Share iT…

After you have configured your mobile device to receive its business e-mail via ActiveSync from your SBS 2011 Exchange 2010 server, it is asking for a 4 digit pin code. This is because the default configuration on the SBS 2011 Exchange Server is to require a password for ActiveSync devices when they are going to synchronize with your server.

To disable or change this feature open Exchange Management Console, go to Organization Configuration, Client Access and choose the Exchange ActiveSync Mailbox Policies. Do properties on the Default policy and select the Passwords tab.

To completely disable the password remove the check at Require password. Of course you can also change the settings to your own requirements.

You can also create separate Mailbox policies with different settings, so you can set other policies for different users. When you create a new policy and want to attach it to a user, go to Recipient Configuration, Mailbox, do properties for the Mailbox user you want to change the policy.

Select the Mailbox Features tab, select Exchange ActiveSync and choose properties, now you can browse to select the other policy you have created.

Some additional information about what settings you can control with the ActiveSync policy are listed over here: Understanding Exchange ActiveSync Mailbox Policies

Please note not all features are supported with all kinds of mobile clients, so before you configure the settings make sure the settings are supported with your type of mobile devices.

When you have problems with or with parts of your windows small business server 2008 or 2011 and you need to troubleshoot, repair or reinstall on or more of the small business server components it is a good start to take a look at the small business server repair guide:

Windows Small Business Server 2008 Repair Guide

Windows Small Business Server 2011 Standard Repair Guide

Most people have multiple aliases on their mailbox, with aliases on the same email domain or even with multiple domain names. But when you try to send from (send as) one of these aliases you get the following undeliverable error message returned:

“You can’t send a message on behalf of this user unless you have permission to do so. Please make sure you’re sending on behalf of the correct sender, or request the necessary permission. If the problem continues, please contact your helpdesk.”

The answer to this problem is relatively easy, by default and design this isn’t possible, but there are a couple of workarounds available:

• Create a separate mailbox and put the alias on the mailbox and configure it with send as permissions.
• Create a distribution group and put the alias on the distribution group and configure it with send as permissions.
• Create a dummy pop account in outlook and configure the alias as email address.
• There are some third party tools available that create a workaround.

Workaround 1:
Create a separate mailbox and put the alias on the mailbox and configure it with send as permissions.

First we start with removing the alias we want to send as from the original mailbox.

Now we create a new mailbox, give it a logical name, etc. and give the alias as email address.

After the account has been created we need to set Send As permissions for the newly created account. We do this via the Exchange management console by right clicking on the newly created mailbox and choose Manage Send As permissions…

Add the original user (user@domain.com) to grant Send As permission for the alias@seconddomain.com

Now you are able to send as user@domain.com also with the alias@seconddomain.com address.

We do this by using the From… field in outlook, add the alias in the from field when you want to send from the alias. When you don’t see the from field go to the options menu and choose Show From.

Best thing to do is click the From… button and select the alias mailbox from the address list.

Of course when email is send to the alias@seconddomain.com it now will be delivered to this newly created mailbox. If you would like to receive the email just as before in the same mailbox (user@domain.com), then go to the properties of the newly created alias mailbox and choose the Mail Flow Settings tab, select Delivery Options… and choose properties.

Add the original mailbox at the Forward to: field, via the Browse… button. Now all mail is forwarded to your original mailbox and all mail will be in same mailbox as before removing the alias.

Workaround 2:
Create a distribution group and put the alias on the distribution group and configure it with send as permissions.

First we start with removing the alias we want to send as from the original mailbox.

Now we create a new distribution group, give it a logical name, I always give it the name of the email alias and set the alias as email address.

Then we add the original mailbox as only member.

Now we need to set the Send As permissions for the original mailbox (user@domain.com) on the newly created distribution list. This cannot be done via the exchange management console, we have to use the exchange management shell.

This is the command syntax: Add-ADPermission “public folder name ” -ExtendedRights Send-As -user “Domain\Username”

Now you are able to send as user@domain.com also with the alias@seconddomain.com address.

We do this by using the From… field in outlook, add the alias in the from field when you want to send from the alias. When you don’t see the from field go to the options menu and choose Show From.

Best thing to do is click the From… button and select the alias distribution group from the address list.

Workaround 3:
Create a dummy pop account in outlook and configure the alias as email address.

WARNING: This option is the least recommended, because setting up this will create the posibillity to open a security hole for smtp virusses.

