchange Server as an application, but not for Exchange data.^[20] In this scenario, the data can be regarded as a single point of failure, despite Microsoft's description of this set up as a "Shared Nothing" model.^[21] This void has however been filled by ISV's and storage manufacturers, through "site resilience" solutions, such as geo-clustering and asynchronous data replication.^[22] Exchange Server 2007 introduces new cluster terminology and configurations that address the shortcomings of the previous "shared data model".^[23]
Exchange Server 2007 provides built-in support for asynchronous replication modeled on SQL Server's "Log shipping"^[24] in CCR (Cluster Continuous Replication)^[25] clusters, which are built on MSCS MNS (Microsoft Cluster Service—Majority Node Set) clusters, which do not require shared storage. This type of cluster can be inexpensive and deployed in one, or "stretched" across two datacenters for protection against site-wide failures such as natural disasters. The limitation of CCR clusters is the ability to have only two nodes and the third node known as "voter node" or file share witness^[26] that prevents "split brain"^[26] scenarios, generally hosted as a file share on a Hub Transport Server.^[27] The second type of cluster is the traditional clustering that was available in previous versions, and is now being referred to as SCC (Single Copy Cluster). In Exchange Server 2007 deployment of both CCR and SCC clusters has been simplified and improved; the entire cluster install process takes place during Exchange Server installation. LCR or Local Continuous Replication^[27] has been referred to as the "poor man's cluster". It is designed to allow for data replication to an alternative drive attached to the same system and is intended to provide protection against local storage failures. It does not protect against the case where the server itself fails.
In November 2007, Microsoft released SP1 for Exchange Server 2007. This service pack includes an additional high-availability feature called SCR (Standby Continuous Replication). Unlike CCR which requires that both servers belong to a Windows cluster, typically residing in the same datacenter, SCR can replicate data to a non-clustered server, located in a separate datacenter.
With Exchange Server 2010, Microsoft introduced the concept of the Database Availability Group (DAG). A DAG contains Mailbox servers that become members of the DAG. Once a Mailbox server is a member of a DAG, the Mailbox Databases on that server can be copied to other members of the DAG. When you add a Mailbox server to a DAG, the Failover Clustering Windows role is installed on the server and all required clustering resources are created.

[edit] Licensing

Like Windows Server products, Exchange Server requires Client Access Licenses, which are different from Windows CALs. Corporate license agreements, such as the Enterprise Agreement, or EA, include Exchange Server CALs. It also comes as part of the Core CAL. Just like Windows Server and other server products from Microsoft, you can choose to use User or Device CALs. Device CALs are assigned to a device (workstation, laptop or PDA). User CALs, are assigned to a user or employee (not a mailbox). User CALs allow a user to access Exchange e-mail from any device. User and Device CALs are the same price, however cannot be used interchangeably. For Service Providers looking to host Microsoft Exchange, there is an SPLA (Service Provider License Agreement) available whereby Microsoft receives a monthly service fee in the place of the traditional Client Access Licenses. Two types of Exchange CAL are available: Exchange CAL Standard and Exchange CAL Enterprise. The Enterprise CAL is an add-on license to the Standard CAL.

[edit] Exchange Hosting

Microsoft Exchange Server can also be purchased as a hosted service from a number of providers.^[28]

[edit] Clients

Microsoft Exchange Server uses a proprietary RPC protocol, MAPI/RPC,^[29] that was designed to be used by the Microsoft Outlook client. Clients capable of using the proprietary features of Exchange Server include Microsoft Outlook and Novell Evolution. Exchange Web Services (EWS), an alternative to the MAPI protocol, is a documented SOAP based protocol introduced with Exchange Server 2007 which significantly reduces synchronization time between the server vs. WebDAV, which is used by Exchange Server 2003. Exchange Web Services is used by the latest version of Microsoft Entourage for Mac. Also, since the release of Mac OS X v10.6 (also known as Mac OS X Snow Leopard), Mac computers running OS X include some support for this technology via Apple's Mail application. Built-in support with Mac OS X 10.6 requires the Exchange organization to be running Exchange Server 2007 SP1/SP2 or Exchange Server 2010.
Mac users wishing to access Exchange e-mail running on Exchange Server 2000 or 2003 must use Microsoft's Entourage client versions X, 2004 or 2008. Alternatively a limited version of Outlook Web Access is available to Mac users using a web browser. Entourage X, 2004 and 2008 do not support synchronizing tasks and notes with Exchange Servers 2000, 2003, 2007 or 2010. However Entourage 2008 "Web Services Edition", which is a free download from Microsoft for users of Office 2008, does support synchronizing tasks and notes with Exchange Server 2007 SP1 rollup update 4 or later (including Exchange 2010).
E-mail hosted on an Exchange Server can also be accessed using SMTP, POP3 and IMAP4 protocols, using clients such as Outlook Express, Mozilla Thunderbird, and Lotus Notes. (These protocols must be enabled on the server. Recent versions of Exchange Server turn them off by default.)
Exchange Server mailboxes can also be accessed through a web browser, using Outlook Web Access (OWA). Exchange Server 2003 also featured a version of OWA for mobile devices, called Outlook Mobile Access (OMA).
DavMail Gateway allows any email client to connect to a Microsoft Outlook server with Outlook Web Access (OWA).
GNOME Evolution project can be used to Connect to MS-Exchange (in OWA mode for Exchange 2000/2003, native mode for Exchange 2007).^[30] Evolution is now also available for Windows.^[31][32]

