A Site of Information and Ideas
Today we continue down our journey in setting up our SharePoint 2010 farm, with the focus on configuring incoming email for SharePoint 2010. When SharePoint 2007 was released, there was a lot of discussion and rumors around Exchange 2007 being the last version of Exchange to provide Public Folder support, and that SharePoint 2007 was going to be its alternative. Microsoft quickly changed its stance and continues to support Public folders in Exchange 2010. However, there still might be a number of compelling reasons why you would want to consider storing incoming email messages in SharePoint 2010 document libraries, instead of public folders.
In today’s post, I will provide you with a comprehensive step by step guide in configuring your SharePoint 2010 server in conjunction with Exchange 2010, to provide successful delivery of incoming email directly to your SharePoint Web Applications.
The environment
It consists of the following servers which would form a common basis in most large organizations.
The SMTP service
SharePoint 2010 is reliant on the SMTP service which is a Windows 2008 feature and we must install this on our SharePoint 2010 front-end web server.
Navigate to your Start Menu / Administrative Tools / Server Manager. Click on the Features node and select Add Feature. Scroll down and select SMTP Server and click on Add Required Role Services.
Click Next, Next and Install.
Click Close
We now need to install the II 6.0 Management Tools on our Windows 2008 R2 server in order to configure our SMTP service. If IIS 6.0 Manager is not already installed you must do so via, Start / Administrative Tools / Server Manager. Click on the Roles node and select Role / Add Role Services. Then select Management Tools and IIS 6 Management compatibility. Click Install.
We can now launch the IIS 6 Manager via Start / Administrative Tools.
Right click on SMTP Virtual Server #1 and select properties.
Under the General tab, I have enabled logging and encourage doing so at the start in the event we need to do some troubleshooting. You can turn logging off after successful testing.
Click on the next tab, “Access”.
Click on “Authentication” and ensure that Anonymous access is selected.
Next, click on “Connection” and ensure “All except the list below” is selected.
Finally, click on “Relay”, and ensure that “Only the list below” is selected and that “Allow all computers which successfully authenticate to relay, regardless of the list above” is also checked.
Now click on the Messages Tab and make any necessary adjustments that you see fit, such as potentially increasing the message size to allow for the delivery of larger emails with attachments into your SharePoint Libraries and Lists.
Next click on the Delivery Tab in which I normally leave all the defaults in place.
We can skip the LDAP routing tab as there are no settings required to be configured in this area.
Lastly, the Security tab should list the default permissions as per the below. No changes are necessary in this area.
We next journey into the “Domains” are within IIS 6 Manager and a domain name should be listed, which by default is the fully qualified domain name of the machine.
Right click on the Domain Name and select properties and take note of the Drop directory.
Finally, we now just need to confirm that our SMTP service is set to start automatically in the event the server is restarted. I can tell you now that the service is by default set to Manual.
Venture into Start / Administrative Tools / Services.
Scroll down your list of services and ensure that the Simple Mail Transfer Protocol (SMTP) is set to Start-up type, Automatic.
We have now completed the configuration of our SMTP service on our SharePoint Server.
Exchange 2007/2010 Connectors
Part two of the implementation of configuring incoming email in SharePoint is to configure our connectors in Microsoft Exchange. Now even though this is not a requirement, most organizations running SharePoint 2010 or 2007 will also be running a recent version of Microsoft Exchange, hopefully either 2007 or 2010. Exchange 2010 or 2007 will provide you with that extra layer of protection ensuring that all the necessary message hygiene has been performed via its inbuilt Anti Spam Agents on the Edge or Hub Transport Server in conjunction with some form of email antivirus such as Microsoft’s Forefront for Exchange, before the message is delivered to the SharePoint 2010 List or Library.
My instructions and screen captures below are from an Exchange 2010 server which are pretty much identical and applicable to Exchange 2007.
Let’s begin by launching the Exchange Management Console / Organization Configuration / Hub Transport.
Click on Send Connectors / Actions / New Send Connector.
Type in a descriptive name for your Send Connector and then select Internal as the type.
Click Add and enter the Address space as the fully qualified domain name of the server where the SMTP service is installed (i.e. your SharePoint Server)
Click Next
Enter the IP address of the server which also hosts the SMTP service.
Click Next
Select “None” as your smart host authentication settings
Click Next
Ensure your Hub Transport Server has been added.
Click Next
Click New and then click Finish
The end result will be that the Send connector will route email to the SMTP service sitting on our SharePoint Server.
The Directory Management Service
SharePoint 2010 allows you to leverage Active Directory Domain Services (AD DS) so that contacts that are created when you email enable document libraries or lists are stored in a designated Organizational Unit within your AD DS infrastructure. So why would you want to enable Directory Management Service? Purely for the fact that by storing these contacts in AD, you are allowing your users to locate email enabled libraries and lists easily from within their Outlook Address book.
Let’s begin by creating an Organizational Unit in Active Directory.
From your Active Directory server, click Start / Administrative Tools / Active Directory Users and Computers.
Right click on your domain object and select New / Organizational Unit
Type in a descriptive name
Click Ok.
