Exchange 2013 RMS Shared Identity user FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 not found

Today I was re-installing Exchange 2013 into an Active Directory forest The schema was already extended with the Exchange 2013 schema extensions.

When installing Exchange 2013, installation of the Mailbox Transport role failed with the following error:

Error:
The following error was generated when “$error.Clear();
if ( ($server -eq $null) -and ($RoleIsDatacenter -ne $true) )
{
Update-RmsSharedIdentity -ServerName $RoleNetBIOSName
}
” was run: “RMS Shared Identity user FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 not found.”.

FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 is a Exchange 2013 built in arbitration user account which must exist in every Exchange 2013 environment. The GUID never changes, it is always “4c1f4d8b-8179-4148-93bf-00a95fa1e042”.

The setup failed because someone deleted this user account from Active Directory!

How can we get it back?

You have two ways to get this mailbox back. If you have a computer on your network with the Exchange 2010 management tools installed, you can create the user account using powershell with the following command:

New-Mailbox -Arbitration -Name FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 -UserPrincipalName FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@default_accepted_domain

For more information on this see Microsoft KB978776

What happens if you do not have exchange management shell installed on any computers? Well there is another way to get this account back. This account is originally created when you prepare the domain/schema. If you run setup.com /PrepareAD on your domain it will re-create this account for you. See below:

Exchange 2013 Platform Options

For BDMs and architects, this model describes the available platform options for Exchange 2013. Customers can choose from Exchange Online with Office 365, Hybrid Exchange, Exchange Server on-premises and Hosted Exchange. The poster includes details of each architectural option, including the most ideal scenarios for each, the license requirements and IT Pro responsibilities.

image

MDT Enable TPM tools from Dell, HP, and Lenovo

If you want to automate enabling the TPM chip as part of the deployment process, you need to download the vendor tools and add them to your task sequences, either directly or in a script wrapper.

Add tools from Dell

The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named cctk.exe. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool:

cctk.exe --tpm=on --valsetuppwd=Password1234

Add tools from HP

The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here is a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool:

BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234

And the sample content of the TPMEnable.REPSET file:

English
Activate Embedded Security On Next Boot
*Enable
Embedded Security Activation Policy
*No prompts
F1 to Boot
Allow user to reject
Embedded Security Device Availability
*Available

Add tools from Lenovo

The Lenovo tools are a set of VBScripts available as part of the “Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide.” Lenovo also provides a separate download of the scripts. Here is a sample command to enable TPM using the Lenovo tools:

cscript.exe SetConfig.vbs SecurityChip Active

Important Hotfixes when running Exchange 2013 on Server 2008 R2 and Server 2012

Additional pre-reqs needed above and beyond Exchange requirements
.NET Framework 4.5.1 deployed on all Exchange servers with CAS role
If .NET Framework 4.5.1 cannot be installed, a hotfix for .NET Framework 4.5 is required

KB2745583 – Windows Server 2012 Download
KB2745582 – Windows Server 2008 R2 Download

Decreases CPU spent in .NET garbage collector
Benefits Mailbox & multi-role
Enable by installing hotfix and setting regkey:
HKLM\Software\Microsoft\.NETFramework\DisableRetStructPinning (REG_DWORD) = 1

A hotfix is now available for Windows Server 2012

Adds two control codes to determine which node owns the GUM lock and which node(s) is/are stuck

KB2779069

Microsoft Exchange Server 2013 Service Pack 1 Architecture Poster

Microsoft Exchange Server 2013 Service Pack 1 Architecture Poster

image_thumb1_thumb

Script Browser for Windows PowerShell ISE

Script Browser for Windows PowerShell ISE enables you to search for over 9000 script samples in the TechNet Script Center from within the scripting environment.

image

Download

Download All Videos and Slides from MEC 2014

Microsoft has published all sessions from Microsoft Exchange Conference 2014, which was held in March, Austin, TX. The sessions are available on Channel9.This script will download all videos from Channel9 in mp4 high quality and slides (pptx) for all sessions, where available.Ins

All content are saved to C:\MEC2014.

