Remote Routing Address Woes - A Hybrid Exchange Problem

So you have to have the Hybrid Exchange. You are better off with either all in, or all out, but Hybrid is an option. There are some problems with Hybrid and that's when you get the Remote Routing Address wrong. How do you change it?

You create a user in the On Premises Active Directory, and then you let it sync to the cloud. You set up your licensing and then you run Enable-RemoteMailbox which includes the -RemoteRoutingAddress option. Of course, if you get it wrong...

Exchange Online will not let you change it. Exchange On Premises refuses to recognize the option in Set-RemoteMailbox. So... you now have to delete the RemoteMailbax, which in turn deletes the user account, you have to... 

Well, no. See, the value is stored in AD under the value targetAddress. Change this and your problems are over.

Added a lot of users in one go? Have a lot to change? No fear:

Create a CSV file with two headings: email, remote

Under email add "userprincipalname=username@domain" This is your filter.

Under remote add "SMTP:username@domain.onmicrosoft.com" being the correct remote routing address in the correct format for the targetAddress value. Now, turn to powershell (run as administrator, of course):

Import-Module ActiveDirectory

new-psdrive -PSProvider activedirectory -Name Users -Root "AD:\OU=Users,DC=domain,DC=com"

Set-Location Users:

$users = import-csv c:\temp\users.csv

foreach ($user in $users) {

write-host $user.email

Set-ItemProperty -filter $user.email -path * -Name targetAddress -Value $user.remote

}

The write-host line is for comfort only. The Set-ItemProperty does not report back when run in a script.

When does Appendable not mean Appendable?

When you use Append Infinite in Backup Exec 2014...

When a media set is set to Append Infinite the media automatically becomes un-appendable. The work around is to apply a limited append period to the media set and your media becomes writeable for append jobs once more.

Remember also: Only the first tape in a media set can be appendable. If the job runs over to a second tape it will only try to overwrite it, not append to it.

Displaying C# Dialogs in the 64bit SCCM Task Sequence

Task Sequence Variables are a powerful tool when deploying new Operating Systems with Task Sequences in System Center 2012 R2. With a Task Sequence Variable, stored on a collection, you can reduce the number of Task Sequences you maintain. Each action or group of actions can be executed based on what the content of a Task Sequence Variable is.

The next logical step to using Task Sequence Variables for existing systems is to use them for unknown computers. For that you need a user dialog box to appear at the start of the Task Sequence to allow the person building the new PC to select what options to include in the build. You might want to be very specific about the drivers you install, for example.

For a Task Sequence with a 32bit boot image Psexec.exe is perfect for launching a dialog in Session 0. Without the option to do this the dialog does not appear. The application will run but it cannot display a GUI without having been launched in the same session at the Task Sequence.

However, 32bit is a bit old in the tooth. Most sensible people are now switching to 64bit operating systems. Psexec.exe however is a purely 32bit application that will not run on a 64bit WinPE image because WinPE does not support Windows on Windows (WOW64.) There are instructions on Technet Blogs about how to write your own application, which you then have to go search out each step of the way.

I did this and found the path a bit harrowing. It's not for the feint hearted but it's doable. I managed to write it first time. To make the application specific to Task Sequences (and not exploitable for other uses) it is written in such a way that it is tied to the task sequence process and will otherwise fail. If you like you can download it from here.

To use it, add it and the dialog executable to a package. In the task sequence use a "Run Command Line" option. Specify the package and for the command-line use tslaunch.exe

This was built for .Net 4.5.1 and works with the Window 8.1 64bit WinPE image (6.3.9600.16384)

If you would like the source code, please contact me on Google+ and I'd be happy to oblige.

Upgrade to VMWare VI 5.5 going wrong?

When upgrading to VI 5.5 all seemed to go fine, until Virtual Machines started failing to vMotion. Failing at 13% with the wonderfully clear and helpful explanation: "a general system error occurred: invalid argument"

Further to that, our Veeam installation was failing to replicate and backup with the following errors:

Error: Client error: NFC storage connection is unavailable. Storage: [stg:datastore-446,nfchost:host-6879,conn:]. Storage display name: []. Failed to create NFC download stream. NFC path: [nfc://conn:,nfchost:host-6879,stg:datastore-446@/.vmx]. 

A similar error was produced if you tried to browse the datastores and download a file from them.

None of the solutions on Veaam or VMWare helped. 

The only solution was to rebuild the Host from scratch using a 5.5 image. Of course, without vMotion live VMs cannot be migrated. But rather than shutting down and cold migrating all the VMs, just suspend them. It's only Live Migration using vMotion that fails. VMs are then only down for ~30 seconds if you are quick.

Xubuntu 12.10 on VMware Desktop Crash

Using Xubuntu (server edition) as a CUPS print server serving AirPrint clients seemed like a good idea and, on the whole has worked out to a fair degree of success. We did have one problem that could have been a show stopper.

When logging out of the X session, the lightdm login manager would crash without recovery. The same thing happens if you try to change the desktop resolution from its initial cramped 800x600 workspace. These days, anything smaller than 1024x768 feels like the dark ages.

The solution? Create your own config. Now X used to create xorg.conf files based on user input. These days X does everything on the fly based on auto-detect. The xorg.conf is therefore defunct and on its way out the door. You can always try to run X -configure (remembering to shutdown your existing xwindows session) but you might run into the same problem as us, where the configure script runs into problems and panics, leaving you without a configurable script.

That is not the end of the World. The brave new world of the modern X server now uses additional files that it finds in the /usr/share/X11/xorg.conf.d directory. These additions are added to the auto-config on startup and prove to be very useful in stabilising what might end up being an unstable configuration.

We are running VMware 5.1. The VM does not have 3D graphics enabled. We created a file in said directory called 10-monitor.conf and added the following information:

Section "Monitor"
    Identifier    "Monitor0"
    HorizSync 1.0 - 10000.0
    VertRefresh 1.0 - 10000.0
EndSection
Section "Device"
    Identifier    "Device0"
    Driver        "vmware"
EndSection
Section "Screen"
    Identifier    "Screen0" 
    Device        "Device0"
    Monitor       "Monitor0"
    DefaultDepth  24 #Choose the depth (16||24)
    SubSection "Display"
        Viewport 0 0
        Depth       24
        Modes     "1024x768"
    EndSubSection
EndSection

Save the file and log out. Now the login manager displays at 1024x768 and after logging in, changing the resolution to 1024x768 no longer produces the hang and crash scenario.

