There are several methods to upgrade ESX/ESXi. This article outlines the available upgrade paths.   Note: This is not a comprehensive guide on how to upgrade ESX/ESXi. For more information on performing an upgrade, see the links in this article.

Resolution

This table lists the methods available to upgrade your ESX/ESXi host, and identifies the version to which you can upgrade:     

For more information about upgrading using:

• *1 *4 The CD-ROM Installation Wizard, see the vSphere Upgrade Guide
• *2 The esxupdate command from the Service Console, see About the esxupdate Utility in the ESX 4 Patch Management Guide
• *3 The vSphere Remote CLI, see Updating ESXi Hosts by Using Update Manager, VMware Infrastructure Update and the Remote CLI (1006089).
• *5 Update Manager, see the VMware vCenter Update Manager Administration Guide
• *6 The Offline Upgrade option, see Performing an offline upgrade from ESX 3.x to ESX 4.x (1009440)

Note: The Host Update Utility replaced Infrastructure Update and is available when you install the vSphere Client. It is a tool for upgrading ESX/ESXi hosts from 3.x to 4.0.x and for patching ESXi hosts only.  Patching ESX with this utility is not supported.  Also, as of vSphere 4.1 the Host Update Utility has been discontinued.

At first sight it looks good, but suddenly my explorer shows the following screen.

And this loops, Controller Module A sees that Controller Module B has an older Management Controller Code version. That’s why Controller Module A starts the update process for Controller Module B. The Flash process on Controller Module B goes bad so it looks.

How to resolve this problem?

• Start an console sesion to Controller Module B.
• type the following command to disable the partner update function

# set advanced-settings partner-firmware-upgrade disabled

• then type the following command to enable ftp access to manualy flash controller module B.

# set protocols ftp enabled

• then start an command prompt on your windows computer type the following command to open an ftp connection to the Controller Module B.

ftp <IPNUMBER>

• enter the correct credentials to logon to the controller module B.
• After some instructions about how to update type the following command. where firmwarefile the file name of the firmware is.

ftp> put firmwarefile flash:force

• After a few minutes the flash updates is done. to check if both Controller Modules have the same firmware type in de console sesion the command

# show versions

•  if everything is the same you can enable the partner update function again and disable ftp access this can be done by the following commands.

# set advanced-settings partner-firmware-upgrade enabled
# set protocols ftp disabled

If you go to the firmware section you see that every version is now the same. If not try to manualy flash also Controller Module A.

Last week we released Exchange Server 2010 Service Pack 1. It has received some great feedback and reviews from customers, experts, analysts, and the Exchange community.

The starting point for SP1 setup/upgrade should be the What’s New in SP1, SP1 Release Notes, and Prerequisites docs. As with any new release, there are some frequently asked deployment questions, and known issues, or issues reported by some customers. You may not face these in your environment, but we’re posting these here along with some workarounds so you’re aware of them as you test and deploy SP1.

1. Upgrade order

   The order of upgrade from Exchange 2010 RTM to SP1 hasn’t changed from what was done in Exchange 2007. Upgrade server roles in the following order:

   1. Client Access server
   2. Hub Transport server
   3. Unified Messaging server
   4. Mailbox server

   The Edge Transport server role can be upgraded at any time; however, we recommend upgrading Edge Transport either before all other server roles have been upgraded or after all other server roles have been upgraded. For more details, see Upgrade from Exchange 2010 RTM to Exchange 2010 SP1 in the documenation.

2. SP1 Prerequisites

   SP1 requires the installation of 4-5 hotfixes, depending on the operating system – Windows Server 2008, or Windows Server 2008 R2. To install the Exchange 2010 SP1 administration tools on Windows 7 and Windows Vista, you requires 2 hotfixes. 

   Note: Due to the shared code base for these updates, Windows Server 2008 and Windows Vista share the same updates. Similarly, Windows Server 2008 R2 and Windows 7 share the same updates. Make sure you select the x64 versions of each update to be installed on your Exchange 2010 servers.

   Here’s a matrix of the updates required, including download locations and file names.

