Loading ...

Month: July 2015

Demote Windows Small Business Server

Since Microsoft is no longer making Small Business Server (SBS) as the complete package for the SMB client, it is time to migrate email to Office365 and put in a Windows Standard Server in its place. This will explain the details of how to demote Windows Small Business Server from the domain after email has been migrated, the new server should already be in place and it should be running the appropriate server service and Flexible Single Master Operation (FSMO) roles would already be migrated.

One Last Check

  • Open a Command Prompt

  • Type in – netdom query fsmo

  • Make sure that all roles are pointing to the new Domain Controller

Uninstall Exchange

  • Open Control Panel

  • Double Click on “Programs and Features” icon

  • Search the list and find the entry named something like “Microsoft Exchange Server…” right click on it and choose “Uninstall”

  • Click “Next >” button then uncheck all possible boxes then click “Next >” button

  • Once the prerequisites have cleared successfully, click “Uninstall” button

  • Finally click “Finish” button

Remove AD Certificate Services

  • Click Start button, click Administrative Tools, and then click Server Manager.

  • Click on Roles, then in the Roles Summary section, click Remove Roles.

  • In the Remove Roles Wizard, click “Next >” button

  • Clear the “Active Directory Certificate Services” check box, and then click “Next >” button

  • On the Confirm Removal Options page, review the information, and then click “Remove >” button

Demote Windows Small Business Server and Remove from Active Directory

  • On the Source Server, click Start button, click Run, type dcpromo, and then click “OK” button

  • Click “Next >” button twice. (WARNING: Do not select “Delete the domain because this server is the last domain controller in the domain.”)

  • In the Summary dialog box, you are told that Active Directory Domain Services (AD DS) will be removed from the computer and that the server will become a member of the domain. Click “Next >” button

  • Click “Finish” button and the Server will restart

  • After the Server restarts, it can then be removed from the domain into a workgroup and disconnected from the network.

To remove the Source Server from Active Directory Domain Services

  • On the new Domain Controller Server click Start button, click Administrative Tools, and then select Active Directory Users and Computers.

  • In the Active Directory Users and Computers navigation pane, expand the domain name, expand MyBusiness, expand Computers, and then expand SBSComputers.

  • Right-click the old Server name if it still exists in the list of servers, click Delete, and then click Yes.

  • Verify that the Source Server is not listed, and then close Active Directory Users and Computers.

To update the Software Updates Group Policy Object

  • On the Management Server, click Start, click Administrative Tools, and then click Group Policy Management.

  • On the User Account Control dialog box, click Continue.

  • In the Group Policy Management console, in the navigation pane, expand Forest:DomainName, expand Domains, expand DomainName, and then expand Group Policy Objects (GPO).

  • Click Update Services Server Computers Policy.

  • In the results pane, click the Scope tab.

  • In the Security Filtering section, click the object that begins with “S-1-5…” This is the old Server Security Identifier (SID).

  • Click Remove, and then click “OK” button

If your company is migrating to Office 365 and needs help to demote Windows Small Business Server, then contact us for assistance.

Problems Reinstalling Office 365 DirSync

This has happened to me countless times in the field and it is time to write up the process on my own. Either the client has an older version of the DirSync tool installed or there is some sort of errors that require reinstalling Office 365 DirSync. Special thanks go to Joseph Turley for the original write up on which this is based.

Uninstall Old AADSync Tool

If the server is running an older version of AADSync then below is a list of applications that are to be removed:

  • Microsoft Azure AD Sync
  • Microsoft Online Services Sign-in Assistant [Restart is required]
  • Forefront Identity Manager Windows Azure Active Directory Connector

There should then be a reboot of the server to finish these uninstallations. Additionally, the Azure AD Sync Scheduler scheduled task needs to be removed from the Task Scheduler to complete the removal of AADSync. There are also several user accounts in Active Directory Users and Computers that will need to be removed either titled something like “AAD…” or “ADSync…” for the reinstall to work properly. Also need to remove the folders named something like “C: > Program Files > Microsoft Azure AD…” before attempting to start the new installer. There might also be some leftovers in the registry that need to be removed as follows:

  • HKEY_CLASSES_ROOT\TypeLib\{1EE655FB-EC8A-4CFE-BFE7-E8D46BC87B6A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AD Sync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server Local DB
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSOLCoExistence
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MicrosoftAzureADConnectionTool
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0311B5B5-B05D-47A0-89D8-98AED5A0D204}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Azure AD Sync Scheduler
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\AzureActiveDirectoryDirectorySyncTool
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DirectorySyncTool_RASAPI32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DirectorySyncTool_RASMANCS

Uninstall Newer DirSync Tool

If the server is running a more current version of DirSync then below is a list of applications that are to be removed:

  • Windows Azure Active Directory Sync Tool
  • Microsoft Online Services Sign-in Assistant [Restart is required]
  • Forefront Identity Manager Synchronization Service

There should then be a reboot of the server to finish these uninstallations. There are several user accounts in Active Directory Users and Computers that will need to be removed either titled something like “AAD…” or “ADSync…” or “FIMSync…” for the reinstall to work properly. Also need to remove the folders named something like “C: > Program Files > Windows Azure…” and the database files located in a folder named something like “C: > Program Files > Microsoft SQL Server > MSSQL**.MSONLINE > MSSQL > DATA > FIMSync…” before attempting to start the installer.

Reinstalling Office 365 DirSync Tool

  • Log into the customer’s Office365 portal as a global administrator.
  • Click on the Admin tile
  • Click on the Users item in the left pane to expand it then click on Active Users
  • At the top of the main pane next to “Active Directory synchronization:” click on Manage
  • Make sure the at Active Directory synchronization is activated
  • Download the Directory Sync tool by clicking on Download button
  • Double click the installer
  • Type in your Office365 global administrator credentials then click “Next >” button
  • Type in your domain administrator credentials then click “Next >” button
  • Ignore the page on Hybrid and click “Next >” button
  • Make sure the box next to Active Directory Password Sync is checked and then click “Next >” button
  • Click on Install then on Finish to complete the install

Another handy thing to do after the installation is complete is to make a shortcut on the desktop for the miisclient software that monitors the sync process. It is located at “c: > Program Files > Windows Azure Active Directory Sync > SYNCBUS > Synchronization Service > UIShell > miisclient.exe” (this also allows for manual syncs when needed).
If your company needs help reinstalling Office 365 DirSync or help setting up Active Directory Password Sync for single sign-on, then contact us for assistance.

Group Policy Preferences Desktop Internet Shortcut

There are often times that shortcuts are needed on all users or a specific subset of user’s desktops, which is where Group Policy Preferences Desktop Shortcuts come in. Here is how to create a simple internet shortcut for a particular website:

Create a Group Policy Preferences Desktop Internet Shortcut

  1. Login as an administrator.
  2. Go the the start screen and type “Server Manager”.
  3. In the Tools menu select “Group Policy Management”
  4. Find / Create the Organizational Unit (OU) in the domain containing the target computers
  5. Right click on the OU and select “Create a GPO in this domain, and Link it here…” to create a policy and link in to that OU.
  6. Right click on the new policy and select “Edit..”
  7. Navigate through the tree structure as follows:

    Computer Configuration — > Preferences — > Windows Settings — > Shortcuts

  8. Highlight Shortcuts and on the right pane, right click and select New then select Shortcut
  9. In the ‘New Shortcut Properties’, make the following changes so the values look like below:

    Action: Update
    Target type: URL
    Location: All Users Desktop
    Target URL: [Full Website Address]

  10. Close the “Group Policy Editor”
  11. Restart the client and once logged in with a domain user, the desktop would have the new Internet shortcut

    12. If your company is needs help creating Group Policy Preferences Desktop Shortcuts or help with Group Policy in general, then contact us for assistance.

