Older versions of Microsoft Exchange in a hybrid configuration with Exchange Online (EXO) used a federation trust to authenticate connections for free/busy information. Newer hybrid deployments of Exchange 2016/2019 use OAuth authentication instead of federation. OAuth authentication is reliant on the Auth certificate in your on-premises Exchange. This certificate is created automatically with a lifetime of 5 years when you install Exchange Server on-premises. If this certificate has been replaced, then you also need to update Azure AD with the new certificate information. The simplest way to update the information is by running the hybrid wizard again after you update the Auth certificate. I wrote a previous post about renewing/updating the Exchange Server Auth certificate here: http://byronwright.blogspot.com/2018/05/expired-microsoft-exchange-server-auth.html If you update the Exchange Server Auth certificate and forget to update the information in Azure AD, you are likely to see fr...
One of our clients uses a remote location as a disaster recovery (DR) site for Exchange. The purpose of the DR site is less about functionality (although, it is usable), it's more about the offsite backup functionality this provides. Last week, the Exchange server in the DR site failed and after rebuilding it, we needed to get it going again. The link speed to the remote location is only about 5 Mbps on which they can move about 50 GB of data per day. Given that they have 250GB of mail data, seeding over the network would have resulting in about 5 days of seeding if there were no network interruptions. The process for preseeding is clearly described in the Microsoft documentation and works as advertised: Clean up an incorrect data for the database such as database copies that no longer exist if you are in a recovery situation. Disable circular logging on the database. You are going to take a copy of the database and the log files generated between when you take a copy and when you ...
CIRA is responsible for managing the .ca domain. To comply with Canadian privacy laws they now offer the option to keep the adminstrative and technical contacts for a domain registration private. This is intended to be used by individuals rather than business domains. Business can also select the option to keep their information private but should not. For two reasons: Domain-based certificate verification cannot be performed. When obtaining certificates for Web servers and such, the cheapest certificates used for SSL are those performed by domain verification. These certificates are approved by sending an e-mail to the administrative contact for a domain. When privacy is selected at CIRA, these providers cannot view the Administrative contact and consequently cannot send the verification request. Other contact is also not possible. There may be legitimate reasons why someone would want to contacts you, such as notifying you of misconfiguration in your DNS domain. This is also not easi...
Comments
Post a Comment