With this workaround we leave the email aliases as they are on the mailbox. We are going to configure a dummy / fake pop account in outlook, so no server configuration needed.
Open outlook and go to Account Settings, choose for New…, choose the email services that include Pop3, choose for manual configure server settings and choose Internet E-mail (Pop).

At Your Name: we give your name (this is the name the receiver will see), at E-mail Address we give alias@seconddomain.com, at incoming mail server, just give in something it doesn’t matter, at outgoing mail server give in your Exchange server and at username and password give in your logon credentials (the users domain account credentials).

Choose More Settings…

Make sure that you enable “My outgoing server (SMTP) requires authentication” on the Outgoing Server tab. This is needed to let you send via your exchange server, then finish the wizard.

Now you are able to send as user@domain.com also with the alias@seconddomain.com address.

We do this by using the Account button that is created after creating the dummy pop account. You just choose the email address you would like to send your email from.

Conclusion:
So you see there are a couple of workarounds available, which one is the best, there isn’t it all depends on your needs and wishes.

As the most of you know, Hyper-V does not support usb redirection. But with some relative easy steps we can redirect our usb disk to a Hyper-V virtual machine.

First on your Hyper-V Server host open Server Manager and select Disk Management

Then select your usb disk and right mouse click and choose Offline.

When done we close Server Management and open Hyper-V Manager. Select the settings of the virtual machine you would like to attach the usb drive to.

Select IDE Controller or SCSI Controller. Before you choose let me explain why I would choose the SCSI controller instead of the IDE controller for an usb redirected drive. A Hyper-V virtual machine can only boot from an IDE hard drive, you can only add a dvd drive on an IDE controller, you can only add 4 IDE devices. Another thing I would prefer to add an usb disk to the SCSI controller is I can add or remove disks to the virtual machine when it is running, to add an IDE controller disk I need to stop the virtual machine then add the disk and then start the virtual machine.

Now to add your usb disk to you virtual machine we choose Add

Now we choose for Physical hard disk: and choose the disk we would to add. If you have more disks available you can choose from a simple pull down list. You will only see here the disks that are set to offline so that was the first step we had to do. If you would like to add an internal hard disk you have to put it offline before you can add it.

Note: before you set another disk offline be sure there are no operating, system or application files on it because otherwise these or your whole server will crash.

When finished choose OK on the bottom of the screen and the disk is added to your virtual machine.

When we are going to look at your virtual machine and open Disk Management.

You will see the disk directly attached and you can use it within your virtual machine

If you would remove the drive from the virtual machine, go back to your Hyper-V Manager virtual machine settings on your host server.

Select the drive and choose remove and choose Apply or OK at the bottom of the screen.

After you have removed the disk from the virtual machine go back to Disk Management

Right click the drive and choose Online. Now the drive is available on your host server.

You can use this if you need to copy some files directly from the usb disk to the virtual machine or vice versa. Another thing you could use this is for is Windows / SBS backup this needs a local attached disk, although I don’t think this is a supported configuration! You can even if you have chosen for the SCSI controller change the backup disk when your virtual machine is running.

Go directly to SBS 2011 index file. With links to all articles from this serie.

After we have finished with Part 15 Configuring “Software update settings” we go to the Network page of the SBS console and choose for the connectivity tab.

In this part we are going to setup virtual private network (VPN) so people can connect to your network from a remote location / connection and access the network as if they are connected in the local office. First we are going to configure the server and further on how to configure a connection from a windows 7 workstation.

Server configuration:

On the right connectivity task bar we choose “Configure a virtual private network”.

The configuration of the server is really easy, choose Allow users to connect to the server by using a VPN.

And the server part is ready. Only thing that could happen is the wizard cannot automatic configure your router. If you choose View Warning Details.

You see that the only thing you have to do is open port 1723 on your router and let it through to your SBS server.

Workstation configuration:

How to setup a VPN connection from a windows 7 workstation, go to the Network and Sharing Center.

Choose Set up a new connection or network, a new wizard will start.

Choose Connect to a workplace (set up dial-up or VPN connection to your workplace.)

Now we choose Use my Internet connection (VPN) Connect using a virtual private network (VPN) connection through the internet.

Now we are going to setup the internet address, this is the fqdn or ip address the vpn connection must connect to. At destination name give a logical name for this connection.