Outlook Anywhere / Outlook via Proxy / RPC over HTTP

Apply RPC over HTTP to an existing account

  1. If Outlook is open, close it.
  2. Click Start then click on Control Panel.
  3. If Control Panel is in Category view, click the Switch to Classic View link on the left and then double-click the Mail control panel. If Control Panel is in Classic view, double-click the Mail control panel.
  4. Click on the “E-mail Accounts…” button.
  5. Select Microsoft Exchange (or whatever is was named). Click on the “Change…” button.
  6. Click on the “More Settings…” button. Click the Connection tab.
  7. In the Outlook Anywhere section, check the “Connect to Microsoft Exchange using HTTP” box.
  8. Click on the “Exchange Proxy Settings…” button.
  9. In the “Use this URL to connect to my proxy server for Exchange” box, type the external URL of the proxy server.
  10. Make sure the “Connect using SSL only” box is checked.
  11. Check the “Only connect to proxy servers that have this principal name in their certificate” box.
  12. In the Principle name for proxy server box, type msstd:[external URL] where [external URL] is the external URL of the proxy server.
    Note: Be certain that entries from Step 9 and 12 are correct. Do not have a space before or after the entries. In Step 12, after msstd there is a colon ( : ). It is not a semicolon. The text should be in all lower-case as well.
  13. Un-check the “On fast networks, connect using HTTP first, then connect using TCP/IP” box.
  14. Check the “On slow networks, connect using HTTP first, then connect using TCP/IP” box.
  15. At the bottom of the dialog box, in the Use this authentication when connecting to my proxy server for Exchange list, change the setting from NTLM Authentication to Basic Authentication instead.
  16. Click OK. Click Apply. Click OK. Click Next. Click Finish.
    Note: If you get “stuck” at the above step and can’t go forward, you need to double-check the settings in the settings in the Exchange Proxy Settings dialog box.
  17. Open Outlook. You will be prompted for a User name and password.
  18. In the User name box, type: [domainname]\ where [domainname] is the internal domain name of the network and then username. (i.E. FHN\Administrator)
  19. Enter the password for the account. Click OK. In some cases, you may be prompted for the password a second time, please enter it.
  20. Outlook should open normally. You’re done.

If your company is using internal Microsoft Exchange servers and need help configuring Outlook Anywhere via RPC over HTTP, then contact us for assistance.

Configure Server 2012 Office 365 SMTP Relay

Install Windows Server 2012 SMTP Relay Feature

  1. Login as an administrator.
  2. Go the the start screen and type “Server Manager”
  3. Click on Manage and choose “Add roles and Features”.
  4. Click “Next >” (Check the box to skip this in the future)
  5. Make sure “Role-based or feature-based installation” is selected then click “Next >”
  6. Choose the appropriate server then click “Next >”
  7. Make no changes to the “Roles” page then click “Next >”
  8. On the “Features” page scroll down and check the box by “SMTP Server”
  9. Click “Add Features” (required for SMTP Server) then click “Next >”
  10. Click “Install” then wait for the install to finish then click “Close”.

Configure Windows Server 2012 SMTP Relay

  1. Go the the start screen and type “Server Manager”.
  2. In the Tools menu select “Internet Information Services (IIS) 6.0 Manager”
  3. Expand the tree until [SMTP Virtual Server #1] is shown then right click and choose “Rename” (as appropriate)
  4. Right click again and choose “Properties”.
  5. Click on the “Access” tab then click the “Connection…” button
  6. Select “All except the list below” then click “OK”
  7. Click on the “Relay…” then select “All except the list below” then click “OK”
  8. Click on the “Delivery” tab then click the “Outbound Security” button
  9. Select “Basic Authentication” and type in the username and password of Office365 user – this can be different than what is used on the device as long as the alternate address on the device is an alias of this user.
  10. Check “TLS encryption” then click “OK”
  11. Click the “Outbound connections” button then change “TCP port” to 587 then click “OK”
  12. Click the “Advanced” button then fill in the FQDN of the internal server (add custom DNS for future changes)
  13. Fill in “Smart host” with SMTP.office365.com – the name of the Office365 SMTP server then click “OK” twice

Warning! You have an open relay now. Use this setup to check the email notification system. When you see it’s fully functional go back to the “Access” tab and narrow down the “Connection” settings to the necessary systems. When no other system needs to relay, just check “Only the list below” and grant “127.0.0.1” access.

Configure External DNS for SPF protection

Go to the domain registrar’s website to update DNS records. Edit / create a sender policy framework (SPF) record. In the entry, include the external IP address. The finished string looks similar to this, where 10.0.0.2 is your public IP address:

v=spf1 ip4:10.0.0.2 include:spf.protection.outlook.com ~all

Note:
Skipping this step might cause email to be sent to recipients’ junk mail folders.
If your company is using Office 365 and needs an Office 365 SMTP relay setup for use by a network device like a multi-function printer, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2023- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]