RPC over HTTP with Apache's mod_proxy

Well, let us get the bad news over and done with. Unless you revert to 2.0.53 or earlier, you can forget proxying RPC over HTTP with Apache web server.

Why is this?

Apache prefetches the entire body before establishing a connection. This mitigates a serious smuggling exploit that is detailed here: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2088

Microsoft's idiosyncratic implementation of RPC over HTTP establishes two connections, RPC_DATA_IN and RPC_DATA_OUT, in order to send data between the Outlook Client and the Exchange Server, or between the Remote Desktop Client and Desktop Gateway. The problem is that the client sends a minuscule amount of data over the RPC_DATA_IN connection, somewhere in the region of 100 bytes. This is not enough to trigger a connection in the Apache implementation of HTTP/1.1

While not strictly forbidden in the RFC, it does mean that allowing the connection creates an insecure environment. Consequently no amount of begging is going to make Apache developers change their minds. To make matters worse, Microsoft in their protocol publication, have applied their right to enforce patents on the use of their protocol. Game over.

So if you are looking for RPC over HTTP, you will have to stay with Microsoft, who, in their infinite wisdom, have apparently ditched their very successful ISA/TMG product without a replacement. Either that or not use Microsoft products in future. We may well tell our users that Outlook Anywhere is no longer an option rather than punch holes in our firewalls to allow what is by design an insecure protocol.

Building Apache 2.4.4 from the Unix source with Openssl, zlib, libxml2, ipv6 support on Windows with Visual Studio 2012 to x86 binaries

Why would I want to even think about it? Well, because all the binaries compiled for windows have IPv6 disabled by default and the only way to enable it is to compile it yourself. Now I have to warn you, it took me well over a week to figure out what was going on and had endless failures. This procedure that follows is likely to test your patience, however, the result is a working Apache httpd running on Windows Server 2012.

That is, one that has been compiled from the original sources, and not one that has been added to by Bob down the road who has slipped in his own datalogger, if you know what I mean...

The main requirements are: Visual Studio 2012, the Platform latest SDK, perl and awk in the environment path, and CMake. Next...

Download it all

Download the latest version of apache source and unpack (Unix sources suffice) into a httpdxx root directory. All the following packages will end up in the srclib directory.
Download latest version of openssl source and unpack in to sub directory srclib\openssl
Download latest version of zlib source and unpack into in to subdirectory srclib\zlib
Download latest pcre source
Download the expat binaries compiled for windows and put into srclib\win32\bin\release
Download the prceombiled binaries and the dev packages for libiconv and copy into srclib\libiconv
Download the source for libxml2 and place into srclib\libxml

Build pcre

Unzip source into a seperate directory from your httpdxx directory. Add a build subirectory as a destination for your CMake build. Use CMake to create a solution for native Visual C 11 with the following options:
• BUILD_SHARED_LIBS Yes
• CMAKE_INSTALL_PREFIX (your httpdxx\srclib\pcre folder)
• PCRE_SUPPORT_UTF
Open the solution in Visual Studio and change to Release. Check the project to make sure that PDB’s are created. Compile the BUILDALL project. If all compiles, build the INSTALL project. Make sure the binaries end up in the same place.
Copy the pcre.dll and pcre.pdb into the srclib\pcre (needed because of badly written includes and this was the easiest option.)

Build zlib

Open your Visual Studio Dev Environment command line and cd to httpdxx\srclib\zlib
open VS Command Prompt and navigate to srrclib\zlib. build using:
nmake /f win32\Makefile.msc
nmake /f win32\Makefile.msc test

Build Openssl

cd to httpdxx\srclib\openssl
perl Configure VC-WIN32 enable-camellia no-idea no-rc5
(You do not really want zlib compiled into openssl do you? I’m shocked. Really!)
ms\do_ms.bat
nmake -f ms\ntdll.mak
Create an empty file store.h in srclib\openssl\inc32\openssl or OpenSSL will fail to build into the rest of the projects.

Prepare httpd

Update srclib\apr\include\apr.hw and change: (default is 0) This enables IPv6
#define APR_HAVE_IPV6           1
Run the following from the root of the httpd source to deal with UNIX line endings and prepared the projects for use with .net compilers:
>Perl .\srclib\apr\build\lineends.pl
>Perl .\srclib\apr\build\cvtdsp.pl -2005
Now open Visual Studio and open the Apache.dsw workspace file. It will convert the file to a Apache.sln and convert all the projects to .vcxproj.
Change properties of libhttpd:
Configuration Properties -> Linker -> General -> Additional Library Directories add .\srclib\pcre\lib (Location of pcre.lib)
Configuration Properties -> C/C++ -> General -> Additional Include Directories add ./srclib/pcre/include (location of pcre.h)
Open ApacheMonitor.rc and comment out the following line with a #:
"CREATEPROCESS_MANIFEST_RESOURCE_IF RT_MANIFEST "ApacheMonitor.manifest""
Change the Properties of ApacheMonitor:
Configuration Properties -> C/C++ -> Manifest Tool -> Input and Output -> Additional Manifest Files. Add ApacheMonitor.manifest
Change the properties of Mod_xml2enc
Configuration Properties -> C/C++ -> General -> Additional Include Directories add ./srclib/apr-iconv/lib

Build Libxml2

The Libxml2 source contains a folder called win32\VC10. Add the libxml2.vcxproj to your Apache solution. Change the properties of the libxml2 project. (You may need to upgrade the project first by going to Project -> Upgrade Projects.)
Configuration Properties -> General
-Configuration Type Dynamic Library (.dll)
Configuration Properties -> C/C++ -> All Options
-Enable Function-Level Linking: No
-Enable Instrisic Function: No
-Output Directory ..\Release (Or it will go into the httpd\Release folder. Not a good idea. You will need to create a win32\Release folder)
Configuration Properties -> Linker -> All Options
-Output File: ../Release/libxml2.dll
-Additional Library Directories: ../../../libiconv/lib;../../../libiconv/bin
-SubSystem: Windows
-Additional Dependencies: libiconv.lib;libcharset.lib;ws2_32.lib;mswsock.lib;
-Link Time Code Generation: Default
-Generate Debug Info: Yes
Modify mod_proy_html and mo_xml2enc. These two projects need Lib2xml.
Configuration Properties -> C/C++ -> All Options
-Additional Include Directories: ../../include;../../srclib/apr/include;../../srclib/libiconv/include;../../srclib/apr-iconv/include;../../srclib/apr-util/include;../../srclib/libxml2/include;
Configuration Properties -> Linker -> All Options
-Additional Library Directories: ../../srclib/libxml2/win32/Release;../../srclib/libiconv/lib;../../srclib/libxml2/win32/bin.msvc;
-Additional Depdencies: (Add) ws2_32.lib;mswsock.lib;