   Hotfix	Download	Windows Server 2008	Windows Server 2008 R2	Windows 7 & Windows Vista
   979744 A .NET Framework 2.0-based Multi-AppDomain application stops responding when you run the application	MSDN or Microsoft Connect	Windows6.0-KB979744-x64.msu (CBS: Vista/Win2K8)	Windows6.1-KB979744-x64.msu (CBS: Win7/Win2K8 R2)	N. A.
   983440 An ASP.NET 2.0 hotfix rollup package is available for Windows 7 and for Windows Server 2008 R2	Request from CSS (select the x64 version)	Yes	Yes	N.A.
   977624 AD RMS clients do not authenticate federated identity providers in Windows Server 2008 or in Windows Vista. Without this update, Active Directory Rights Management Services (AD RMS) features may stop working	Request from CSS using the “View and request hotfix downloads” link in the KBA | US-English	Select the download for Windows Vista for the x64 platform.	N.A.	N.A.
   979917 Two issues occur when you deploy an ASP.NET 2.0-based application on a server that is running IIS 7.0 or IIS 7.5 in Integrated mode	Request from CSS using the Hotfix Request Web Submission Form or by phone (no charge)	Yes	N. A.	N. A.
   973136, FIX: ArgumentNullException exception error message when a .NET Framework 2.0 SP2-based application tries to process a response with zero-length content to an asynchronous ASP.NET Web service request: “Value cannot be null”.	Connect	Windows6.0-KB973136-x64.msu	N.A.	N. A.
   977592 RPC over HTTP clients cannot connect to the Windows Server 2008 RPC over HTTP servers that have RPC load balancing enabled.	Request from CSS	Select the download for Windows Vista (x64)	N.A.	N. A.
   979099 An update is available to remove the application manifest expiry feature from AD RMS clients.	Download Center	N. A.	Windows6.1-KB979099-x64.msu	N. A.
   982867 WCF services that are hosted by computers together with a NLB fail in .NET Framework 3.5 SP1	MSDN	N. A.	Windows6.1-KB982867-v2-x64.msu (Win7)	X86: Windows6.1-KB982867-v2-x86.msu (Win7) x64: Windows6.1-KB982867-v2-x64.msu (Win7)
   977020 FIX: An application that is based on the Microsoft .NET Framework 2.0 Service Pack 2 and that invokes a Web service call asynchronously throws an exception on a computer that is running Windows 7.	Microsoft Connect	N. A.	N. A.	x64: Windows6.1-KB977020-v2-x64.msu X86: Windows6.1-KB977020-v2-x86.msu

   Some of the hotfixes would have been rolled up in a Windows update or service pack. Given that the Exchange team released SP1 earlier than what was planned and announced earlier, it did not align with some of the work with the Windows platform. As a result, some hotfixes are available from MSDN/Connect, and some require that you request them online using the links in the corresponding KBAs. The administrator experience when initially downloading these hotfixes may be a little odd. However, once you download the hotfixes, and receive two of the hotfixes from CSS, you can use the same for subsequent installs on other servers. In due course, all these updates may become available on the Download Center, and also through Windows Update.

   These hotfixes have been tested extensively as part of Exchange 2010 SP1 deployments within Microsoft and by our TAP customers. They are fully supported by Microsoft.

3. Prerequisite download pages linked from SP1 Setup are unavailable

   When installing Exchange Server 2010 SP1 the prereq check may turn up some required hotfixes to install. The message will include a link to click for help. Clicking this link redirects you to a page saying that the content does not exist.

   We’re working to update the linked content.

   Meanwhile, please refer to the TechNet article Exchange 2010 Prerequisites to download and install the prerequisites required for your server version (the hotfixes are linked to in the above table, but you’ll still need to install the usual prerequisites such as .Net Framework 3.5 SP1, Windows Remote Management (WinRM) 2.0, and the required OS components).

4. The Missing Exchange Management Shell Shortcut

   Some customers have reported that after upgrading an Exchange Server 2010 server to Exchange 2010 SP1, the Exchange Management Shell shortcut is missing from program options. Additionally, the .ps1 script files associated with the EMS may also be missing.

   We’re actively investigating this issue. Meanwhile, here’s a workaround:

   1. Verify that the ConnectFunctions.ps1, commonconnectfunctions.ps1 and RemoteExchange.ps1 files are present in the %ExchangeInstallPath%\bin directory.NOTE: If these files are missing, you can copy the files from the Exchange Server 2010 Service Pack 1 installation media to the %ExchangeInstallPath%\bin directory. These files are present in the \setup\serverroles\common folder.
   2. Click Start -> AdmiinistrativeTools ->, right-click Windows PowerShell Modules, select Send to -> Desktop (as shortcut)
   3. Go to the Properties of the shortcut and on Target replace the path to C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -command “. ‘C:\Program Files\Exchange Server\V14\bin\RemoteExchange.ps1′; Connect-ExchangeServer -auto”Note: if the Exchange installation folder or drive name is different than the default, you need to change the path accordingly.

5. Upgrading Edge Transport on Forefront Threat Management Gateway (TMG) and Forefront Protection for Exchange 2010

   If you upgrade a server with the Edge Transport server role running with ForeFront Threat Management Gateway (TMG) and ForeFront Protection for Exchange (FPE) enabled for SMTP protection, the ForeFront TMG Managed Control Service may fail to start and E-mail policy configuration settings cannot be applied.

   The TMG team is working on this issue. See Problems when installing Exchange 2010 Service Pack 1 on a TMG configured for Mail protection on the ForeFront TMG (ISA) Team Blog. Exchange 2010 SP1 Release Notes has been updated with the above information.

6. Static Address Book Service Port Configuration Changes

   The location for setting the port the address book service should use has changed in SP1. In Exchange 2010 RTM you had to edit the Microsoft.exchange.addressbook.service.exe.config to configure the service port. In SP1 you must use the following registry key:
   Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MSExchangeAB\Parameters
   Value name: RpcTcpPort
   Type: REG_SZ (String)
   When you apply SP1 to a machine where you had previously configured a static port by editing the Microsoft.exchange.addressbook.service.exe.config file, the upgrade process will not carry forward your static port assignments. Following a restart, the Address Book Service will revert to using a dynamic port instead of a static port specified in the config file. This may cause interruptions in service.