The next step is imperative and very important that we get this right. I have seen on many occasions where incorrect permissions were applied and all sorts of problems were encountered when libraries or list were email enabled.
In summary, we need to provide our Central Administration Application pool identity account specific permissions to our recently created Organizational Unit to be used for creating and deleting contacts for our SharePoint 2010 libraries and lists when they are either email enabled or email disabled.
Right click on the recently created Organizational Unit and click on Delegate Control. This will invoke the Delegation of Control Wizard.
Click Next.
We will now add the Central Administration application pool account which you can confirm from IIS Manager as per the below screen capture.
Add the necessary Account.
Click Next.
Click Create a custom task to delegate.
Click Next
Click “This folder, existing objects in this folder, and creation of new objects in this folder’.
Click Next
Click on Create All Child Objects and Delete All Child Objects.
Click Finish.
Before we finish off our configuration of AD DS and the Directory Management Service we need to provide our Central Administration application pool account with Delete Subtree permissions.
We need to ensure that “Advanced Features” from within Active Directory Users and Computers (ADUC) is active before we venture into the security tab of our SharePoint organizational unit. If you do not enable Advanced Features, the security tab will not be visible.
From within ADUC, click on View and select Advanced Features.
Right click on our SharePoint 2010 Organizational Unit and select Properties.
Click on the Security Tab / Advanced /and Edit the CA Application Pool Identity Account.
Select Allow for “Delete Subtree”
Click on OK and Apply.
After assigning these permissions, you must run IISRESET on your SharePoint server.
Configuring Incoming e-mail settings in Central Administration
Navigate to Central Administration / System Settings / Configure incoming e-mail settings.
Select Yes to “Enable site on this server to receive e-mail”
Select “Automatic” for Setting mode.
Select “Yes” to use the SharePoint Directory Management Service to create distributions groups and contacts.
Enter your Active Directory container details, i.e. the Organizational Unit container that we created specifically for our SharePoint 2010 contacts.
Ensure that your SMTP server details are correct, this should be the fully qualified domain name of your SMTP service that was installed on your SharePoint Server.
Finally, ensure “Accept mail from all e-mail servers” is selected.
Click OK.
Please note that this process will configure the necessary permissions on the email drop folder listed in IIS 6 Manager. In summary, the following permissions are added;
WSS_Admin_WPG – Full Control and
WSS_WPG – Read & Execute / List folder Contents / Read
Ensure that these accounts are added successfully and on the rare occasion in which it isn’t, you will need to add them manually.
Testing the configuration
From within any document library or list, click on Library / Library Settings.
Click on Incoming e-mail settings.
Select “Yes” to allow this document library to receive e-mail.
Select your email attachment options and ensure that Save original e-mail is set to Yes.
Lastly, ensure that you Accept e-mail messages from any sender is selected.
Click OK.
This is your first step to ensure that all of the above configuration is in place. If you do receive an error, it’s most likely going to be permissions related against your Organizational Unit, i.e. SharePoint may not have the privilege to add the contact in Active Directory.
Let’s navigate back to ADUC and confirm that our “testing” contact is created under the SharePoint 2010 Contacts Organizational Unit.
Let’s next navigate to our Exchange 2010 server and ensure it is also listed there with an SMTP address against it.
Launch your Microsoft Exchange Management console and navigate to Recipient Configuration / Mail contact.
Right click on the Contact and select Properties / E-Mail Addresses.
Ensure that both an internal and external routable email address is listed.
From your favorite email client, send a test email to the document libraries’ external SMTP address.
Navigate to your recently email enabled document library and hopefully after a couple of minutes (SharePoint Job timer service delay) you should have received your test email.
Well! That’s all that is to it, from start to finish. Apart from sending a test email, there are a couple of other scenarios that you should test to ensure complete seamless integration with the SharePoint 2010 Directory Management Service. Within the same document library, modify the email address to something different and ensure that this change also flows through to Active Directory. You should also try disabling incoming email from that same library and ensure that the contact is completely removed from Active Directory. If you pass all of these tests scenarios, then we are comfortable in knowing that the correct delegation was provided to our Central Administration Pool Account against our SharePoint Contacts Organizational Unit.
I run a ton of VMs and since I operate on a thin budget and utilize thin provisioning, one thing I hate is wasted drive space. Therfore, I employ this registry entry in my “Server Optimization” GPO:
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Action | Update |
Properties
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEMCurrentControlSetControlSession ManagerMemory Management |
| Value name | PagingFiles |
| Value type | REG_MULTI_SZ |
Lines
| LINE | VALUE |
|---|---|
| 1 | c:pagefile.sys 1000 1000 |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
Slap that sucker in there…
Another one I’ve implemented is Interactive Logon: Do not display last user name – Enabled. I mean, you’re giving them half the equation of the problem otherwise, right?
“The account ‘DomainAdministrator’ provided valid credentials, but is not authorized to use the server; failing authentication.
Event ID: 1020”
Elucidation:
The aformentioned error event is an indication of missing permissions on the receive connector. If the user account does not have MS-Exch-SMTP-Submit permissions then it is not authorized. This error occues when the user account does not have the authority to use Microsoft Exchange Server 2010 Hub Transport Server or Edge Transport Server that contains Receive connector, though the same account possesses the authority to use the Receive connector for inbound messages.