Exchange Server 2007 Email Routing

Exchange Server 2007contains a completely new implementation of email routing. Each of the Active Directory service sites where Exchange mailboxes are hosted must have a Hub Transport server role to control messaging between sites, even within a single site. Within this article we will dive a little bit deeper into this new technology and I will explain how it works. Part I explains the vocabulary and the architecture to help you understand how Exchange is designed and how it works, Part II will show how to configure it on Exchange Server 2007 using the GUI administration tools and Powershell.

Message Flow Architecture

The Hub Transport server role is essential for each Exchange Server 2007 to route internal and external emails. The service running on these servers is the Exchange Transport Service (MSExchangeTransport.exe).

Inbound Email

Inbound email is email that is delivered from outside Exchange Server 2007, for example, from the Internet. We should have a gateway server implemented which can be an Edge Transport server role or Hub Transport server role. This depends on what internet connectivity and firewall structure is implemented. Best practice should be installing an Exchange Server 2007 Edge Transport server role residing in the perimeter network (also known as DMZ) without the need of Active Directory. This server then routes incoming messages into your Exchange Server 2007 organization.

Outbound Email

Outbound email means messages that are being sent from internal mailbox users to external recipients residing on the Internet. After a Hub Transport server has processed the mail and identified it as outbound mail, the server routes it to the Internet, either directly or again by passing a gateway server. This gateway server can be an Edge Server Transport server.

Local Email

Local mail flow refers to messages that are processed by a Hub Transport server in an Exchange Server 2007 organization and delivered to a mailbox on the same Active Directory Site.

Remote Email

Remote Email flow refers to messages that are processed by a Hub Transport server in an Exchange Server 2007 organization and delivered to a mailbox on a different Active Directory site from the source mailbox.

SMTP Connectors

SMTP connectors are Exchange Server 2007 components that support one-way SMTP connections. Due to this new restriction (based on earlier versions of Exchange Server) we need two connectors:

• SMTP Receive Connectors
• SMTP Send Connectors

An SMTP Receive connector is required for an Exchange Server 2007 server system to accept any SMTP connection. It is used to enable an Exchange Server Hub Transport role or Edge Transport server role to receive email from any other SMTP server on the Internet, other Exchange Server 2007 Hub Transport server roles, Edge Transport server roles or other Exchange Server 2007 environments. You can configure multiple SMTP Receive connectors with different parameters on a single Exchange Server due to implementation or high availability reasons. You do not have to create SMTP Receive connectors to route mail between Hub Transport server roles within the same forest.

An SMTP Send connector is required for an Exchange Server 2007 system to send any SMTP email. It is required to send email to any SMTP server on the internet or to any SMTP server within the same Exchange Server organization.

You can manage each of them using the Exchange Management Console or Exchange Management Shell. To manage connectors using the shell use the Set-ReceiveConnector and Set-SendConnector cmdlets.

Message Transport Components

To work with Exchange Server and troubleshoot message transport problems you should know the internal workings of Exchange message routing.

Messaging Components are:

• Submission Queue
• Store Driver
• Microsoft Exchange Mail Submission Service
• Pickup Directory
• Categorizer

Messages from outside your Exchange organization enter the transport pipeline through an SMTP Receive Connector. Messages inside enter the pipeline through the Hub Transport server role.

Submission Queue

Each Transport server role (Hub or Edge Transport) has one submission queue that is created by the categorizer when Exchange Transport Service starts. It stores all messages on the local hard disk until they are processed by the categorizer for delivery. They are then finally removed from this queue.

Store Driver

Messages sent by a mailbox user enter the transport pipeline when they reach the sender’s outbox. The store driver on the Hub Transport retrieves it from the user’s Outbox and then transfers it to the submission queue. After the message has been successfully added to the submission queue, it is moved from the sender’s Outbox to the sender’s Sent Items. Messages are stored in MAPI format and must be converted to Summary Transport Neutral Encapsulation Format (S/TNEF) before being placed in the Submission Queue. This conversion is the job of the store driver, too. If this conversion is unsuccessful, a non-delivery report (NDR) is generated.