   As with all upgrades where servers are in load balanced pools, we recommend you perform a rolling upgrade — removing servers from the pool, updating them and then moving the pool to the newly upgraded machines. Alternatively, we recommend that you upgrade an array of servers by draining connections from any one machine before you upgrade it.

   There are times when these approaches may not be possible. You can maintain your static port configuration, and have it take effect the moment the address book service starts for the first time following the application of the service pack, by creating the registry key BEFORE you apply SP1 to your server. The registry key has no impact pre SP1, and so by configuring it before you apply the Service Pack you can avoid the need to make changes to set the port post install, and avoid any service interruptions.

7. iPhone, OWA Premium and POP3 & IMAP4 issues due to invalid accepted domain

   After applying E2010 SP1:

   1. iPhone users may not be able to view the content of incoming messages in their Inboxes, and when they try to open a message, they get an error saying:This message has not been downloaded from the server.Admins may see the following event logged in the Application Event Log on Exchange 2010 CAS Server:Watson report about to be sent for process id: 1234, with parameters: E12, c-RTL-AMD64, 14.01.0218.011, AirSync, MSExchange ActiveSync, Microsoft.Exchange.Data.Storage.InboundConversionOptions.CheckImceaDomain, UnexpectedCondition:ArgumentException, 4321, 14.01.0218.015.
   2. OWA Premium users may not be able to reply or forward a message. They may see the following error in OWA:An unexpected error occurred and your request couldn’t be handled. Exception type: System.ArgumentException, Exception message: imceaDomain must be a valid domain name.
   3. POP3 & IMAP4 users may also not be able to retrieve incoming mail and Admins will see the following event logged in Event Log:ERR Server Unavailable. 21; RpcC=6; Excpt=imceaDomain must be a valid domain name.

   Resolution

   Please run the following command under Exchange Management Shell and verify that there is one domain marked as ‘Default’ and it’s DomainName & Name values are valid domain names. We were able to reproduce the issue by setting a domain name with a space in it, like “aa bb”

   Get-AcceptedDomain | fl

   If you also have an invalid domain name there (for example, a domain name with a space in it), then removing the space and restarting the server will fix the EAS (iPhone), OWA, POP3 & IMAP4 issues as mentioned above.

   Command to run under EMS would be:

   Set-AcceptedDomain –Identity <value> -Name “ValidSMTPDomainName”

   Thes examples update the Name parameter of the “My Company” and “ABC Local” accepted domains (the space is removed from both):

   Set-AcceptedDomain –Identity “My Company” –Name “MyCompany.Com”
   Set-AcceptedDomain –Identity “ABC Local” –Name “ABC.Local”

8. Error when adding or removing a mailbox database copy

   If a server running Exchange 2010 RTM (or Exchange 2010 SP1 Beta) is upgraded to Exchange 2010 SP1, administrators may experience an error when using the Add-MailboxdDtabaseDopy or Remove-MailboxDatabaseCopy cmdlets to add or remove DAG members.

   When you try to add a DAG member, you may see the following error:

   Add-MailboxDatabaseCopy DAG-DB0 -MailboxServer DAG-2

   The result:

   WARNING: An unexpected error has occurred and a Watson dump is being generated: Registry key has subkeys and recursive removes are not supported by this method.
   Registry key has subkeys and recursive removes are not supported by this method.
   + CategoryInfo : NotSpecified: (:) [Add-MailboxDatabaseCopy], InvalidOperationException
   + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.Exchange.Management.SystemConfigurationTasks.
   AddMailboxDatabaseCopy

   The command is not successful in adding the copy or updating Active Directory to show the copy was added. This happens due to presence of the DumpsterInfo registry key.

   Workaround: Delete the DumpsterInfo key, as shown below.

   1. Identify the GUID of the database that is being added using this command:Get-MailboxDatabase DAG-DB0 | fl name,GUIDThe result:

      Name : DAG-DB0
      Guid : 8d3a9778-851c-40a4-91af-65a2c487b4cc

   2. On the server specified in the add command, using the database GUID identified, remove the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v14\Replay\State\<DB-GUID>\DumpsterInfoThe GUID identified in this case is 8d3a9778-851c-40a4-91af-65a2c487b4cc. With this information you can now export and delete the DumpsterInfo key on the server where you are attempting to add the mailbox database copy. This can be easily done using the registry editor, but if you have more than a handful of DAG members, this is best automated using the Shell.This example removes the DumpsterInfo key from the 8d3a9778-851c-40a4-91af-65a2c487b4cc key:

      Remove-Item HKLM:\Software\Microsoft\ExchangeServer\Replay\State\8d3a9778-851c-40a4-91af-65a2c487b4cc\DumpsterInfo

      To automate this across all servers in your organization, use the DeleteDumpsterRegKey.ps1 script.

      File: deletedumpsterregkey_ps1.txt
      Description: The DeleteDumpsterRegkey.ps1 script can be used to delete the offending DumpsterInfo registry keys that can cause this problem on all mailbox servers in the organization. Rename the file to DeleteDumpsterRegkey.ps1 (remove the .txt extension).

