Outlook Sync Issues

Synchronization issues are something that seem to plague any Exchange Admin. They come up for no reason, and go away for no reason. There have been a number of posts on the issue over the years, most telling MS to go fix their issues.

One particular issue that I've seen recently is when moving a database from one Exchange 2010 DAG Member to another, the Sync Issues folder starts filling up with the following Synchronization Log messages:

7:57:57 Synchronizer Version 15.0.4701

7:57:57 Synchronizing Mailbox 'User Name'

7:57:57 Synchronizing Hierarchy

7:57:58 Synchronizing server changes in folder 'Inbox'

7:57:58 Downloading from server 'Client-Access-Server'

7:57:58    1 item(s) added to offline folder

7:57:58 Error synchronizing folder

7:57:58                   [8004010F-501-8004010F-0]

7:57:58                   The client operation failed.

7:57:58                   Microsoft Exchange Information Store

7:57:58                   For more information on this failure, click the URL below:

7:57:58                   http://www.microsoft.com/support/prodredirect/outlook2000_us.asp?err=8004010f-501-8004010f-0

7:57:58 Canceled

Checking all the normal locations, there is nothing wrong with the synchronization, yet every 5 minutes Outlook reports an error synchronizing. The above example is with Outlook 2013 on Exchange 2010 SP3 RU6, but I've seen it through several Service Packs and Rollups. The issue also shows up on Outlook 2010.

Looking through all the settings on the Exchange DAG Members, and the Client Access Server in use (which doesn't change during the failover), there is nothing out of the ordinary that might keep it from syncing.

If I find a solution to this particular issue, I'll post it back here for posterity. Until then, this is merely another "Microsoft, please fix you're sync problems" blog.

------
Dustin Shaw
VCP

Brother ControlCenter4 Scanning Permissions

Brother ControlCenter4 Scanning to File requires certain permissions to write files to the folder. These permissions use the current logged in user permissions. To test that the write permissions are accessible, ControlCenter4 appears to write a .tmp file and create a temp folder. I say appears because I have not found any documentation on the subject.

I ran across these required permissions because a scanner I support was trying to write to a network share that allowed Full Access MINUS the ability to create folders. Without the ability to create folders, it would drop a .tmp file in the folder on scan, and pop up an Unable to write the file to "Destination Folder". error like the below:

Once I assigned the user the ability to create folders in this directory (only), ControlCenter4 was able to scan properly.

------
Dustin Shaw
VCP

Install ElasticSearch 1.3 on CentOS 6 for Graylog2 1.0

Graylog2 1.0 requires ElasticSearch 1.3 (or up). To fulfill this requirement, you will need to install ElasticSearch - I recommend on a separate server for environment growth. IOPS on your hard disk matters here.


First, make sure your CentOS 6 is fully patched:
#yum update


Then install Java 1.7:
#yum install java
Make sure that it prompts you to install Java 1.7 (look for the below text):
Installing:
 java-1.7.0-openjdk


Set up the ElasticSearch Repositories and install Elasticsearch 1.3:


Import they key:
#rpm --import https://packages.elasticsearch.org/GPG-KEY-elasticsearch


Create a new repository file in /etc/yum.repos.d/ named elasticsearch.repo with the following contents:
[elasticsearch-1.3]
name=Elasticsearch repository for 1.3.x packages
baseurl=http://packages.elasticsearch.org/elasticsearch/1.3/centos
gpgcheck=1
gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch
enabled=1


Install ElasticSearch:
#yum install elasticsearch


Add ElasticSearch to boot process:
#chkconfig --add elasticsearch

Stop the elasticsearch service so that we can update the cluster name:
#service elasticsearch stop



Edit the /etc/elasticsearch/elasticsearch.yml file to update your cluster.name variable. Ex:
cluster.name: graylog2_production

Update any additional settings needed and save the file. I recommend updating the path.data and path.logs to custom directories.



Start the elasticsearch service and set it to run on startup:
#service elasticsearch start
#chkconfig elasticsearch on



Check your logs to make sure that it started properly and joined the cluster (if there is an existing one).



For Graylog2, the recommended settings are also to increase the open file limit to at least 64000 as seen in the Configuring and tuning Elasticsearch documentation. I did this by increasing the max number of ulimit open file below.



Edit /etc/sysctl.conf and add the following line at the end:
fs.file-max = 65536



Save the file. Next edit /etc/security/limits.conf and add the following lines:
*               soft    nproc           65535
*               hard    nproc           65535
*               soft    nofile          65535
*               hard    nofile          65535



Save the file and restart the server.
#shutdown -r now



Once restarted, verify that the max open file ulimit has been increased.
# ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 30507
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 65535
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 10240
cpu time               (seconds, -t) unlimited
max user processes              (-u) 65535
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited



Additional recommended settings are to increase the ES_HEAP_SIZE. I did this by editing /etc/init.d/elasticsearch and adding the following line after checkJava under start():
ES_HEAP_SIZE=2g



They recommend that you leave 50% of your memory for other system functions, and I had 4 Gig of RAM, hence the 2g setting.



------
Dustin Shaw
VCP

Deploying vCOPS 5.x in vSphere Essentials Plus

VMware vCenter Operations Manager 5.x has a requirement for DRS (Distributed Resource Schedule) to be able to be deployed in a cluster - this is because it is deployed as a vApp, and vApps require DRS.