Build Apache

Go to Solution Congifuration. Change to Release and remove the build tick from the following projects:
• all projects beginning apr_db
• BuildAll
• BuildBin
• Fcgistarter
• gen_test_char
• InstallBin
• Libarpiconv_ccs_modules
• Libarpiconv_ces_modules
• Mod_lbmethod_rr
• Mod_lua
• Mod_session_crypto
• Mod_socache_dc
Build the Solution. This should allow everything to build successfully. There may well be something I have missed. Believe me, it is possible to fix it! I did.
Open your Visual Studio Dev Environment command line.
>Cd \htppdxx\srclib\apr-iconv\ces
Use NMake to create a batch file from the MakeFile instructions:
>NMAKE /nologo /f Makefile.win BUILD_MODE="Win32 Release" BIND_MODE=shared /N /U >>make.bat
Edit the make.bat file to remove all the leading tabs and remove all of " /Yuinconv.h " This stops the building of components using precompiled headers, otherwise you get an external reference error.
Run the batch file to compile these, do NOT compile them in Visual Studio.
Do the same in the ccs directory.
Amend Makefile.win. Find the section list below and add the line in bold:
!IF EXIST("srclib\libxml2")
 copy srclib\libxml2\win32\$(LONG)\libxml2.$(src_dll) "$(inst_dll)" <.y 
 copy modules\filters\$(LONG)\mod_proxy_html.$(src_so)  "$(inst_so)" <.y
 copy modules\filters\$(LONG)\mod_xml2enc.$(src_so)  "$(inst_so)" <.y
Save MakeFile.win.
Finally go to the root of the source directory and run the install script to pull out all the compiled files into an installation directory (in my case D:\Apache24)
>cd \httpdxx
>nmake -f makefile.win INSTDIR=D:\apache24 SHORT=R LONG=Release _install

Strip the Binaries

You now have about 86MB of Apache Server. You can make that a lot lighter by doing the following.
Remove all the debug information (i.e. del /S /Q *.pdb)
Delete the Manual Directory (That why Google was invented)
Delete the Include and Lib directories (Unless you are going to do some development work using this set of binaries.)
You should now have about 8MB of web server.

Install on Server 2008 R2/2012

Install the Visual C redistributable (You will need the 2012 version, of course)
Copy your cut down binaries to your chosen location on your server.
From a (elevated) Command Prompt, navigate to bin directory and run:
httpd.exe –k install (installs as a service and starts…)
Configure Server using the configuration files
Now – I cheated – of sorts. In order to get an initially working conf file, I installed apache using the MSI and ran through the initial configuration. When I then compiled my own version of apache, I used the same working configuration file and amended it from there.

Configuration Gotchas

SSLPassPhraseDialog The default setting (builtin) does not work on windows so you need to point to a pass phrase programme. I used Notepad.exe. I removed the pass phrases from my passwords (Just Google “retrieving a key and certificate from a PFX file.” Very effective)
SSLSessionCache This requires a path not broken by spaces. If you have installed to the default location (as with the msi installed provided by apache) then you’re not quite stuck, but it feels it. Create a shortcut in the root of the c drive that points to your apache directory. Then use shmcb:C:\Apache\etc…

And that is it. As I have said, I have probably missed some things out here, but I do have a working solution, so it is possible, if akin to having your fingernail being pulled out.

This year's IPv6 Roadblock

Are you wondering why most companies are not looking at IPv6? Why is adoption so slow?

The answer may be Web Filtering!!!

Go back 5 years and the blocks to IPv6 adoption were multiple. Device compatibility, especially firewalls and switching, applications. Even Active Directory in its 2003 form could not support IPv6.

That is all past. Today, lack of IPv6 support is a warning sign that the company you are purchasing from is lazy on the development front. Consequently, such companies are on a slow downward trend. Watch carefully and you'll see them disappear or bought out. Except for Web Filtering.

Most filtering companies are still on the edge of the cliff, gathering together for warmth and seeing who is going to jump in first. Well guess what, no one with any mind for web security (which is just about every minor organisation with the financial oomph to purchase such a package) is going to go IPv6 for web browsing until filtering is in place. Companies that look into IPv6 adoption don't jump and then look how they are going to do things, they want the whole project plan down first. So when they get to the final step and find that they cannot cross it, the whole project fails.

So it is not that companies are not looking for IPv6 filtering, they are just waiting for Web Filtering companies to get on board. Guess what, Web filtering companies are waiting for firms to tell them they want it. That is not going to happen! So if any web filtering company is reading this, want to get ahead of the competition in this tough season, IPv6 is your boost. Get in first and you may give yourself that needed lift to not only survive the current financial crisis, but to come out fighting.

Exchange 2010 UM and WMF 3.0

Windows Management Framework 3.0 is about to be rolled out over Windows Update. Do you know what will break? I do! Exchange 2010 Unified Messaging. Specifically the part which uploads media files to the server for use in the Auto Attendants. When you try to do this you will get a WinRM error:

Starting a command on remote server failed with the following error message : The WinRM client sent a request to the remote WS-Management service and was notified that the request size exceeded the configured MaxEnvelopeSize quota. For more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OperationStopped: (um01.westminster.org.uk:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : JobFailure
    + PSComputerName        : um01.westminster.org.uk

This is the PowerShell version of the error. The EMC will weakly complain that it has been given the above message with roughly the same text. Can you live without the ability to upload message to Exchange? I thought not.

Trust me, the about_Remote_Troubleshooting Help topic will not help you with this one. Changing the WinRM MaxEnvelopeSizekb value will not make a difference. The release notes point out that this has been change to 700. You can find out what WinRM config is set to by opening an elevated command prompt and typing 'winrm g winrm/config' to display the current config.

But WinRM/config is not the only place that MaxEnvelopeSize is specified! (See http://msdn.microsoft.com/en-us/library/windows/desktop/ee309364(v=vs.85).aspx) Hosted applications (such as Exchange PowerShell) also have their own configuration in IIS. This is typically in the system.management.wsmanagement.config xml portion of the web.config. Exchange PowerShell module has it's own virtual directory in IIS and it is here that you will need to make an amendment in order to restore functionality back to UM.