Microsoft Exchange Mail Submission Service

The Microsoft Exchange Mail Submission Service is a notification service that runs on Mailbox server roles. It notifies the Hub Transport server role to pick up the message from the sender’s Outbox. If there are multiple Hub Transport server roles on one Active Directory site, the Message Exchange Mail Submission service attempts to evenly distribute notifications between each transport role using static load balancing.

Pickup Directory

Each message that is transferred to the pickup directory has been successfully submitted to the submission queue via the categorizer. Messages placed in the Pickup Directory must be in the appropriate format and have read/write permissions configured. It allows you to take a properly formatted text file and have the Hub Transport server role process and deliver it. This can be very helpful when mail flow is being validated in the organization or relaying specific messages or returning to the transport pipeline. Even 3rd party applications may place messages in the Pickup directory rather than communicating directly with the Exchange Server.

Categorizer

The categorizer always picks the oldest message from the Submission queue and checks whether this message has to be routed internally in the Exchange organization or externally.

On each Hub Transport server the categorizer performs the following tasks:

• Identification and verification of recipients
• Expansion of distribution lists
• Determination of routing paths
• Conversion of content formats
• Application of message policies

Implementation of Message Transports

Every time you install Hub Transport server roles in Exchange Server 2007 environments, message routing is enabled by default, but you may need to configure additional options on the Hub Transport server role. This process can look like this:

• Configure server-specific settings
• Configure authoritative domains and email address policies
• Configure a postmaster mailbox
• Configure Internet message flow
• Configure messaging policies
• Configure administrative permissions:
  • Exchange Organization Administrators
  • Exchange Server Administrators
  • Exchange View-Only Administrators

Each of these configuration settings are unique and need to be defined in a design document before the configuration for each company.

Managing Exchange 2010 with Remote PowerShell

by Mukesh Kumar Singh on February 6, 2011

One of the major changes in Exchange 2010 is that all of the Exchange Management Shell administration is done through PowerShell remoting. Even when you run the Exchange Management Shell from an Exchange Server, or a workstation with the Exchange tools installed, you are establishing a remote PowerShell session to Exchange.
When you double click the Exchange Management Shell icon on an Exchange 2010 server or workstation with the management tools installed, the following takes place:

• The Microsoft.Exchange.Management.PowerShell.E2010 snap-in gets loaded.
• The RemoteExchange.ps1 script get's dot sourced into the PowerShell session - this initializes some variables and imports several Exchange specific functions.
• The Connect-ExchangeServer function gets executed - this will attempt to create a remote PowerShell session on the local server, if a connection cannot be made locally it will attempt to connect to a another server in the same site, starting with servers running the CAS role, then on to servers running the mailbox, hub transport and UM roles.
• Once you are connected to an Exchange server, all of the Exchange cmdlets are imported into the PowerShell session using implicit remoting.

You can run the Connect-ExchangeServer function manually. Use the -auto parameter to connect using autodiscover:
Connect-ExchangeServer -auto

You can use the Connect-ExchangeServer function with the -ServerFQDN parameter to manually connect to a specific server:
Connect-ExchangeServer -ServerFqdn phx-ex01.exchangelab.com

Manually Configuring Implicit Remoting

We can manually configure implicit remoting to import commands into our local PowerShell session. This means that we do not need to have the Exchange tools installed in order to work with Exchange Management Shell commands.
The first step is to create a session using the New-PSSession cmdlet:
$s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://phx-ex01.exchangelab.com/PowerShell/ -Authentication Kerberos

If you need to connect with alternate credentials, you can use the credential parameter with New-PSSession. For example, you can pass the Get-Credential cmdlet to the credential parameter, this would prompt you for your credentials when creating your PSSession.
$s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://phx-ex01.exchangelab.com/PowerShell/ -Authentication Kerberos -Credential (Get-Credential)
Once you have a PSSession object created, import the session using the Import-PSSession cmdlet:
Import-PSSession $s

As you can see here, the Exchange Management Shell commands are imported into our local PowerShell session and listed in under the exported commands column.

Managing Exchange Servers using Fan-Out Remoting

Fan-out remoting is used to issue PowerShell commands to many systems at once. For example, say you need to reboot several servers for maintenance, you could use the Invoke-Command cmdlet to invoke the Restart-Computer cmdlet on each server at the same time:
$srv = "EX01","EX02","EX03"
Invoke-Command -ScriptBlock {Restart-Computer -Force} -ComputerName $srv

Fan-out remoting is useful for mass server management, when the Exchange cmdlets are not required. For example, restarting services or making a registry change on many servers at once, or rebooting multiple servers at the same time as we saw in this example.

Adding Exchange Management Shell to your Standard PowerShell Profile

I like to have all my tools loaded in my standard PowerShell profile. For example, I have several snap-ins and other tools loading when I start PowerShell. I use a single PowerShell instance to manage AD with the RSAT AD PowerShell module, PowerCLI for VMware, and also the Exchange Management Shell tools.
If you do not have a profile setup, you can create one using the following command:
New-Item -Itemtype file -path $profile -force

Once your profile is created, you can edit it in notepad by typing notepad $profile and hitting enter.
There are two ways to add the Exchange Management Shell tools to your standard PowerShell profile.