If you are attempting to install vCOPS on vSphere Essentials, Essentials Plus, or Standard, you will discover that you don't have license for DRS. VMware released this article as the resolution to the problem. Here are the steps that they detailed:

---

To deploy vCenter Operations Manager in a vCenter Server environment with an Essentials Plus or Standard cluster of three ESX hosts:

1. Remove one of the ESX hosts from the cluster so that it resides directly under the parent datacenter.
2. On that ESX host, deploy the vCenter Operations Manager vApp, specifying static IP addresses.
3. Power on the vApp before moving the host back into the cluser to ensure IP settings are picked up.
4. License the solution in vCenter.
5. Move the ESX host with vCenter Operations back into the cluster.

Note: Static IP addresses are required.

Warning: The steps above dissolve the vApp container and an error is displayed. Disregard the error message and continue moving the host into the cluster.

Moving the ESX host with the vCenter Operations vApp back into the cluster results in the addition of the two virtual machines (the UI virtual machine and the Analytics virtual machine) to the cluster, without the vApp container. vCenter Operations Manager 5.x continues to function normally when this happens.
---

Also, in case you need it, the default logins for vCOPS are:
Default Administration:
admin
admin

Default Root Login:
root
vmware

------
Dustin Shaw
VCP

User exceeded the maximum of 250 objects of type "objtMessage".

I have users that are regularly exceeding 250 objtMessage objects in Exchange 2010. What this really means is that the user has over 250 Messages open at once. While this seems high, when you consider third party tools and other such things, 250 is really not that much. I actually have a couple of users that regularly spike over 500 on a daily basis.

Whenever this behavior exhibits itself, it's in the form of ERROR in the Application log with EventID 9646. The text reads:

Mapi session "64807ed0-b1b3-4938-92e3-b9dbd9cfe67b: /o=Company/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=User Name" exceeded the maximum of 250 objects of type "objtMessage".

The default setting for this (and other open item limits in Exchange 2010) is detailed in Microsoft's Exchange Store Limits article.

To change from the default settings, open the registry on your Mailbox Server, and navigate to the following key:
HKLM\SYSTEM\ConcurrentControlSet\services\MSExchangeIS\ParametersSystem\MaxObjsPerMapiSession

Update/create the DWORD named objtMessage and give it the decimal value that you need (up it to 500).

Don't forget if you are in a DAG to repeat the registry entries on all Mailbox Servers.

------
Dustin Shaw
VCP

The symbolic link cannot be followed

When you setup symbolic links on a server that point to another server, you will by default run into the inability for a client computer to follow the links with the following error:


The symbolic link cannot be followed because its type is disabled.

This is because the ability to traverse from one remote system to another across the symbolic link is disabled by default. You can see what is disabled and what is enabled on a computer by running the fsutil command:

>fsutil behavior query eymlinkevaluation
Local to local symbolic links are enabled.
Local to remote symbolic links are enabled.
Remote to local symbolic links are disabled.
Remote to remote symbolic links are disabled.

You have two methods to enable this - enable it locally on each machine, or enable it via Group Policy.

Local

The downsides to enabling it locally are obvious, but sometimes you just need it on one stubborn computer *right now* and can't wait for GP. To enable Remote to Remote symbolic links, run the following command:
fsutil behavior set symlinkevaluation R2R:1

Similarly, you can change the settings for Local to Local (L2L), Local to Remote (L2R), and Remote to Local (R2L) by using 1 for enabled and 0 for disabled.

Group Policy

To enable (or disable) Remote to Remote symbolic links in Group Policy, create a new GPO Policy (or edit a current one), and edit it. Navigate to:
Computer Configuration -> Administrative Templates -> System -> Filesystem
You can then set the settings how you want in Selectively allow the evaluation of a symbolic link

Once you've created your new GPO, test it and validate that it is successfully applied using gpresult /R and rsop.

How to use Group Policy to allow the users to chose any screensaver except (None)

I just found one of the most beautiful Group Policies that I've ever come across:

How to use Group Policy to allow the users to chose any screensaver except (None)

This post is from Group Policy Central, and is 4 years old, but I've verified that it works properly with Windows 7 and 8, and is just a beautifully done Group Policy. Thanks Kevin for creating it and thank Alan for sharing.

The below is excerpts from the posting:

Step 1. Edit a Group Policy Object (GPO) that is targeted to the users accounts you wan to apply this policy
Step 2. Navigate to User Configuration > Preferences > Windows Settings > Registry then from the menu click on Action > New > Registry Item

Step 3. Select “Update” from the Action then type “Control Panel\Desktop” in the Key Path: text field then type “SCRNSAVE.EXE”  in the Value Name text field and “C:\Windows\System32\scrnsave.scr” in the Value data: text field.

Step 4. Click on the Common tab and then tick “Item-level targeting” and then click the “Targeting…” button.

Now we will target the screen saver to apply only when the “HKCU\Control Panel\Desktop\SCRNSAVE.EXE” registry key does NOT exist as this means the screen saver has been configured to “(None)”.
Step 5. Click on “New Item” then the “Registry Match” option.

Step 6. Select the “Value exists” Match type” then type “Control Panel\Desktop” in the key path field and then type “SCRNSAVE.EXE” in the value name field

Step 7. Click back on the targeting setting in the top pane and press “F8” which changes the option to “does not exist” then click OK and OK.

This policy will now apply the blank screen saver on the next group policy refresh to all targeted users whenever they select the “(None)”.