Find the web.config associated with the PowerShell IIS Virtual Directory. Found usually in the \Client Access\PowerShell directory. Make a backup. Amend the OperationsConfiguration node to add the MaxEnvelopeSizeKB="700" setting. Replace 700 with whatever MaxEnvelopeSizekb is in WinRM. (You've probably been trying to amend the value like I did and sinking into despair when it makes little difference. Go on. Admit it.) Mine now looks like this:

 
   
      ...
      <operationsconfiguration MaxEnvelopeSizeKB="700" ... >
</operationsconfiguration><
...
      ...


Reset IIS and the error should be gone. There are, of course, other issues with WMF that are detailed elsewhere. The most significant is the fact that WinRM IIS Extensions for me needed re-installing after WMF was installed, but that is well documented elsewhere.
As an additional warning, if you want to run update rollups, you will need to uninstall WMF 3.0 first before installing the rollup, and then reinstalling WMF.

Getting SQL 2008 R2 Reporting Server working with System Center 2012 Configuration Manager

When you upgraded to System Center 2012, you discovered that in order to get reports from Configuration Manager, you now absolutely need to get Configuration Manager working with SQL Reporting Services. You follow the instructions provided by Microsoft and then you hit the train wreck!!!

Error 7403 - The report server service is not running on Reporting Service Point server "MySMS.domain.org.uk"; start the service to enable reporting.

Nothing out there seems to fix the problem. I have discovered that there are a number of problems that cause this error, hence the one or two 'fixes' out there are all red herrings. There are, of course, clues. I followed them and have come to the following solution to the problem.

What's the problem?
The problem occurs mainly when you have the SQL Server, the SQL Reporting Services on the same server as the Management Point. This means also that IIS is installed. That is not a problem, mind you. Reporting Services does work happily with IIS, but as you will see, there are caveats. After following all the installation you find that SMS_SRS_REPORTING_POINT under Component Status, has a Red X instead of a Green Tick. List the error events you get a repeated performance from Error 4703. It is also possible that if you go to Reporting Service Configuration Manager, you can sometimes get the ReportServer website to come up, and sometimes not, but only on HTTP, and not on HTTPS. You also see no reports and any attempt to create a report brings up AUEM (Another Useless Error Message.) Checking the srsrp.log you notice the error: 'The underlying connection was close: Unable to establish a secure connection.'

Problem 1 - The certificate Subject
If you have followed Microsoft's installation plan to the letter you probably have an IIS certificate. The subject on the certificate will be the host name of the Management Point (e.g. 'MySMS'.) This is fine, perfect for Configuration Manager. However, I bet when specify the Site Server, you specify them using their FQDN (e.g. 'MySMS.domain.org.uk'.) Can you guess what I am about to say now? Configuration Manager now cannot connect to SRS because the certificate is invalid! As I said - train wreck!

Solution 1 - The first thing you need to do is uninstall the Reporting Point, as you will need to re-install it later. Get yourself a new certificate from your CA with the FQDN as the subject and a uniquely identifying name (I used "For Report Server") as the subject and install it in the computer's personal certificate store.

Problem 2 - Conflicting Bindings
But it's not a simple as that. Why? Because Reporting Services shares the TCP Port with IIS. IIS needs to be using the SMS IIS Certificate. Despite the fact that you can specify a separate certificate in IIS to that in Reporting Services, they both present their Certificate to the OS to handle. The result is that only one certificate can remain on that particular binding (IP and Port combination.) In the report server log you see 'Failed to register url=https://MySMS.domain.org.uk:443/ReportServer...' etc.

Solution 2 - Change the Binding in Reporting Services Configuration Manager (RSCM.) Now, funny enough guess what? You might have another problem.

Problem 3 - Lingering URLs in Reporting Services
When you change the certificate and binding in RSCM you sometimes find that although you have changed the binding, the original link to 443 remains. If it does, Reporting Services will still fail to bind everything.

Solution 3 - Remove all bindings first and stop the Reporting Services Service. Open \Program Files\Microsoft SQL Server\MSRS10_50.\Reporting Services\ReportServer\rsreportserver.config (remembering to take a backup first!!!) and remove any lingering URL Reservations. You will find them under ... For me it was okay to remove the entirety and leave a behind, if you understand xml. If not, just delete everything in between the individual  and . Restart the Reporting Services Service.

Wrapping it all up
Before you re-configure your bindings in RSCM I would look at netstat first. Using the command line 'netstat -ano -p TCP' list out all the bindings. I did not do this and guess what, I picked another port that was already in use! I would suggest using a custom HTTP port as well as a custom HTTPS port, for the simple reason that you will see it being bound in netstat. It's okay to leave it and share the binding with IIS, but it does mean that you won't see the successful binding.

Okay - you have picked your ports and you go back to RSCM. Go to the "Web Service URL" tab and click on Advanced. Reporting Services automatically picks a host only URL if you enter an IP Address. You don't want this, for sanity's sake. Add the HTTP identity using your custom port (I used 81) and the FQDN for the host header. Add your SSL Binding selecting (All IPv4), add you custom currently unused port (I used 446 - 443 was used by IIS and something else had 445) and select your uniquely named certificate (with the "For Report Server" name.) Do the same for IPv6 (You are using IPv6 - >frown<) and confirm. Do the same for the "Report Manager URL" tab. Now go back to netstat and note that you now have new connections (for me on 81 and 446.)

Great. Now Navigate to your ReportServer url (launch Internet Explorer using 'Run As Administrator')  on SSL and note that you do not get any certificate warnings. Start to feel happy.

Install the Reporting Point once more. You do not have to worry about port numbers, Configuration Manager figures this out. You will need to wait about ten minutes (should be less) and then check your reporting service URL again. Configuration manager will have added a folder. Go to the Monitoring Tab of Configuration Manager and check out the large number of default report that have suddenly appeared. Finally, notice that you now have a green tick next to your SMS_SRS_REPORTING_POINT component status.

Go back to you boss and state to him that you single handly resolved the problem that had been bothering him for the last six months. Brownie points all round!!!

Jelly Bean - Accounts and Sync

Okay - your phone has just been updated to Jelly Bean (Android 4.1) and now your mail is not syncing, even though all your account settings say it should be. When you pull up your settings and go to your individual accounts you see the message 'Sync is OFF.'

Somewhere else in the interface as you search for why this just isn't working you find the message "Go to Settings, Accounts and Sync, etc. etc." but when you look at settings there is no 'Accounts and Sync.' What's going on?