1. Using Implicit Remoting

We already looked at the commands for performing implicit remoting with Exchange. You can simply add that code to your PowerShell profile. Every time you start PowerShell, you will have the Exchange Management Shell commands imported into your session.

2. Using the Exchange Snap-in

Technically, you'd want to use implicit remoting even if the tools are installed, since that's the supported way and what makes RBAC possible. But, you can also setup a PowerShell profile using the Exchange snap-in if you so choose; add the following code to your profile:
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
. $env:ExchangeInstallPath\bin\RemoteExchange.ps1
Connect-ExchangeServer -auto

This will add the snap-in, dot source the RemoteExchange.ps1 to load the helper functions and gloabal variables, and then connect to an Exchange server using autodiscover. Keep in mind that adding the snap-in like this isn't actually supported. It will work but you'll need the appropriate AD permissions since you are essentially bypassing RBAC by not using remoting.
There are a lot of changes in Exchange 2010, and as you can see the PowerShell management is no exception. I hope this information has been helpful.

WHAT'S NEW IN EXCHANGE 2010

NEW FEATURES IN EXCHANGE 2010

Microsoft Exchange Server 2010 brings a new and rich set of technologies, features, and services to the Exchange Server product line. New features and functionality in Exchange 2010 support several key concepts:

• Flexible and reliable
  
• Anywhere access
  
• Protection and compliance
  

The following sections provide you with an overview of some of the important new features and functionality, which you can use when you're planning, deploying, and administering your Exchange 2010 organization.
(For information about features that have been discontinued or de-emphasized from Microsoft Exchange Server 2003 or Exchange Server 2007 to Exchange 2010, see Discontinued Features [ http://technet.microsoft.com/en-us/library/aa998911.aspx ] .)
For information about the features and changes that have been added in Exchange 2010 SP1, see What's New in Exchange 2010 SP1 [ http://technet.microsoft.com/en-us/library/ff459257.aspx ] .

 Flexible and Reliable

The pressure to optimize your IT infrastructure to respond to changing business conditions demands agility and that means investing in solutions that provide you and your organization choice. Exchange 2010 gives you the flexibility to tailor your deployment based on your organization's unique needs and a simplified way to help keep e-mail continuously available for your users.

 High Availability Functionality

Exchange 2010 integrates high availability into the core architecture of Exchange to enable customers of all sizes and in all segments to economically deploy a messaging continuity service in their organization.
Exchange 2010 includes many changes to its core architecture. In Exchange 2010, new features such as incremental deployment, mailbox database copies, and database availability groups work with other features such as shadow redundancy and transport dumpster to provide a new, unified platform for high availability and site resilience.
For more information about high availability features, see New High Availability and Site Resilience Functionality [ http://technet.microsoft.com/en-us/library/dd335211.aspx ] .

 Exchange Store and Mailbox Database Functionality

The following is a list of core store functionality that's included or has been changed in Exchange 2010:

• Deprecated storage groups
  
• Mailbox databases no longer connected to the server object
  
• Improvements in Extensible Storage Engine (ESE) for high availability, performance, and database mobility
  
• Flattened Outlook store schema
  
• Enhanced reporting with public folders
  

For more information about Exchange store and mailbox database features, see New Exchange Core Store Functionality [ http://technet.microsoft.com/en-us/library/bb125040.aspx ] .

 Permissions Functionality

In Exchange 2010, Role Based Access Control (RBAC) replaces the permissions model used in Exchange 2007. Using RBAC, you can define extremely broad or extremely precise permissions models based on the roles of your administrators and users.
For administrators and specialist users, management role groups define what these users can manage in the organization. Role groups associate role group members to a set of management roles that define what the members can do. By adding or removing users as members of role groups, and adding or removing role assignments to or from a role group, you can control what aspects of the organization the members can manage.
For end users, management role assignment policies define what users can configure on their own mailbox. Assignment policies are applied to every mailbox either by default or manually, and enable you to control whether users can change their personal information, contact information, distribution group membership, and so on.
Both role groups and role assignment policies are assigned management roles. Management roles control access to the cmdlets and parameters required to perform a task. For example, if a cmdlet exists on a management role, and that role is assigned to a role group, the members of that role group can then use that cmdlet.
For more information about RBAC features, see Understanding Permissions [ http://technet.microsoft.com/en-us/library/dd297943.aspx ] .

