Wednesday, December 22, 2010

Exchange 2010 - Publishing Outlook Anywhere using NTLM Authentication on ISA 2006

Microsoft's recommendation is to setup Outlook Anywhere through ISA 2006 using Basic Authentication but I was faced with a dilema trying to get this working in our environment.

After rolling out a new Exchange 2010 Cluster with an F5 load balancer we found if Outlook Anywhere was disabled or setup with basic a user on a domain machine would get prompted for a password. This was random and we have not been able to resolve. This doesn't seem to happen if we don't use the Load Balancer but that is another issue we are working to resolve.

In the meantime we have created a GPO to set the Outlook Exchange Proxy Settings (http://support.microsoft.com/kb/961112 if you are interested). This works well however greys out the options you use to set the client.

So a user that takes their work pc home and tries to connect fails as they are trying to authenticate to OA with NTLM. This can be done!!!!

A frustrated admin had refused to take Microsoft's answer and tested different settings until a suitable solution was found. I followed the settings from the blog and it worked a treat.


Kudos goes to Erik for doing the hard yards. I hope this prevents someone wasting the time I and I am sure Erik has wasted in getting this to work.

Monday, December 13, 2010

Exchange 2010 Migration - Technical and Political minefield

For the last 6 months our organisation has been planning for a migration from Exchange 2007 to Exchange 2010. While the steps to complete this task are widely documented all over the blogging world, there are a few points I found little information on and thus wasted hours researching.

Exchange 2010 SP1

Unlike EX2007 Sp1, Sp2 and Sp3, Exchange 2010 Sp1 has to be installed over an RTM version of Exchange 2010. While Microsoft advises that it is possible to install Exchange from SP1 files, there are a good number of issues from this release. Less of a Service Pack and more of a feature Release (Exchange 2010 R2 maybe?) Sp1 introduces a number of additional features requested by the community.

Being an early adopter has its advantages but in this case it didn't pay in spades. OWA missing web files, issues with EMC and other general beta-ness that confirmed Microsoft had rushed the release before it was ready. Test, test and more testing was needed before going live. While we did test it not to the extent that was needed. Fortunately we are in the position to be able to co-locate and thus the initial upgrade was on non-production servers.


Load Balancing Exchange 2010.

Our Org is fortunate to possess an F5 fully redundant load balancer. While an excellent device with an endless level of configuration, beware of how the LB is configured. After migrating the Unified messaging team with no issues we sat on it for a week conteent with the performance and stability. We then proceeded to run a second migration group which consisted of the remaining 50 ICT staff members. After that we struck issue after issue of Outlook hanging, users being prompted for passwords and general inconsistency of product not seen in our Exchange environment.

After getting most users working, we found after some testing that it appeared exchange was working correctly and all Serivces, URL's and IIS instances were setup correctly. Turns out following product documentation doesn't always pay off. A Virtual server script designed to facilitate the use of OA through the LB was breaking the Outlook client. This change had been made a day early but the UM team had slightly different client setups. Fail!

While assuming it was an exchange issue would of nailed it 9-10 this was certainly a third party issue and a frustrating one at that.


GPO's for Outlook 2007 and 2010

When deploying Office 2007 a couple of years ago, the Exchange proxy settings were deployed when installing office. This caused an issue as in certain circumstances when migrated to Exchange 2010 the client would switch to HTTPS instead of TCP/IP randomly. This presented a problem as the URL did not and could not resolved to the LB. There are many VB scripting solutions to sort this but we found a supported KB on dealing with this issue.


Setup a GPO, filtered it based on group, adding the users to change the Outlook settings as we migrate them. By far the neatest solution and one that should of been part of the original Group Policy Templates. As with all GPO settings applied this ability for the user to modify this change presents an issue as OA works differently externally.


Politics

Enter a new Government and a new organisational change bringing a merger to the table. What began a simple migration handled in-house by our team become difficult with the politics taking over. With our neigbours still on Exchange 2003 and jostling to outsource and the incumbent migrating the Exchange 2010, bigwigs felt our migration points out the canyon between both of the groups in direction. We are doing all of this works to provide a better services for our clients and we will continue. Ohh the slippery slope we slide!!