      For more info, see Tim McMichael’s blog post Exchange 2010 SP1: Error when adding or removing a mailbox database copy.

Thanks to all the folks in CSS and Exchange teams who helped identify, validate and provide workarounds for some of the issues mentioned above, and to the Exchange community and MVPs for their feedback.

New Deployment Functionality

During an Exchange 2010 SP1 installation, you can now select a new option to install the required Windows roles and features for each selected Exchange 2010 SP1 server role. For more information, see New Deployment Functionality in Exchange 2010 SP1.

Exchange ActiveSync

In Exchange 2010 SP1, you can manage Exchange ActiveSync devices using the Exchange Control Panel (ECP). Administrators can perform the following tasks:

• Manage the default access level for all mobile phones and devices.
• Set up e-mail alerts when a mobile phone or device is quarantined.
• Personalize the message that users receive when their mobile phone or device is either recognized or quarantined.
• Provide a list of quarantined mobile phones or devices.
• Create and manage Exchange ActiveSync device access rules.
• Allow or block a specific mobile phone or device for a specific user.

For every user, the administrator can perform the following tasks from the user’s property pages:

• List the mobile phones or devices for a specific user.
• Initiate remote wipes on mobile phones or devices.
• Remove old mobile phone or device partnerships.
• Create a rule for all users of a specific mobile phone or device or mobile phone type.
• Allow or block a specific mobile phone or device for the specific user.

SMS Sync

SMS Sync is a new feature in Exchange ActiveSync that works with Windows Mobile 6.1 with the Outlook Mobile Update and with Windows Mobile 6.5. SMS Sync is the ability to synchronize messages between a mobile phone or device and an Exchange 2010 Inbox. When synchronizing a Windows Mobile phone with an Exchange 2010 mailbox, users can choose to synchronize their text messages in addition to their Inbox, Calendar, Contacts, Tasks, and Notes. When synchronizing text messages, users will be able to send and receive text messages from their Inbox. This feature is dependent on the user’s mobile phones or devices supporting this feature

Reset Virtual Directory

In Exchange 2010 SP1, you can use the new Reset Client Access Virtual Directory wizard to reset one or more Client Access server virtual directories. The new wizard makes it easier to reset a Client Access server virtual directory. One reason that you might want to reset a Client Access server virtual directory is to resolve an issue related to a damaged file on a virtual directory. In addition to resetting virtual directories, the wizard creates a log file that includes the settings for each virtual directory that you choose to reset. For more information, see Reset Client Access Virtual Directories.

Exchange Store and Mailbox Database Functionality

The following is a list of new store and mailbox database functionality in Exchange 2010 SP1:

• With the New-MailboxRepairRequest cmdlet, you can detect and repair mailbox and database corruption issues.
• Store limits were increased for administrative access.
• The Database Log Growth Troubleshooter (Troubleshoot-DatabaseSpace.ps1) is a new script that allows you to control excessive log growth of mailbox databases.
• Public Folders client permissions support was added to the Exchange Management Console (EMC).

Mailbox and Recipients Functionality

The following is a list of new mailbox and recipient functionality included in Exchange 2010 SP1:

• Calendar Repair Assistant supports more scenarios than were available in Exchange 2010 RTM.
• Mailbox Assistants are now all throttle-based (changed from time-based in Exchange 2010 RTM).
• Internet calendar publishing allows users in your Exchange organization to share their Outlook calendars with a broad Internet audience.
• Importing and exporting .pst files now uses the Mailbox Replication service and doesn’t require Outlook.
• Hierarchical address book support allows you to create and configure your address lists and offline address books in a hierarchical view.
• Distribution group naming policies allow you to configure string text that will be appended or prepended to a distribution group’s name when it’s created.
• Soft-delete of mailboxes after move completion

High Availability and Site Resilience Functionality

The following is a list of new high availability and site resilience functionality included in Exchange 2010 SP1:

• Continuous replication – block mode
• Active mailbox database redistribution
• Enhanced datacenter activation coordination mode support
• New and enhanced management and monitoring scripts
• Exchange Management Console user interface enhancements
• Improvements in failover performance

Messaging Policy and Compliance Functionality

The following is a list of new messaging policy and compliance functionality included in Exchange 2010 SP1:

• Provision personal archive on a different mailbox database
• Import historical mailbox data to personal archive
• Delegate access to personal archive
• New retention policy user interface
• Support for creating retention policy tags for Calendar and Tasks default folders
• Opt-in personal tags
• Multi-Mailbox Search preview
• Annotations in Multi-Mailbox Search
• Multi-Mailbox Search data de-duplication
• WebReady Document Viewing of IRM-protected messages in Outlook Web App
• IRM in Exchange ActiveSync for protocol-level IRM
• IRM logging
• Mailbox audit logging

Technet Exchange 2010 SP1 info
Release Notes for Exchange Server 2010 SP1
What’s New in Exchange 2010 SP1
Downloads:
Microsoft Exchange Server 2010 Service Pack 1
Microsoft Exchange Server 2010 SP1 Language Pack Bundle
Exchange Server 2010 SP1 UM Language Packs
Exchange Server 2010 SP1 Help

Downloads.