 Transport and Routing Functionality

The following is a list of new transport and routing functionality included in Exchange 2010:

• Shadow redundancy
  
• MailTips
  
• Moderated transport
  
• Federated delivery
  
• Latency service level agreement (SLA) management
  
• End-to-end message tracking
  
• Incremental EdgeSync
  
• Transport rules integration with AD RMS
  
• Transport dumpster improvements
  
• Transport database improvements
  

For more information about transport features, see New Transport Functionality [ http://technet.microsoft.com/en-us/library/ee633463.aspx ] .

 Exchange Server 2010 Deployment Assistant

Exchange Server 2010 introduces the Exchange Server Deployment Assistant, or ExDeploy, a new Web-based tool that can help you with your Exchange deployment. ExDeploy asks you a few questions about your current environment and then generates a custom checklist and procedures that help simplify your deployment.
For more information, see Exchange 2010 Deployment Assistant [ http://technet.microsoft.com/en-us/library/ee681665.aspx ] .

 Administration Functionality in the Exchange Management Console

The following is a list of the new core Exchange Management Console (EMC) features included in Exchange 2010. The core EMC refers to new functionality that affects how you use the EMC, and not how you use specific features:

• Ability to add Exchange forests to the console tree
  
• Customer Feedback start tab
  
• Community and Resources
  
• EMC command logging
  
• Property dialog box command exposure
  
• RBAC permissions aware for the EMC
  
• Online Exchange Help
  

For more information about EMC features, see New Administrative Functionality in the Exchange Management Console [ http://technet.microsoft.com/en-us/library/dd335120.aspx ] .

 Administration Functionality in the Exchange Management Shell

The following is a list of features available in the new Exchange Management Shell:

• Remote administration   With the new Shell, you can connect to remote servers running Exchange 2010 across the network with only Windows Management Framework installed, which includes Windows PowerShell. For more information, see Overview of Exchange Management Shell [ http://technet.microsoft.com/en-us/library/dd297939.aspx ] .
  
• RBAC integration   The Shell works with RBAC to give you and your users access only to the cmdlets and parameters you and they are allowed to use. If your permissions don't allow you to configure a certain feature, you aren't given access to the cmdlets, parameters, or both, that manage that feature. For more information, see Understanding Role Based Access Control [ http://technet.microsoft.com/en-us/library/dd298183.aspx ] .
  
• Administrator audit logging   Actions that result in the modification of Exchange organization configuration and other object properties in the EMC, the Web management interface, and the Shell can now be logged for later review. For more information, see Overview of Administrator Audit Logging [ http://technet.microsoft.com/en-us/library/dd335052.aspx ] .
  
• Improved multiple-valued property syntax   Instead of running multiple commands to add and remove values from a single property, you can now add and remove values with a single command. For more information, see Modifying Multivalued Properties [ http://technet.microsoft.com/en-us/library/bb684908.aspx ] .
  

 Exchange Control Panel

Administrators can use the Exchange Control Panel for Outlook Web App to manage some on-premises tasks. The following is a list of the administrative features available:

• Text messaging integration
  
• Voice messaging integration
  
• Multiple mailbox search
  
• Additional proxy addresses for mailboxes
  
• Moderation and approval for distribution list submission
  

In addition, users have self-service capabilities in that they can perform administrative tasks via the Exchange Control Panel. The ECP enables users to perform common tasks without having to call the help desk. This allows your users to be more productive and allows IT staff to deliver more, while reducing support costs.
For more information, see Configure ECP Virtual Directory Properties [ http://technet.microsoft.com/en-us/library/dd876904.aspx ] .

 Mailbox and Recipient Functionality

The following is a list of the new mailbox and recipient functionality that's included or has been changed in Exchange 2010:

• Ability for users to share information, such as calendar free/busy information and contacts with users who reside in a different organization
  
• Improved scheduling and configuring for resource mailbox calendar processing
  
• Ability to move a mailbox while the end user is still accessing it
  
• Additional parameters added to distribution group cmdlets to allow users to create and manage their own distribution groups in Outlook Web App and Exchange 2010
  
• Ability to appoint a moderator to regulate the flow of messages sent to a distribution group
  
• Ability to manage folder-level permissions for all folders within a user's mailbox
  
• Expanded bulk recipient management to allow you to bulk manage recipient properties
  
• Ability to send mail to recipients from the EMC
  

For more information about mailbox and recipient features, see New Mailbox and Recipient Functionality [ http://technet.microsoft.com/en-us/library/dd298027.aspx ] .

 Exchange Web Services Managed API 1.0

The Microsoft Exchange Web Services (EWS) Managed API 1.0 provides a managed interface for developing client applications that use Exchange Web Services. Beginning with Exchange 2007 Service Pack 1 (SP1), the EWS Managed API simplifies the implementation of applications that communicate with Exchange. Built on the Exchange Web Services SOAP protocol and Autodiscover, the EWS Managed API provides a .NET interface to Exchange Web Services that's designed to be easy to learn, use, and maintain.
For more information, see Introducing the Exchange Web Services Managed API 1.0 [ http://go.microsoft.com/fwlink/?LinkId=168445 ] and Microsoft Exchange Web Services Managed API 1.0 [ http://go.microsoft.com/fwlink/?LinkId=168443 ] .