Never fear, and do not buy the app "Accounts and Sync Missing" either; you don't need it. There are two ways to turn Sync on in Jelly Bean:

1. If you have the standard "Power control" widget, the auto-sync is the second option button from the right; the one that looks like two arrows circling each other. Enable that button and Sync is back on.

2. Got to Settings, select Data Usage and hit the menu button: Tick "Auto-sync Data" and it has the same effect.

Go back in to Settings and into your accounts: You should now have green sync icons (and lots of emails.) Oh joy!

System Center 2012 Configuration Manager, 802.1x and Migration

It was interesting going to a Microsoft System Center 2012 launch party and hearing the opinion that wired 802.1x is an old outgoing technology and we should all move to IPSEC. At the same time across town Cisco have 802.1x at the heart of their up and coming ISE product. Anyway, well done to Microsoft for bring the System Center product up to date (to a point!)

My guess is that we will still be hacking away at Microsoft Products in order to enable the smooth running of wired 802.1x. Fortunately, with the ground laid down in my previous posts, there is very little to do different from the latest version of Configuration Manager. if you have not already read those posts, you will need to cover those. This just adds on to the previous offering.

Your prepared boot images will still work with one exception. Microsoft have done something amazingly sensible: They have moved the start up hook from the TSConfig.ini file and into the GUI. To be precise, you no longer have to amend the TSConfig.ini file I referred to in my previous into the boot image before showing it to Configuration Manager. In fact, if you do it will ignore it now. Instead go to the boot image in Configuration Manager and select property. On the Customisation tab tick 'Enable prestart command' and enter your script command here: x:\windows\system32\cscript.exe pretsmboot.vbs.

I have still included the pretsmboot.vbs files in the image because they are needed when you run a task sequence that does not boot from PXE, such as when you run it from the new Software Center. However, you do have the choice of including the files and you also specify this in the same location.



There is a gotcha, of course. If you want to do the same for a CD or USB bootable image, you will need to put those same files into a package. When you create the bootable CD image you will be asked for a package is you want to include file, not just a source directory. But that's not a problem.

Otherwise everything else is the same as before. Of course, we are still talking about Windows 7 here, not Windows 8. That's another hurdle that will be long into the next half of the year before we venture there.

Other Gotchas in System Center 2012 Configuration Manager

• It is entirely possible to import the Operating System Images and driver packages from SCCM 2007. My advice? Don't. Especially the OS images. Don't even think about just copying the same previously captured WIM file. I don't know what the MDT does to images when you capture them, but it creates interesting and varied problems with OSD afterwards. One such problem is the disappearance of the OSD Task Sequence Progress Bar on 64bit builds. Who knows why, it just solves it when you create and capture a new image. Instead create new images captured with the 2012 MDT that is the only version compatible with System Center 2012. This will save you a whole heap of pain.
• I don't know about you, but we are now running totally on 64bit, with any 'I really need 32bit' applications running happily on Application Virtualisation. However, that does not mean you can ditch the 32bit boot image. Oh, no! If you want PXE to work, even if you only server 64bit OS to PCs, you need a 32bit boot image set up to be served by PXE as well as your 64bit version that will be the only image ever used. PXE will not run without a 32bit image. I think it's something like a comforter. PXE has reached that age when no-one really wants it in the room, but seeing it still hasn't written a will, everyone is being nice to it, so really it can do what it likes and no one will scold it. I will be glad when the IPv6 equivalent finally makes an appearance and puts the old man to bed.
• Capture those reboots. The 2012 OSD seems to be a little less robust in handling unexpected reboots. So wherever possible, try to catch those application reboots with a -noreboot flag or similar. The OSD will bomb out if it is hit with an unexpected reboot and it will not recover.

Finally, if you haven't already, introduce some custom task sequence variables. The standard MDT Task Sequence includes such things as "Request State Store" regardless of whether it has actually done a Capture User State or not. You will end up with errors every time you run a task sequence on a new PC. It is a trivial task to clean up this mess by settings a task sequence variable after the Capture User State and referring to that Variable as a condition for the State Store Restore tasks. I don't know about you, but I hate spurious red marks in my logs that I know should not be there. It just makes it look like it's not a clean build when it really is.

Stateless IPv6 with DNS Options

Yes is it possible to have your cake and eat it!

IPv6 brought us stateless auto-configuration. Your routers do the work with router advertisements. This means no more having to configure every new VLAN with a DHCP range, worrying about your exceptions, your statics or router addresses. Now you can even have two routers on the one VLAN and your clients will happily talk to both/either. 

One of the problems to overcome is how to configure DNS while at the same time retaining a stateless IPv6 Addressing scheme. While running Dual Stack, this is not a problem; you will have already done the work in IPv4 and assigned DNS and Suffix Options to your DHCP range. Your IPv4 DNS server settings will happily serve AAAA addresses.

The days of IPv6 only networks are around the corner. They aren't here yet, so you have some time, but you will want to be ready.

First of all you will need a DHCPv6 server. If you are running DHCP on Windows Server 2008 or 2008 R2 this will serve. You need to bind your DHCP to a static IPv6 address on the server. There is a problem with Server 2008. DHCPv6 will not respond if it does not recognise all the options in the forward request. A solution to this can be found on KB Article 972962, and a hotfix is available. You need to set up your server options. I have at least one scope set up in the IPv6 section, although it is not used. You only need to set up a scope for a particular VLAN if you are intending to provide scope options different to that of the server options. As you are not intending to distribute IP addresses from the DHCPv6 server only the Server Options need concern you.

On your router, you need to enable the "other config flag." This flag is an option in the router advertisement package that signals the availability of other configuration options from a DHCPv6 server. This flag is an invitation, not an instruction, the client must act on it. Windows 7 does this. I have not tested other clients. The Cisco IOS interface command for this is:

ipv6 nd other-config-flag

You also then need a DHCP relay on the same interface that points back to the static binding on your DHCPv6 server. It is noted that in the past that our Cisco switches would not relay DHCP messages unless the DHCP server was running on the switch itself. So you may have to configure a DHCP pool on the switch, even if you do not use it. It is noted that on some older switches you can set up an IPv6 DHCP pool, provide the DNS server and domain prefix and user the ipv6 dhcp server command in the interface. This works as good as using the DHCPv6 server on windows. However, my latest routers running IOS-XE probably require an Enterprise Services License to do this. For the cost difference, I'll stick to relaying to a DHCPv6 Windows 2008 server running on VMware. The Cisco IOS interface command for setting up a DHCP relay is:

ipv6 dhcp relay destination [DHCPv6 Static IPv6 Address]

And that's it.