• Main Download Page
• ESX 4.1
• ESXi 4.1
• vCenter Server 4.1
• vSphere Hypervisor (Free ESXi)
• vSphere Management Assistant (vMA) 4.1
• vSphere CLI 4.1
• Cisco Nexus 1000 AV1 Virtual Ethernet Module

Documentation.

Main and Documentation sets:

• Main documentation link
• Download the complete ESXi 4.1 Embedded and vCenter Server 4.1 Documentation Set
• Download the complete ESXi 4.1 Installable and vCenter Server 4.1 Documentation Set
• Download the complete ESX 4.1 and vCenter Server 4.1 Documentation Set

Individual Docs:

• Documentation Roadmap
• Configuration Maximums for VMware vSphere 4.1
• VMware vSphere Compatibility Matrixes
• Introduction to VMware vSphere
• Getting Started with ESX
• ESX and vCenter Server Installation Guide
• Upgrade Guide
• Datacenter Administration Guide
• Virtual Machine Administration Guide
• vSphere Web Access Administrator’s Guide
• ESX Configuration Guide
• Resource Management Guide
• Availability Guide
• Fibre Channel SAN Configuration Guide
• iSCSI SAN Configuration Guide

ESXi:

• Getting Started with ESXi Installable
• Getting Started with ESXi Embedded
• ESXi Installable and vCenter Server Setup Guide
• ESXi Embedded and vCenter Server Setup Guide
• ESXi Configuration Guide

Features.

• What’s New in VMware vSphere 4.1
• What’s new in Networking with vSphere 4.1 (VMware white paper)
• What’s new in vCenter Server 4.1 (VMware white paper)
• What’s new in Availability & Resource Manager in vSphere 4.1 (VMware white paper)
• What’s new in Performance for vSphere 4.1 update (VMware white paper)
• What’s new in vSphere 4.1 storage (VMware white paper)

Release Notes.

• VMware vSphere 4.1 Release Notes – ESX Edition
• VMware vSphere 4.1 Release Notes – ESXi Edition
• vSphere CLI 4.1 Release Notes

Upgrade.

• Upgrading to ESX 4.1 and vCenter Server 4.1 best practices (1022104)
• Upgrading ESX 4.0 to ESX 4.1 (1022140)
• vSphere 4.1 upgrade pre-installation requirements and considerations (1022137)
• Performing an offline upgrade from ESX 3.x to ESX 4.x (1009440)

Install.

• Installing ESX 4.1 and vCenter Server 4.1 best practices (1022101)
• Troubleshooting ESXi 4.1 Scripted Install errors (1022308)

KB Articles.

• VMware ESX and ESXi 4.1 Comparison (1023990)
• Changes to DRS in vSphere 4.1 (1022842)
• Changes to VMware High Availability in vSphere 4.1 (1022843)
• Changes to VMware Support Options in vSphere 4.1 (1023118)
• Changes to vMotion in vSphere 4.1 (1022851)
• Changes to Fault Tolerance in vSphere 4.1 (1022844)
• vCenter Server 4.1 fails to install or upgrade with the error: This installation package is not supported by this processor type (1019144)
• Using Tech Support Mode in ESXi 4.1 (1017910)
• USB support for ESX/ESXi 4.1 (1022290)
• I/O Statistics in vSphere 4.1 (1021953)
• Lockdown mode configuration after upgrading from ESXi 4.0 to 4.1 (1021935)
• vSphere 4.1 upgrade pre-installation requirements and considerations (1022137)
• Load Based Teaming in vSphere 4.1 (1022590)
• Migrating to the vCenter Server 4.1 database (1021635)
• Update Manager 4.1 patch repository features (1021695)
• Upgrading to ESX 4.1 and vCenter Server 4.1 best practices (1022104)
• Upgrading ESX 4.0 to ESX 4.1 (1022140)
• Using vShieldZones 1.0 with ESX 4.1 (1022536)
• Deploying ESXi 4.1 using the Scripted Install feature (1022263)
• Network I/O Resource Management in vSphere 4.1 with vDS (1022585)
• Changing the number of virtual CPUs per virtual socket in ESX/ESXi 4.1 (1022289)
• Troubleshooting ESXi 4.1 Scripted Install errors (1022308)
• Using Tech Support Mode in ESXi 4.1 (1017910)
• Installing ESX 4.1 and vCenter Server 4.1 best practices (1022101)
• vCenter Server 4.1 network port requirements (1022256)
• Recreate vSphere 4.0 lockdown mode behavior in vSphere 4.1 (1017628)
• Overview of Active Directory integration in ESX 4.1 and ESXi 4.1 (1021970)
• Securing Credentials in vMA 4.1 (1017669)

This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010.

For this migration to work you will need the following software:

Steps required:

It’s important that the steps are followed in order as different stages make different changes to the way in which your server operates.  For example you MUST make the 2008 server a domain controller before you install Exchange.