 Client Throttling Functionality to Manage System Performance

Exchange 2010 uses client throttling policies to manage the performance of your Exchange organization. To do this, Exchange tracks the resources that each user consumes and enforces connection bandwidth limits as necessary.
Some of the benefits of client throttling include making sure that:

• Users aren't intentionally or unintentionally taxing the system.
  
• Users of various connectivity methods are proportionally sharing resources.
  

You manage client throttling policies with Shell cmdlets. For more information about client throttling policies, see Understanding Client Throttling Policies [ http://technet.microsoft.com/en-us/library/dd297964.aspx ] .

 Anywhere Access

Enhancements in Exchange 2010 helps users get more done by helping them to access all of their communications—e-mail, voice mail, instant messaging—from virtually any platform, Web-browser, or device through industry standard protocols. Managing the flow of information into and out of an individual’s inbox daily can create overload and affect productivity and profitability. In response to this challenge, Exchange 2010 adds new productivity features that can help users more easily organize and effectively prioritize their communications.

 Unified Messaging Features

The following is a list of new Unified Messaging features included in Exchange 2010:

• Call answering rules
  
• Additional language support included in Outlook Voice Access
  
• Enhancements to name lookup from caller ID
  
• Voice Mail Preview
  
• Message Waiting Indicator
  
• Missed call and voice mail notifications using text messaging
  
• Protected Voice Mail
  
• Incoming fax support
  
• Addressing to groups (personal distribution lists) support
  
• Built-in Unified Messaging administrative roles
  

For more information about Unified Messaging and voice mail features, see New Unified Messaging Functionality and Voice Mail Features [ http://technet.microsoft.com/en-us/library/dd351281.aspx ] .

 Outlook Web App Features

The following is a list of new features in Outlook Web App included in Exchange 2010:

• Favorites in the navigation pane
  
• Search folders
  
• Message filtering
  
• Ability to set categories in the message list
  
• Options in the Web management interface for Outlook Web App
  
• Side-by-side view for calendars
  
• Multiple client language support
  
• Ability to attach messages to messages
  
• Expanded right-click capabilities
  
• Integration with Office Communicator, including presence, chat, and a contact list
  
• Conversation view
  
• Ability to send and receive text messages from Outlook Web App
  
• Outlook Web App mailbox policies
  

For more information about Outlook Web App features, see Understanding Outlook Web App [ http://technet.microsoft.com/en-us/library/aa998629.aspx ] .

 Exchange ActiveSync Features

The following is a list of new Exchange ActiveSync features included in Exchange 2010:

• Conversation grouping of e-mail messages
  
• Ability to synchronize or not synchronize an entire conversation
  
• Synchronization of SMS messages with a user's Exchange mailbox
  
• Support for viewing of message reply status
  
• Support for availability information for contacts
  

 Text Messaging Features

The following is a list of new text messaging features included in Exchange 2010:

• Missed call and voice mail notifications
  
• Calendar and agenda updates
  
• Text messages sent and received through Outlook Web App and Outlook 2010
  
• Text message synchronization with a mobile phone
  

 POP3 and IMAP4 Cross-Site Connectivity Support

Cross-site POP3 and IMAP4 client connectivity is supported by default in Exchange 2010. For more information about POP3 and IMAP4 client connectivity features, see Understanding POP3 and IMAP4 [ http://technet.microsoft.com/en-us/library/bb124107.aspx ] .

 Protection and Compliance

Exchange 2010 delivers new, integrated e-mail archiving and retention functionality, including granular multi-mailbox search and immediate legal hold. Exchange 2010 also helps you to better protect your company’s communications and e-mail through centrally managed information control capabilities. This includes the ability to more effectively intercept, moderate, encrypt, and block e-mail messages. Together, this functionality provides you with a flexible range of protection and control options, whether you want to automatically enforce controls or empower users to implement their own data protection.

 Messaging Policy and Compliance Features

Exchange 2010 compliance features make retention independent of users' mailbox management and filing habits, and ensure retention policies are applied continuously. The following is a list of new messaging and compliance features included in Exchange 2010:

• Additional messaging records management (MRM) functionality to apply message retention policies
  
• Personal Archive feature to provide users with online archive mailboxes and help eliminate .pst files
  
• Mailbox search features for cross-mailbox search with Advanced Query Syntax (AQS) support
  
• Additional transport rules predicates and actions
  

For more information about messaging policy and compliance features, see New Messaging Policy and Compliance Functionality [ http://technet.microsoft.com/en-us/library/dd351165.aspx ] .