Remember that your clients will pick up the settings at the same time as they configure their IPv6 addresses, not their IPv4 addresses. This means that ipconfig /release and ipconfig /renew will have no effect on picking up these options. Either a restart is needed (preferable) or you can disable/re-enable the interface (or pull the cable out.) It has been noted that the later options can result in an inconsistent routing table on Windows 7, so use with caution.

IE9 Rendering Problems

We have been having problems with IE and some add-ins: notably Flash 11 and Silverlight. The symptoms include having some flash objects not appear at all. Streetview, for example, displayed a blank black panel with some images appearing at the mouse passed over it. For Silverlight, it was Word Web App. Again, a black background with some text occasionally appearing when the mouse rolled over. SharePoint also got a rough time, with permission denied boxes appearing to be totally blank.

We have discovered that the problem is not with Internet Explorer, Silverlight or Flash. In fact it was the Intel Graphics Adaptor incorporated into our otherwise well endowed desktops.

There is a simple work-around for this (if an upgrade to the Graphics Driver) does not fix the problem: Tell Internet Explorer to use the Software Render. Tools -> Internet Options: Advanced Tab: Tick 'Use Software Rendering instead of GPU Rendering'. Done!

Now if, like me, you have around 500 PCs and laptops to look after, you don't want to wander around all 500. Neither do I want to have the pain of having to explain to a range of competencies how to fix this themselves. Instead, I use group policy preferences (under user configuration) Windows Settings, Registry:
Hive: HKCU
Path: Software\Microsoft\Internet Explorer\Mait
Value Name: UseSWRender
Value: 1

Apply this to all your affected users and enjoy a cuppa.

IPv6 Reverse Proxy using Apache on Windows

Moving to IPv6 poses certain problems. The biggest of which is application compatibility. Of Course, as one would expect, Microsoft is on the bandwagon for IPv6. Unexpectedly, their web proxying product, Forefront TMG, does not play happy with IPv6. Maybe Microsoft are expecting us to put all our web servers out there straight on to the IPv6 web, bolts and all. We have all our web servers safely in our intranet, and use a single firewall/reverse proxy application to serve pages to the outside from multiple sources inside without the need to expose those servers, or multi-home them.

So what is out there that can do the job? Thankfully, Apache comes to the rescue. Apache makes proxying fairly simple, if you like text configuration files. After tinkering with it for a little bit, you'll see why I say that. Unfortunately, the IPv6 troll strikes again. In the standard Apache binaries, compiled for Windows, IPv6 is not built into the listening stack. But that is not the end of the world, because you can compile Apache yourself with Visual Studio's command line tools. I used Visual Studio 2010 professional in my attempt.

So, this document details how to build your own Apache binaries, with IPv6 listeners enabled:

To start off with you will need the locations of perl and awk.exe to be in the path variable. Check out where to get these from the Compiling Apache for Windows page.

Download the latest source versions. You are going to need the source code for Apache, Openssl and zlib. Create a working directory for the Apache source code and extract it there. You will find amongst the directory structure a directory called srclib. In this directory, create a sub-directory called openssl. Extract the Openssl source there. In the srclib directory, create another folder called zlib. Extrack the zlib source in there.

Build the components in the following order: zlib - Openssl - Apache

Building zlib: Open srclib\zlib\win32\makefile.msc. Add 'inffast.obj' to the OBJS= line and save the file. From your visual studio command prompt navigate to srclib\zlib. Build using the following two commands:
nmake -f win32\Makefile.msc
nmake -f win32\Makefile.msc test
If this is successful, you will see a series of tests where a file is created, compressed and decompressed.

Building openssl: From your visual studio command prompt navigate to srclib\openssl. the following commands:
perl Configure VC-WIN32 enable-camellia no-idea no-rc5
ms\do_ms.bat
nmake -f ms\ntdll.mak
Finally, create an empty file and name it store.h and place it in srclib\openssl\inc32\openssl

Building Apache: Open the file srclib\apr\include\apr.hw. Fine the line:
#define APR_HAVE_IPV6    0
Change the 0 for a 1. From your visual studio command prompt, navigate to the root of your Apache source code. Compile with the following commands:
nmake /f Makefile.win _apacher
nmake /f Makefile.win installr INSTDIR=D:\Apache2
(For D:\Apache2 put in a blank directory of your choice. Once compiled, this will contain the complete programme file structure for Apache.)

Now move the whole installation to your destination server. We used server 2008 R2. Place into the Program Files directory of your choice. Once located run httpd.exe -k to install the application as a service.

Now a little cheat. I had previously downloaded the msi installation files off the Apache website and had been fiddling around with that until I discovered that they had compiled it without IPv6 support. If you want to get up and running quickly, run the installer and answer all the questions. Your conf file is then set up to run for your server. I then deleted the contents of the programme files and inserted my compiled version, keeping the original working configuration.

So to add an IPv6 listener to Apache open the main httpd.conf file and add, for example:
listen [2xxx:xxxx:xxxx:xxxx::xxxx]:80
listen [2xxx:xxxx:xxxx:xxxx::xxxx]:443
Make sure your ssl certificates are all in place, by un-commenting the httpd-ssl.conf (in httpd.conf) and changing the settings accordingly. Thankfully, the Apache configuration files are well commented and set up is not rocket science.

Un-comment the httpd-vhosts.conf (in httpd.conf) and add your own site in place. Here are two examples:

Permanent redirection to https:

<VirtualHost [2xxx:xxxx:xxxx:xxxx::xxxx]:80>
 ServerAdmin admin@s.org.uk
 ServerName host.s.org.uk
 ServerAlias *.s.org.uk
 ErrorLog "logs/host.s.org.uk-error.log"
 CustomLog "logs/host.s.org.uk-access.log" common
 ProxyRequests Off
 
http://host.s.org.uk/*>
  Order deny,allow
  Allow from all
 

 redirect permanent / https://host.s.org.uk/
VirtualHost>
Proxy a http site over https

<VirtualHost [2xxx:xxxx:xxxx:xxxx::xxxx]:443>
 SSLEngine on
 SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
 SSLCertificateFile "C:\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\cert.pem"
 SSLCertificateKeyFile "C:\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\cert.key"

 ServerAdmin admin@s.org.uk
 ServerName host.s.org.uk
 ServerAlias *.s.org.uk
 ErrorLog "logs/ssl.host.s.org.uk-error.log"
 CustomLog "logs/ssl.host.s.org.uk-access.log" common
 ProxyRequests Off

 http://host.s.org.uk/*>
  Order deny,allow
  Allow from all
 

 ProxyPass / http://host.s.org.uk/
 ProxyPassreverse / http://host.s.org.uk/
 ProxyPreserveHost Off
VirtualHost>

There are a few configuration gotchas in Apache to watch out for:
SSLPassPhraseDialog: No doubt you will want to run https on this. Unfortunately, the default setting (builtin) does not work on Windows. So you have to point this setting to an application. I pointed it to notepad. Having removed the need to enter a pass phrase this never gets called.