Step 1 – Health Checks on Small Business Server 2003

The absolute first thing you need to do is take a SYSTEM STATE backup of your Small Business Server as well as a full system backup.  There is little chance of the data getting lost but the SYSTEM STATE backup backs up Active Directory so that if it all goes wrong we can recover it if needed.

What you then need to do on the SBS 2003 server is to make sure you have all the latest available updates.  This means you should at a minimum have:

Once you have installed all of the above, run Windows Update and make sure you select the option in the blue banner bar across the top for Microsoft Update.  Microsoft Update will then allow you to update all Microsoft products installed on the server providing a more comprehensive update solution.  Keep running the check and installing all updates until there are no more available.

Check the health of your Active Directory by running DCDIAG, if there is anything reported as an error fix it before moving on.

Run the Small Business Server 2003 Best Practices Analyser from here:  http://www.microsoft.com/downloads/details.aspx?familyid=3874527A-DE19-49BB-800F-352F3B6F2922&displaylang=en

Make sure you fix any problems the analyser identifies. If you cannot, then why not raise a question on EE to have our Experts help you?

A common problem that can cause this migration to fail is that the SBS 2003 server does not have its own IP address listed for DNS in the network properties under TCP/IP.  If this is the case, update it so that it does (do not use the loopback 127.0.0.1 address).

Step 2 – Join new Windows 2008 Server to the domain as a member server

To join a Windows 2008 Server to the Small Business Server domain we need to first ensure that it is receiving a correct IP Address

Allow the Windows 2008 Server to receive a DHCP Address from your Small Business Server.  Run an IPCONFIG /ALL to check this.  The DNS Server entry is probably the most important. This should be configured to use the IP Address of your Small Business Server for DNS.

To test, it might be worth just pinging the SBS 2003 server from a command prompt just to check the name can be resolved by doing the following:

If you get a good response then we can try and join the 2008 server to the domain.

To Join the Server to the Domain, do the following:

Step 3 – Prepare Active Directory for Windows 2008 R2 Server

The first step of this process is to raise the Functional Levels of the SBS 2003 server.  This involves raising the domain and forest functional level of Active Directory and the Operational mode of Exchange Server.

To raise the Domain Functional Level do the following:

To raise the Forest Functional Level do the following:

And we also need to raise the Exchange Operational Mode.  To do this, you need to do the following:

Before we can add the Windows 2008 Server as a domain controller to the SBS 2003 domain, we need to prepare Active Directory.
To do this use the following procedure whilst working on the Small Business Server

NOTE: X: refers to the drive letter that has been assigned to your DVD Drive.

After the above command you will be prompted to confirm you wish to proceed by typing the letter C and pressing Enter

Step 4 – Make Windows 2008 R2 Server a Domain Controller of the Existing Small Business Server 2003 Domain

To make the Windows 2008 Server a Domain Controller is fairly straight forward, we simply click Start > Run  and type DCPROMO click OK.

This will check that the Active Directory Services Binaries are installed and if they are not, it will install them.  It will then start the Active Directory Domain Services Installation Wizard.
 

On the first screen, there is no need to check the ‘Use Advanced mode Installation’ check box, just simply click next.  On the operating System Compatibility screen click next.
 

On the ‘Choose a Deployment Configuration’ screen, select the radio box for Existing Forest and Add a domain controller to an existing domain.  Then Click next.
 

On the ‘Network credentials’ screen, the name of the domain should have been detected automatically.  Check this is correct.  If you are logged in as a user that has domain admin privileges then you can use the My Current logged on credentials option.  If not, click the set button and add the username and password that has domain admin privileges as shown in the screen above.  Click Next.

The following screen will give you the results of a domain search and ask you which domain you want to add this domain controller to.  As you are upgrading Small Business Server there should only be one.  Click Next. 
The next screen will give you an option to select the site for the new domain controller.  If you have more than one Active Directory Site ensure that you select the correct one if it hasn’t been done by default.  Click next.
 

On the ‘Additional Domain Controller Options’ screen, make sure that both the DNS Server and the Global Catalog options are both checked.  Click Next.  The error message regarding DNS Delegation can safely be ignored.  Click Yes on this dialog to continue.

If you have separate folders where you want to store your log files, SYSVOL share and the Active Directory database then these can be specified on the next screen.  To be honest I keep them all as defaults.  Once done, click Next.

On the following screen, you are asked to set a password for Directory Services Restore Mode Administrator (DSRM).  Please note this is NOT the Domain Administrator password.  This password is used to boot the Domain Controller into Directory Services Restore Mode which is used for recovering corrupt/deleted/failed Domain Controllers.  Make a note of this password and keep it somewhere safe (in a fire safe for example).

Click Next on the following 2 screens.  The wizard will then start the promotion of the server to a domain controller (I always check the box on this screen to reboot on completion – This way you can leave it and come back to it knowing that it will be ready to continue).

Once rebooted your new server will be a domain controller, DNS server and Global Catalog server in your Small Business Server Domain.

Step 5 – Transfer DHCP Service

By default the Small Business Server will be the DHCP Server (if it isn’t and you’re using something else for DHCP, then you will simply need to update the DNS configuration this device is giving out so that it points to the 2008 Server instead of the 2003 Server) we will need to transfer this to the new server.