 IRM-Protected E-Mail Functionality with Active Directory Rights Management Services

The following is a list of new Information Rights Management (IRM)-protected e-mail functionality with Active Directory Rights Management Services (AD RMS) included in Exchange 2010:

• Microsoft Outlook protection rules, to apply IRM-protection to messages in Outlook 2010
  
• Transport protection rules, to apply IRM protection to messages based on rule conditions
  
• Persistent protection of attachments in IRM-protected messages
  
• Support for AD RMS templates
  
• Support for IRM in Microsoft Office Outlook Web App
  
• Transport decryption, to decrypt IRM-protected messages to apply messaging policies
  
• Journal report decryption, to attach a decrypted copy of IRM-protected messages to journal reports
  
• AD RMS protection for Unified Messaging voice mail messages
  

For more information about IRM features, see Information Rights Management [ http://technet.microsoft.com/en-us/library/dd351035.aspx ] .

FSMO ROLES

This article describes how to transfer Flexible Single Master Operations (FSMO) roles (also known as operations master roles) by using the Active Directory snap-in tools in Microsoft Management Console (MMC) in Windows Server 2003.

Back to the top

FSMO Roles

In a forest, there are at least five FSMO roles that are assigned to one or more domain controllers. The five FSMO roles are:

• Schema Master: The schema master domain controller controls all updates and modifications to the schema. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.
• Domain naming master: The domain naming master domain controller controls the addition or removal of domains in the forest. There can be only one domain naming master in the whole forest.
• Infrastructure Master: The infrastructure is responsible for updating references from objects in its domain to objects in other domains. At any one time, there can be only one domain controller acting as the infrastructure master in each domain.
• Relative ID (RID) Master: The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. At any one time, there can be only one domain controller acting as the RID master in the domain.
• PDC Emulator: The PDC emulator is a domain controller that advertises itself as the primary domain controller (PDC) to workstations, member servers, and domain controllers that are running earlier versions of Windows. For example, if the domain contains computers that are not running Microsoft Windows XP Professional or Microsoft Windows 2000 client software, or if it contains Microsoft Windows NT backup domain controllers, the PDC emulator master acts as a Windows NT PDC. It is also the Domain Master Browser, and it handles password discrepancies. At any one time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest.

You can transfer FSMO roles by using the Ntdsutil.exe command-line utility or by using an MMC snap-in tool. Depending on the FSMO role that you want to transfer, you can use one of the following three MMC snap-in tools:

Active Directory Schema snap-in
Active Directory Domains and Trusts snap-in
Active Directory Users and Computers snap-in

If a computer no longer exists, the role must be seized. To seize a role, use the Ntdsutil.exe utility.

Back to the top

Transfer the Schema Master Role

Use the Active Directory Schema Master snap-in to transfer the schema master role. Before you can use this snap-in, you must register the Schmmgmt.dll file.

Register Schmmgmt.dll

1. Click Start, and then click Run.
2. Type regsvr32 schmmgmt.dll in the Open box, and then click OK.
3. Click OK when you receive the message that the operation succeeded.

Transfer the Schema Master Role

1. Click Start, click Run, type mmc in the Open box, and then click OK.
2. On the File, menu click Add/Remove Snap-in.
3. Click Add.
4. Click Active Directory Schema, click Add, click Close, and then click OK.
5. In the console tree, right-click Active Directory Schema, and then click Change Domain Controller.
6. Click Specify Name, type the name of the domain controller that will be the new role holder, and then click OK.
7. In the console tree, right-click Active Directory Schema, and then click Operations Master.
8. Click Change.
9. Click OK to confirm that you want to transfer the role, and then click Close.

Back to the top

Transfer the Domain Naming Master Role

1. Click Start, point to Administrative Tools, and then click Active Directory Domains and Trusts.
2. Right-click Active Directory Domains and Trusts, and then click Connect to Domain Controller.
   
   NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.
3. Do one of the following:
   • In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.
     
     -or-
   • In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
4. In the console tree, right-click Active Directory Domains and Trusts, and then click Operations Master.
5. Click Change.
6. Click OK to confirm that you want to transfer the role, and then click Close.

Back to the top

Transfer the RID Master, PDC Emulator, and Infrastructure Master Roles

1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Right-click Active Directory Users and Computers, and then click Connect to Domain Controller.
   
   NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.
3. Do one of the following:
   • In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.
     
     -or-
   • In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
4. In the console tree, right-click Active Directory Users and Computers, point to All Tasks, and then click Operations Master.
5. Click the appropriate tab for the role that you want to transfer (RID, PDC, or Infrastructure), and then click Change.
6. Click OK to confirm that you want to transfer the role, and then click Close.

UNDERSTANDING DIRECT PUSH IN EXCHANGE 2010

Direct Push is a feature that's built into Microsoft Exchange Server 2010. Direct Push keeps a mobile phone current over a cellular network connection. It provides notification to the mobile phone when new content is ready to be synchronized to the mobile phone.