SSLSessionCache: This setting requires a path not broken by spaces. If you have placed your installation in Programme Files, this setting does not work. To get round it, create a shortcut in the root of the drive that points to your Apache directory. Then use that shortcut in the setting. (e.g. shmcb:c:\Apache\etc...)

Maybe Microsoft and other vendors will get their IPv6 act together before people start realising that the products they paid for are not up to scratch, and before freeware products like Apache start stealing their thunder...

Sonicwall NSA Support for IPv6

You may see a few posts on IPv6 through the summer. Keep tuned.

Sonicwall NSA firewall devices DO support IPv6. What they do not tell you is that you need a specific version of the firmware. (5.5.6) When you go to the downloads site, click on the previous versions link and look for the feature release - Version 5.5.6.0-IPv6.

Why they do not mention this anywhere is beyond me. But you've heard it here now. I hope my two days of frustrated hunting around will save you time.

SCCM, WinPE and 802.1x - Windows 7 Service Pack 1

In addition to my last post on this issue here, Windows 7 Service Pack 1 has brought with it only a minor change. The details in that post are still valid, with one minor exception.

In "Stage Two Prepare the WinPE Image" I referred to a hot fix package KB972831, which contained the WinPE module for 802.1x. This had to be added using DISM /add-package. Happily the Service Pack 1 AIK toolkit now contains the winpe-dot3svc.cab in the same location as the other three cabs (winpe-scripting.cab, winpe-wmi.cab, winpe-wds-tools.cab.) 

This means that there is very little reconfiguration needed for introducing your SP1 image.

SCCM and WDS

One of the most complained about problems on the SCCM technet message boards is when the PXE service point stops working. We have had this problem for some time now. The issue ranges from simply not starting after a reboot to not working at all after provisioning a new PXE service point. Our last PXE outage lasted about a month.

The problem is now that there are so many post on this issue, it is hard to find one with a workable solution. The first thing you should be aware of this blog from the Configuration Manager Support Team. This is the first place to go to when looking for solutions to your WDS and SCCM problems. As you will note, even they are constantly updating the information. The last update was on 6 January (or 1 June - depending how you read it) this year. The whole integration of SCCM and WDS is so complex, that even the people who created it are having a hard time.

And even after following the instructions in the above blog, you can still come up against a brick wall. For example: Simply uninstalling the SMS_PXE service point and the WDS server is not enough. You also need to delete the "remoteinstall" directory, or WDS will install and pick up the (probably wrong) settings when it is re-installed.

Another big issue is communications between the WDS server and the Database server. In the world of Windows Server 2008 R2, the firewall is switched on by default. Even with an SQL exception the WDS server can find itself blocked out of the Database. My solution there was to allow all traffic from the WDS server through to the SMS Database Server. My symptoms included the WDS services failing to load the SMS provider with 0x4005 error. As any persistent user of the Technet Forums knows, 0x4005 means 'access denied' in any application.

One of the best ways to figure out whether the issue is at the the WDS end or at the SCCM end, is to actually configure the WDS server as a WDS server. If you have already configured SCCM with a boot image and an OS image, it's really simple to do. After uninstalling and re-installing the WDS role, go ahead and configure the WDS server. Now before the server will start to server PXE, it needs a boot.wim and an install.wim. Having already configured the boot and OS images, you can simply pick them up from their source directories. Just pick up the boot.XXX0001A.wim files and drop them in a temporary directory on the WDS server. Rename the files boot.wim and install.wim. The fact that they are not configured for WDS use is neither here now there at this point. You just need to have both a boot and an install file in order for the WDS server to start servicing PXE requests. Using the WDS mmc console, add the boot file first, then add the install file. Now try to start the service and boot a client to PXE. If it works, your WDS installation is clean.

Following best practice, uninstall the WDS server as you did before, remembering to remove the remoteinstall directory, and then follow the instructions in the blog mentioned above. If you then have problems (even after setting a firewall exception for the WDS server on your SMS DB server) you are looking at a SCCM issue such as access by the WDS server's computer account to the database.

Disable MS Word 2007 Proofing Tools via Group Policy

Yes it is possible!

Why would I want to do this? Well, for exams, of course. In order to have multi-use PCs that are used for teaching to have the possiblity of use for qualified exams, the PCs need to have it's proofing tools tied down.

The other things like internet access and access to network locations is easy enough, but how do you lock down Proofing in Word 2007? Well, you have probably at first glance seen the Group Policy Objects for Word 2007. You can find them in User Settings/Administrative Templates/Microsoft Office Word 2007/Word Options/Proofing. But, as anyone who has ever tried these settings knows, when you open Word 2007, the settings are easily switched back on or bybassed by using the items in the proofing toolbar or by going into the options.

Ah - but what if you could disable the specific user interface items? Well you can - that's easy: Under Microsoft Office Word 2007/Disable Items in User Interface/Custom you can do this. Microsoft has a whole page devoted to this subject. You can find that here.

So what IDs do you disable. Well here is my list:
2566
15780
9056
6111
12842
14453
2815
3492
3492
4025
3997
3958
790
2
3217
2349
329
3219
2469
2788
11323
7343
7387

The important one, the one that is not in the documentation, is 11323. including this ID disables the "Options" button in the Office Button (that un-named circle that someone sensible renamed 'File' in Office 2010.) Without the "options" button disabled, those pesky office group policies can be over-ridden by the user. Without access to options, the user must accept a proofless Word.

But that is not quite enough. It is still possible to gain access to Options by using the "Alt-T, O" legacy key press. But once again, there is an answer. In the same folder as 'Disable commands,' is 'Disable shortcut keys.'