Pre-defined permission groups are assigned to Receive connectors. These permission groups contain pre-defined set of permissions granted to security principals that include users, computers and security groups. Using these permission groups the Receive connectors define the entities that can submit messages to it and the permissions assigned to those entities. In order to submit messages using the Receive connector a user account must possess MS-Exch-SMTP-Submit permissions.
Microsoft Exchange Server 2010 has pre-defined permission groups that can not be modified. Moreover, additional permission groups can not be created.
Resolve:
Being a MS Exchange user, if you are bugged down by the above stated error you need to verify that the user account has MS-Exch-SMTP-Submit permissions assigned on the appropriate Receive connectors on the Hub Transport Server or Edge Transport Server.
To grant the required permissions follow these steps:
Get-ReceiveConnector -Identity “SERVERNAMEDefault SERVERNAME” | Get-AdPermission -User UsernameHere | Format-Table -View User
Add-AdPermission -Identity “Default SERVERNAME” -User Username -ExtendedRights MS-Exch-SMTP-Submit
If the above resolve does not solve the problem, then you can turn to Microsoft Exchange tools to troubleshoot this problematic event warning. These tools can be run from the Exchange Management Console.
Occasionally it is necessary to use Sysprep instead of Quickprep when creating a desktop pool with View. This usually is because of some legacy software requiring unique local computer identifiers (SIDs). I recently got asked about it because of some older antivirus software that needed it to centrally manage its in-OS agents.A comparison of the two customization techniques can be found in the View Administration Guide on pages 95 and 96. KB article 2003797 gives a quick table of the differences:
| Function | QuickPrep | Sysprep |
| Removing local accounts | No | Yes |
| Changing Security Identifiers (SID) | No | Yes |
| Removing parent from domain | No | Yes |
| Changing computer name | Yes | Yes |
| Joining the new instance to the domain | Yes | Yes |
| Generating new SID | No | Yes |
| Language, regional settings, date, and time customization | No | Yes |
| Number of reboots | 0 | 1 (seal & mini-setup) |
| Requires configuration file and Sysprep | No | Yes |
So what are the steps that take place when View customizes with Sysprep?
1. Generate a Private Key (Note: Do not execute this command on an NSG command line. Use a Linux or Windows system with openssl installed)
Here are some examples:
openssl genrsa -des3 -out <private key file name>.key 2048
openssl genrsa -aes128 -out <private key file name>.key 2048
openssl genrsa -aes256 -out <private key file name>.key 2048
openssl genrsa -aes256 -out <private key file name>.key 4096
The encryption algorithm and key-length can be modified as desired.
2. Generate a CSR (Certificate Signing Request)
openssl req -new -key <private key file name>.key -out <csr file name>.csr
Note the request for the different Siging Company. e.g, verisign : no email address,challenge password or optional company.
3. Upload the csr to the signing company.
Note if you copy the text please dont copy the text to microsoft word. Use notepad or vi
4. Generate the PKCS12 file.
openssl pkcs12 -export -in <the file you got from the signing company>.crt -inkey <private key file name>.key -out <your filename>.p12
5. Import the PKCS12 file.
6. (Optional) If the signing company use an intermediate ca, upload the ca.
7. If you have PEM files, use the following:
openssl, the command is…openssl pkcs12 -export -in xxxx.pem -inkey xxxx.pem -out xxx.p12 -passout pas:newpassword -name "newnameJust quickly, I’ve been using Equallogic equipment for several years now. I’ve grown to trust this hardware and enjoy an extremely relaxed work setting based on its reliability.
1. All Equallogic equipment is backwards compatible.
2. Replication is a snap.
3. Mix and match different drive arrays and the data will “level out” – you can’t beat that!
4. Dual controllers, in every tray, yeah it’s expensive, but the scalability of that is ridiculous!
5. Ease of use, a monkey can use it. I mean it’s sooooo easy, and the interface for configuration is super intuitive.
I love using the Dell R815 as my vHosts for several reasons:
1. The airflow through the thing is phenomenal. redundant fans, the power supply package, the way the ram is stacked. it’s just laid out really well and really serviceable.
2. I get them with no spinning media. yep, just dual SD cards, and you’re good to go!
3. Dual Power supplies are a given!
4. Slots for extra network connectivity!
5. You can order them with a “half ram / half processor” configuration for expansion later!
6. The AMD processor, in my opinion is the best power wise processor on the market today.
Ever tried logging into a machine with ssh and found you have to wait much longer than reasonable for the session to start? This happened to me a few times and was especially annoying with machines on my local network (or a VM attached to a virtual network) that should be letting me in immediately. Basically the session is slow to start because the SSH server is trying to lookup the hostname of the SSH client and for whatever reason it’s timing out (e.g., it can’t reach a nameserver, because you happen to be offline) There are a couple of very simple ways to fix that: add “UseDNS no” to /etc/ssh/sshd_config add the client’s net address to the server’s /etc/hosts