 Overview

For Direct Push to work, the mobile phone or other mobile device must be Direct Push capable. These devices include the following:

• Mobile phones that have Windows Mobile 5.0 with the Messaging and Security Feature Pack (MSFP) or a later version of Windows Mobile.
• Mobile phones that are produced by Microsoft Exchange ActiveSync licensees and are designed specifically to be Direct Push compatible.

By default, Direct Push is enabled in Exchange 2010. Mobile phones that support Direct Push issue a long-lived HTTPS request to the server running Microsoft Exchange. The Exchange server monitors activity on the user's mailbox and sends a response to the device if there are any changes, such as new or changed e-mail messages or calendar or contact items. If changes occur within the lifespan of the HTTPS request, the Exchange server issues a response to the device that states that changes have occurred and the device should initiate synchronization with the Exchange server. The device then issues this request to the server. When synchronization is complete, a new long-lived HTTPS request is generated to start the process again. This guarantees that e-mail, calendar, contact, and task items are delivered quickly to the mobile phone, and the device is always synchronized with the Exchange server.

 Direct Push Topology

The following figure shows a typical Exchange 2010 topology that's configured for Direct Push. This figure assumes you have the Client Access and Mailbox server roles installed on two separate Exchange computers. You can also install both server roles on the same physical Exchange 2010 computer.

Direct Push network design

Direct Push operates in the following way:

1. A mobile phone that's configured to synchronize with an Exchange 2010 server issues an HTTPS request to the server. This request is known as a PING. The request tells the server to notify the device if any items change in any folder that's configured to synchronize in the next 15 minutes. Otherwise, the server should return an HTTP 200 OK message. The mobile phone then stands by. The 15-minute time span is known as a heartbeat interval.
2. If no items change in 15 minutes, the server returns a response of HTTP 200 OK. The mobile phone receives this response, resumes activity (known as waking up), and issues its request again. This restarts the process.
3. If any items change or new items are received within the 15-minute heartbeat interval, the server sends a response that informs the mobile phone that there's a new or changed item and provides the name of the folder in which the new or changed item resides. After the mobile phone receives this response, it issues a synchronization request for the folder that has the new or changed items. When synchronization is complete, the mobile phone issues a new PING request and the whole process starts over.

Direct Push depends on network conditions that support a long-standing HTTPS request. If the carrier network for the mobile phone or the firewall doesn't support long-standing HTTPS requests, the HTTPS request is stopped. The following steps describe how Direct Push operates when a mobile phone's carrier network has a time-out value of 13 minutes:

1. A mobile phone issues an HTTPS request to the server. The request tells the server to notify the device if any items change in any folder that is configured to synchronize in the next 15 minutes. Otherwise, the server should return an HTTP 200 OK message. The mobile phone then stands by.
2. If the server does not respond after 15 minutes, the mobile phone wakes up and concludes that the connection to the server was timed out by the network. The device reissues the HTTPS request, but this time it uses a heartbeat interval of 8 minutes.
3. After 8 minutes, the server sends an HTTP 200 OK message. The device then tries to gain a longer connection by issuing a new HTTPS request to the server that has a heartbeat interval of 12 minutes.
4. After 4 minutes, a new e-mail message is received and the server responds by sending an HTTPS request that tells the device to synchronize. The device synchronizes and reissues the HTTPS request that has a heartbeat of 12 minutes.
5. After 12 minutes, if there are no new or changed items, the server responds by sending an HTTP 200 OK message. The device wakes up and concludes that network conditions support a heartbeat interval of 12 minutes. The device then tries to gain a longer connection by reissuing an HTTPS request that has a heartbeat interval of 16 minutes.
6. After 16 minutes, no response is received from the server. The device wakes up and concludes that network conditions cannot support a heartbeat interval of 16 minutes. Because this failure occurred directly after the device tried to increase the heartbeat interval, it concludes that the heartbeat interval has reached its maximum limit. The device then issues an HTTPS request that has a heartbeat interval of 12 minutes because this was the last successful heartbeat interval.

The mobile phone tries to use the longest heartbeat interval the network supports. This extends battery life on the device and reduces how much data is transferred over the network. Mobile carriers can specify a maximum, minimum, and initial heartbeat value in the registry settings for the mobile phone.

 Configuring Direct Push to Work Through Your Firewall

For Direct Push to work through your firewall, you must open TCP port 443. This port is required for Secure Sockets Layer (SSL) and must be opened between the Internet and the Client Access server.

In addition to opening ports on your firewall, for optimal Direct Push performance, you should increase the time-out value on your firewall from the default of 15 minutes to 30 minutes. The maximum length of the HTTPS request is determined by the following settings:

• The maximum time-out value that's set on the firewalls that control the traffic from the Internet to the Client Access server
• The Firewall time-out values that are set by the mobile service provider