The three other options on the screen are really straight forward, choose use a smart card if smart card logon is configured. Allow other people to use this connection if all people who use this computer may use this vpn connection and don’t connect now if you will not connect the vpn connection directly after configuration is finished.

Give in your user name, password and domain name. My opinion is never use the remember this password, because if anyone takes your workstation they can simply connect to your network.

Setup is finished, you can now choose Connect now to connect your vpn connection.

When you connect and haven’t checked the remember the password option you will get this username and password windows and you just have to enter your password.

And the connection is made, you are now able to access your network as if you were connected on the local area network.

Some additional information:

You can see if your VPN connection is connected, by choosing this icon on the right bottom part of your taskbar. You can also right click the connection to disconnect it.

If you got this Error 812: The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.

Probably the user does not have the right to make a vpn connection. Go to the properties of this user.

And go to the Remote Access part, make sure the “User can access virtual private network” option is enabled.

Additional information: Here is a really good article that describes the whole VPN setup (it is for 2008 but this is almost the same in SBS 2011)

Go back to Part 15 Configuring “Software update settings”

Go directly to SBS 2011 index file. With links to all articles from this serie.

After we have finished with Part 14 Configuring “Add a new report” we go to the security page of the SBS console and choose for the updates tab.

Here you see an overview of the windows updates if there are updates pending for approval or errors you can see them over here. Also By default Optional Updates are not installed automatically.

Right click an update and choose if you want to deploy or decline the selected update.

If you choose approve you get this warning message, to continue click OK.

And another message that it could take 4 till 24 hours before the update will be deployed to the computers on your network.

After you approved or declined all updates we are going to take a look on the software update settings. On the right taskbar choose “Change the software update settings”

On the Server Updates part, choose the update level you would set for your servers. Think carefully before you set this setting to high and approve every update automatically. If it may go wrong it concerns your server.

On the Client Updates part, you choose the same setting as on server updates but this time for client computers.

On the Schedule part you choose separate for server and client if you would install the updates automatic during a schedule or only notify the new updates are available.
Note!! Is you choose for automatic installation and an update requires a restart the client or server will automatically restart at that time. So think twice before you set this for a server computer.

On the Included Computer part, you can add or remove if a server or client computer must be part of the software update group. If you have some very important client computers that may never restart automatically. You can select the client computer and choose Modify…

And change the update group, so if you leave the settings for server not to automatically install and restart change the Update Group to the Server Computers. The selected client will now perform updates according to the Server Computers settings.

Go back to Part 14 Configuring “Add a new report”
Continue to Part 16 Configuring “Configure a virtual private network (VPN)”

Go directly to SBS 2011 index file. With links to all articles from this serie.

After we have finished with Part 13 Configuring “Connect a computer to your network” we go back to the SBS console and go to the Reports section to setup reporting.

By default there are 2 reports created, 1 daily summary and 1 detailed weekly. You can change these reports as you like. For now we are going to create a new report. So choose “Add a new report” on the right Network Report Tasks section.

On the General part we give the report a name and description.

On the Content part we choose what content we want in our report.

In the E-Mail Option part we can choose if we want to e-mail the report and to who. You can choose to send it even to an e-mail address outside your organization.

On the schedule part we can choose to generate the report daily or weekly and at what time.

When finished choose OK.

Now when you select your report you have a few option on the right My report Tasks pain.

View Report properties, you can change the properties set before.

Generate report, the report is generated immediately and the results are displayed in the section below.

Generated and e-mail report, the same as previous only the report is e-mailed to the recipient(s) you have configured in your report.

View archives, you can select to view older reports.

This is a part of a summary report, where you can easy see if there are errors on your server. You see a Details option for the items you selected in your report.

And this is how a detailed report for Backup and E-Mail Usage and Mailbox Sizes look like.

So you can make as many reports and send them to different people, this could be very useful.

Go back to Part 13 Configuring “Connect a computer to your network”
Coninue to Part 15 Configuring “Software update settings”

After your server has become corrupted or doesn’t start anymore or hardware died it would be nice if there is a simple way to restore the whole server. This is how it works with the build in server backup program.

What you need is you’re SBS 2011 dvd or iso and a successful windows server backup. In this blog post (click here) I described how to configure the sbs server backup.

If you have a hardware error fix this first. Then start the server from your SBS dvd or iso.

Choose your language and next to continue

Now we choose Repair your computer

If you are restoring to same hardware and the old installation is still on that disks you will see this here and can try to use the recovery tools before you are going to do a full restore.
If you use a storage controller that has to load additional drivers then choose Load drivers before you continue.