Once again here is my list:
118
254
79,12
118,16
118,4

The 254 entry is equivalent to the key and option combination 84,16. It's not that clearly explained, the key is the standard ascii character that is being used in the combination. 84 is t. The number following the comma is the option. Alt is 16, Ctrl is 8 and Shift is 4. Any combination adds up; so Ctrl-Shift is 12 (8 + 4).

So these options will now disable:

• 118 - F7 Do a spell check
• 79,12 - Ctrl-Shift-o - Opens the research bar
• 254 (or 84,16) - Alt-T Legacy Tools Menu

So now we have used the standard group policies to disable proofing on Word 2007. The User interface buttons are disabled and the options menu is also unreachable so that the disabled options can no longer be turned back on.

The only thing left to do is to make sure the Group Policy Object is targeted only at your Exam login, or your teachers are going to get very angry with you.

Integrating a Cisco CUCM 7.x cluster with multiple Exchange 2010 UM servers

Microsoft's Exchange 2010 Unified Messaging is shaping up to be a top class messaging system. Cisco's Unified Call Manager is a steady standard for VOIP. Can the two live together in a high availability environment? yes they can, and here is how.

CUCM's cluster exists as a failover solution. If the Primary Server fails, devices contact the secondary (or tertiary) server. Changes made on the Primary are replicated to the Secondary. Exchange 2010 allows for as many UM servers as your organisation needs. Failed calls to one server are re-routed to another. Once there are two UM servers it also load balances between the two. Having a Call Manager and a Unified Messaging Server in each of your DR sites effectively means uninterrupted access to voicemail, auto attendants, etc.

Note that we had Cisco Unity enabled and running throughout the time we migrated to UM and they happily sat side by side.

Starting with Exchange UM: We will assume that you have created your Dial Plan and Mailbox Policies and skip straight to creating a new IP Gateway. Specify the name (being possibly the name of the Primary CUCM Server) and specify the IPv4 address. After creating the IP Gateway, right click the gateway and select Properties. Make sure "Allow outgoing calls through this UM IP Gateway" and "Allow Message Waiting Indicator" are both ticked. Create a new IP Gateway for the Secondary CUCM Server with the same details enabled.

Now for the CUCM set up. You may be told that some of these steps are unnecessary, especially in regard to Media Resource Groups. We listened to experience of other users where not using Media Resource Groups caused a problem. In the end, following this path did not result in any problems.

You should already have Media Termination Points set up, one for each server, although only one may be active on the secondary server. You can view them by going to Media Resources -> Media Termination Points. Note their names. Create a Media Resource Group under Media Resources -> Media Resource Group (We'll call it MRG_CCM) and add the previously noted Media Termination Points. Now create a Media Resource Group List (we'll call this MRGL_CCM) that contains the Media Resource Group MRG_CCM.

Go to System -> Device Pool. Copy the Default pool and call it Ex_UM_Device_Pool. In Ex_UM_Device_Pool specify the MRGL_CCM Media Resource Group List and save. (Why this step I don't know, the following steps don't use this profile?!!)

Go to System -> Security Profile -> SIP Trunk Profile. Copy the existing Non Secure SIP Trunk Profile and call it e12_NS_SIP_Trunk_Profile. Tick the boxes for "Accept Out-Of-Dialog REFER", "Accept Unsolicited Notification" and "Accept Replaces Header". Leave the other settings untouched.

Go to Device -> Trunk and create a new trunk with Trunk Type being "SIP Trunk" and Device Protocol being "SIP". Under "Device Information" change the Media Resource Group List to MRGL_CCM. Tick "Media Termination Point Required." Under Call Routing Information select your internal Calling Search Space and tick "Redirecting Diversion Header Delivery - Inbound." (The calling search space is needed for the 'Listen on Phone' feature. Change Calling Party Selection to "Originator" and tick "Redirecting Diversion Header Delivery - Outbound." Under SIP Information enter the IP Address of your first Exchange Unified Messaging server. For SIP trunk Security Profile, select the previously created e12_NS_SIP_Trunk_Profile. Set the Rerouting Calling Search Space to Internal. Finally for SIP Profile select the Standard SIP Profile.

Note that the Standard SIP Profile must have a Default MTP Telephony Event Payload Type of 101. If it is different, you will need to create a new SIP profile and use it here.

Create a new Trunk for each additional UM Server using the above information. (You can test these trunks by adding a route directly into the trunks themselves. However, you will need to remove all routes to those trunks before you add the trunk into a route group. You cannot have the trunk individually routed to AND in a route trunk. If you need to route to an individual Trunk for a specific reason, you can create a separate Route Group List, etc.)

Now to create a Route Group that contains all of the Trunks you have created to the Unified Messaging servers. Under Call Routing -> Route/Hunt -> Route Group select Add New. We will call this e12_UM_Route_Group. Highlight the Trunks you have created. They will only appear here if you have not specified them in a Route Pattern already. Click on Add to Route Group to include them.

Now Create a Route List that can be used in a Route Patter by going to Call Routing -> Route/Hunt -> Route Group. We will call it e12_UM_Route_List. Add the previously created e12_UM_Route_Group.

Now to create a Route Pattern. Under Call Routing -> Route/Hunt -> Route Pattern select Add New. Enter the voicemail access number (We will pretend this is 2010) leave the Route Partition blank. Select the previously created e12_UM_Route_List under Gateway/Route List and make sure "Route this pattern" is selected. Make sure that under the section "Calling Party Transformations" the calling Line ID Presentation is set to "Allowed."

Under Voice Mail -> Voice Mail Pilot, select Add New. Enter 2010 for "Voice Mail Pilot Number" and leave the Calling Search Space as .

Under Voice Mail -> Voice Mail Profile, select Add New. We will give it the name UM2010_Profile. Select the newly created Pilot 2010/.

Back in Exchange -> Organisation Configuration -> Unified Message (UM Dial Plans tab) Open the properties of your dial plan and select Subscriber Access. Ensure to associate the Voice Mail Pilot number (ours is 2010 in this example) with the dial plan.

Find a suitable test mailbox that you have full access to under recipient configuration -> Mailbox. Select "Enable Unified Messaging" and assign a suitable extension, we will select 1050 for example.

Back to CUCM under Call Routing -> Directory Number. Find your extension test extension 1050. Under Voice Mail Profile select UM2010_Profile. Make sure that Call Forward Settings allow forwarding to voicemail.

You should now be able to access Exchange Voicemail from that phone by pressing the messages button, and be able to call into the system. This setup should now be secure from a power failure at either DR site.