We can start this process by installing the DHCP Service.
 

To install DHCP, open up Server Manager and under Roles, click Add Role. From the list, select DHCP Server and click Next then next on the Introduction to DHCP Server screen.

On the network Connection Bindings screen you should have your primary IP address listed.  As you will be installing Exchange on this server it’s not recommended to have a multi-homed server but if you do make sure the LAN card and IP is the only one selected.  Click next.

NOTE: A multi-homed server is a server that has multiple IP addresses assigned to multiple Network Interface Cards.  Normally these types of servers would be used as routers.  Whilst Exchange can be made to work in this environment, it’s not recommended.
 

On the Specify IPv4 DNS Server Settings check the following settings:

Click next accepting the default settings on the WINS screen.

On the Add or Edit DHCP Scopes screen, click Add.  This will present you with the Add Scope dialog box.
 

On this screen enter the following details:

(This should be the same as the DHCP Scope you have configured on the Small Business Server).

You will notice in the scope I am creating, I have started from 192.168.10.15 this is so that I have 15 addresses that I can assign to fixed addresses.  My Small Business Server and Windows 2003 server will have an address below 192.168.10.15 but I might also have printers, photocopiers, and wireless access points that also need fixed IP addresses.  I have also left 192.168.10.254 available to use for my router.

Once you have completed all the details, click OK and then Next.

Accept the default setting on the ‘Configure DHCPv6 Stateless Mode’ and the Specify IPv6 DNS Server Settings.

On the ‘Authorize DHCP Server’ screen, select to use the current credentials and click Next, then Install on the confirmation screen.

The DHCP Server service is now installed on the Windows 2008 server.

Before we can switch over, we need to make some changes to the Small Business Server DHCP settings.  Whilst we can just turn one off and turn the other on this will cause you to have to release and renew the settings on the client machines manually for them to pick up the new DHCP Service.  The alternative is to wait the 4 days before your client machines request an IP address renewal.

To make the required changes, do the following on the Small Business Server:

In the section titled ‘Lease duration for DHCP clients’ we are going to change it to 2 hours from the default of 8 days.  Click OK

Then under Address Leases, highlight all DHCP Leases, right click and select delete.  NOTE:  If you have any reserved addresses make sure they are not highlighted otherwise they will be deleted also.

This action will cause all DHCP clients to renew their addresses and gain an address that has a 2 hour lease.  Check the Address Leases and refresh until you are happy that all the clients now have an IP address. (You might want to leave this overnight just to make absolutely sure)

Once you are happy that all the clients have now got a 2 hour lease from the Windows 2008 server do the following:

This will start the DHCP Service on the 2008 server and deactivate the service on the Small Business Server (this will happen automatically because when Small Business Server detects another DHCP server on the network it shuts its own down).

You will now find that in approximately 1 to 2 hours time, all your clients will start picking up IP addresses from the Windows 2008 Server.

You can now disable the DHCP Server service on the Small Business Server.  DO NOT disable the DHCP Client service, as this plays a part in DNS registration.

Now that all the clients are using the new Windows 2008 Server for DHCP and DNS, we need to make sure that the Small Business Server is also using the Windows 2008 Server for DNS.  To do this modify the TCP/IP properties of the network card and change the Primary DNS servers IP address to that of the Windows 2008 Server.  Do not enter anything in the Secondary DNS server.

Once you have done this restart the NETLOGON service so that the DNS entries are added to the Windows 2008 DNS.

Step 6 – Install Exchange 2010

Because we performed all the diagnostic checks at the start, the installation of Exchange 2010 should be fairly straight forward.  Please note that even though the installation of any version of Exchange Server on a domain controller is supported by Microsoft, it is not a recommended configuration.  But since we are migrating from Small Business Server the chances are you still want to stick with a single server configuration.

The first step is to install the pre-requisites on Windows 2008 to allow the Exchange 2010 installation to complete.  This can be done very easily using the Windows PowerShell.

To do this, please use the following steps:

Once the PowerShell is opened run the following commands:

There is no notification this has completed you will just see a flashing cursor waiting for input.  This command will allow us to add server roles and features via the PowerShell command.

This command will install all the pre-requisites for the Mailbox, Hub Transport and Client Access roles on to the Windows 2008 Server.  This will replicate what you currently have on the Small Business Server.
Once the server has restarted after the above command, launch the Windows Powershell again and run the following command:

This will set the Net.Tcp Port Sharing Service to Automatic instead of Manual

Install the Microsoft Office Filter Pack (which you should have downloaded earlier from the top list of required software).

Once we have done this, we need to prepare Active Directory for the Exchange 2010 installation.

Unlike previous versions, Exchange 2010 will detect if the schema updates have been done and do them if not, I prefer to see this happen.

To prepare Active Directory for Exchange 2010 we need to do the following:

Start the Exchange installation from the DVD.  On the initial splash screen that opens, click Step 3: Choose Exchange Language Options, select the appropriate option then click Step 4: Install Microsoft Exchange.  The Exchange Installation Wizard will then start.