In this case we are going to restore to complete new disks so there can be found no earlier installation. Choose next.

If you got an error make sure you have connect the device with your sbs server backup on it.
Choose if you would like to use the last available backup or select another backup.

Now you can choose if you would exclude disks to restore to, install drivers for you storage controller if your disk aren’t detected or choose to only restore system drives from your backup.
Choose next to continue

An overview what will be restored. Choose Finish

Another warning that your disks will be formatted and all data on i twill be lost. Choose Yes to continue.

Now the restore is in progress, this can take a while depending your hardware and amount of data. After restore is finished the server will reboot automatically. When you first logon it could take a while before everything is started successful please be patient.

You now have successful restored your SBS 2011 server.

Go directly to SBS 2011 index file. With links to all articles from this serie.

After we are finished with Part 12 Configuring “Add a new user account” we go to add a new computer to our network. We go to the computer we would like to add to the network and start an internet browser. (In this case it is a Windows 7 machine with internet explorer 8.)

In the address bar of the browser we type: http://connect

The following page will open:

The webpage further describes what you can expect.

We are going to continue and click on Start Connect Computer Program

Now you will get a security warning, you can safely choose Run to continue

Choose Yes to continue

If you get this error “An error occurred during the download of Connect Computer. Please go to http://connect and try again. ” read here

Make sure you have already created the user account on the SBS server. Now we are going to add the user logged on to this computer, choose Set up this computer for myself.

If something doesn’t meet the requirements, try to solve the problem and start over. If everything is alright choose next to continue.

Enter you username and password. If you’re just a user and don’t know for sure, ask your network administrator for the username and password.

Give your client computer a name (default it will use the name already given to the computer) and you may enter a description.

The wizard can move your existing data to your domain account so you don’t have to move those files manually.

You have to confirm the data will be moved to the new domain account.

The wizard will now have to restart en will continue / finish when you log on again.

You have successful add the computer to your network.

Go back to Part 12 Configuring “Add a new user account”
Continue with Part 14 Configuring “Add a new report”

Go directly to SBS 2011 index file. With links to all articles from this serie.

After we are finished with Part 11 Configuring “Add a new user role” we go to the “Users and Groups” page of the SBS console and then the Users tab.

First we are going to create a new user account, choose “Add a new user account” in the task pane

Fill all fields with necessary information. All fields except Description and Phone number are required. At User role: you choose the role this user fits the most.
You can always change settings and user role later if you would like to.

Enter a password for this user, please note the password requirements.

The user account has been created successfully. You can now assign an existing computer or add a new computer. This last option has to be done on the new to add computer I will come back to that option in a later part.

When we choose Finish and return to the SBS console, we can right click a user to change all given settings.

Note!! When you are going to update the user role connected to this user all manually changed settings are lost. So think about this before changing settings to a user role.

Another nice option is to create a user set all options you would like and then choose “Add a new user role based on this user account’s properties” to create a new user role based on the settings and membership given to this particular user.

We can also add multiple user accounts at once, choose add multiple user accounts.

First choose the user role you would to connect to all the new users. Choose Add… for all users you would like to create.

Enter all necessary fields and choose OK to add the user. Repeat this for all users you would like to create. At the end choose Add user accounts to really create the user accounts.

All user accounts have been created successful. Choose Finish so we return to the SBS Console.

Another option we can do here is to change the user role for user accounts.

Choose the user role you want to add and choose if you would like to Replace or Add user permissions or settings. Note that if you choose replace all settings and membership are changed to the user role. So if the user you are going to change is already member of groups which are not part of the new user role, the will be removed from those groups.

Select the users you would like to change the user role and choose Add >> and Change user role.

User role has been changed successfully. Choose Finish to return to the SBS console.

Another option we can change is Change password policy.

These are the default settings, you can change them to your own discretion.
Please note that users will have to change their password if it doesn’t fit the new requirements anymore.

Last option on the Users tab of the SBS console is to Redirect folders for user accounts to the server.

Select the folders you want to redirect to the server. If you have enabled folder redirection on a user role then by default these folder are redirected for the users who have that particular role.

Now the users with the checkmark are member of a user role where folder redirection is enabled. But you can add folder redirection for other user manual here.

Go back to Part 11 Configuring “Add a new user role”
Continue with Part 13 Configuring “Connect a computer to your network”