Download Glimlach

DownloadMEC14Videoandslides.ps1

MEC 2014 Recordings are here!

A few weeks ago was MEC 2014 in Austin, TX with the farewell Austin post. Today we are happy to announce that the MEC 2014 keynote and breakout sessions are published on Channel 9. This includes the latest content on Exchange foundational topics and the latest features including groups, and many more. The conference provides content for both Exchange on-premises and Office 365 customers. If you missed the event in person, begin by watching the MEC 2014 keynote to get you up to speed on the latest initiatives the Exchange engineering team is working on plus a segment with Perry Clarke.

image

MEC isn’t just an event but also a community. Keep active in Twitter using the #IamMEC community hashtag and join us in the Office 365 IT Pro Network to engage in Exchange conversations in the Exchange IT Pro group. Enjoy the MEC 2014 sessions.

Windows 8.1 Update (KB 2919355) prevents interaction with WSUS 3.2 over SSL

There is a known issue which causes some PCs updated with the Windows 8.1 Update (KB 2919355) to stop scanning against Windows Server Update Services 3.0 Service Pack 2 (WSUS 3.0 SP2 or WSUS 3.2) servers which are configured to use SSL and have not enabled TLS 1.2.

Issue Description

The problem is specific to the following scenario when all of the following are true

  1. Client PC has installed Windows 8.1 Update KB 2919355
  2. Windows 8.1 with Windows 8.1 Update KB 2919355 attempts to scan against WSUS 3.2 running on any affected platform:
    • Windows Server 2003 SP2, or
    • Windows Server 2003 R2 SP2, or
    • Windows Server 2008 SP2, or
    • Windows Server 2008 R2 SP1
  3. HTTPS and Secure Sockets Layer (SSL) are enabled on the WSUS server
  4. TLS 1.2 is not enabled on the server

Only users who have enabled HTTPS and have not enabled TLS 1.2 on their WSUS 3.2 servers and who are also using these WSUS 3.2 servers to manage PCs running the Windows 8.1 Update KB 2919355 are affected by this issue. Please note, while we do recommend the use of HTTPS on WSUS servers, HTTPS and TLS 1.2 are not enabled by default.

Workarounds

If you are using WSUS 3.2 on Windows Server 2008 R2, you may perform either of the following steps to restore the scan functionality if you have deployed the Windows 8.1 Update KB2919355.

  • Enable TLS 1.2 (follow the instructions under More Information > SCHANNEL\Protocols subkey), or
  • Disable HTTPS on WSUS

If you are using WSUS 3.2 on an operating system other than Windows Server 2008 R2, you may perform the following step to restore the scan functionality.

  • Disable HTTPS on WSUS

When Microsoft releases an update that resolves the issue, you may re-enable HTTPS on WSUS.

Microsoft plans to issue an update as soon as possible that will correct the issue and restore the proper behavior for Windows 8.1 Update KB 2919355 scanning against all supported WSUS configurations. Until that time, we are delaying the distribution of the Windows 8.1 Update KB 2919355 to WSUS servers.

You may still obtain the Windows 8.1 Update (KB 2919355) from the Windows Update Catalog or MSDN. However, we recommend that you suspend deployment of this update in your organization until we release the update that resolves this issue. You may also find the workarounds discussed in this article to be useful for testing this Windows 8.1 Update for your organization. Thank you for your patience during this time.

Server 2012 R2 Update & Windows 8.1 Update (KB2919355) direct download links

Server 2012 R2 Update & Windows 8.1 Update is a cumulative set of security updates, critical updates and updates.

Windows 8.1 Update for x86 (KB2919355)

Windows 8.1 Update for x64 (KB2919355)

Windows Server 2012 R2 Update (KB2919355)

Translate »