The first screen you see is the Introduction screen, click Next.  Read, agree to and accept the license agreement screen.
 

This screen allows us to choose the type of installation.  As it’s assumed the Exchange 2010 server is a direct replacement for Small Business Server and all roles will be installed on a single server, we simply select Typical Exchange Server Installation and Click next.

If we were separating our roles out on to different servers we would select Custom Exchange Server Installation and then click next.
 

This screen allows us to specify what URL will be used for accessing our Outlook Web App from outside of the network.  Whatever you put in here you will need to make sure you have a DNS A record for it in your EXTERNAL DNS server.  In the later steps you will also need to use this name in your SSL Certificate Request. (CSR)

Check the box ‘The Client Access role server will be internet-facing’ and then specify the URL you will use, do not addhttps:// or anything at the end i.e. /owa.  Click next.
 

This screen is asking us to specify the Exchange 2003 server that the installation will create a routing group connector for.  This is essential for mailflow between the servers.  Click Browse, the list should be generated automatically and you will be able to select the Small Business Server from the list.  Click OK and then next.

Choose on the next screen if you wish to participate in the Customer Improvement program and then click next.  At this point the readiness checks will be performed to ensure your infrastructure is ready for Exchange 2010.
 

The results of the readiness check should show a warning on the Organisation Prerequisites, this is normal and it’s because we didn’t run the setup /PrepareAD /OrganizationName: command earlier on.  This can safely be ignored as the setup will perform this task for us.

The other cautionary warning you will see on my screen capture is simply because I haven’t installed the Office Filter Pack so you will only see this if you didn’t follow the step earlier.  Once you click install, the wizard will Install Exchange Server 2010.  And we are looking for the screen below.  All green.
 

Now that Exchange is installed, using the Exchange Management Console, navigate to Server Configuration > Hub Transport.  Here there will be 2 Receive Connectors listed.

The one we will be dealing with is the one that starts with the word Default and is followed by the name of the Exchange 2010 server.  Right click on this Receive Connector and select properties.  Under the Permission Groups tab, check the box for Anonymous Users.  If this box is not checked then servers sending mail to you will not be able to connect.  Your e-mails with therefore be rejected.

One final task before we move on, is to reconfigure any firewall/router rules you may have for ports 25 and 443 to allow the Exchange 2010 server to now deal with SMTP traffic and Outlook Web App.

Step 7 – Installing Exchange 2010 SSL Certificate

Exchange 2010 installs with a self-signed certificate by default.  Whilst this will work, it will cause browser errors in the form of untrusted websites, Outlook errors for Autodiscover (which is used for free/busy information & Offline Address Book) and errors when using mobile devices and Outlook Anywhere.  Whilst for the most part there are ways around these problems, I won’t be covering them in this article because my recommendation, as any other Exchange specialist would recommend, would be to use a 3rd party certificate.

Unlike earlier versions of Exchange, we have a nice easy to use wizard in the Exchange Management Console for certificate generation.  This makes installing commercial certificates in Exchange 2010 much easier and less prone to error.

To start the New Exchange Certificate wizard do the following:

This will start the New Exchange Certificate Wizard
 

Enter a friendly name for the certificate. This can be whatever you like, but standard practice is to use the company name or something that can identify your company.  Click Next
DO NOT Select to create a wildcard certificate unless you plan on buying a certificate for your entire domain, which is not required for Exchange to function.  Click Next
 

On the following screen pull down the arrows for:

Make sure all the URLs are correct (examples can be found in my screen capture above) and then click Next.
 

Confirm the entries on the next page (it’s worth noting on this screen that the address shown in bold is what is known as a Common Name).  This could be important later as Outlook Anywhere requires the common name to be the same as the URL used in the RPC connection.  In most of my configurations I use the owa.gkvirtualdomain.co.uk as the common name.  To do this, highlight the URL and click the Set as Common Name option.  Click next when finished.
 

You then need to complete your organisation information as shown in the screen above.  Then click New on the next screen. And then finish.

You can then open the file you have specified to create the request with, copy and paste the entire contents into the 3rd party vendors website and follow their instructions for submitting it.
 

Once you receive the signed certificate, right click on the certificate request located as above and select Complete Pending Request.  Follow the instructions to import the certificate you have just received.

Step 8 – Migrate Exchange Data

Now we have Exchange installed, it’s time to migrate the data over.  We will start with the easy part as a bit of a break from the previous 6 steps.
 

To migrate the user mailboxes, open Exchange Management Console and navigate to Recipient Configuration > Mailbox. Highlight the mailboxes you want to move (the mailboxes that are on the Exchange 2003 server will appear as Legacy Mailboxes, as pictured above), right click on them and select New Local Move Request
 

When the New Local Move Request wizard opens, click the browse option to select the Windows 2008/Exchange 2010 server mail store and click OK, then click next.

On the following screen, select what you would like to do when the wizard encounters corrupt messages. You have two options: either to skip only the corrupt message or to skip the whole mailbox.  Click next and on the following screen click New.
 

Once the move requests have been verified, we should see the screen above.  All the mailboxes you selected should hopefully show a green tick.  Please note that during the move mailbox process, the user will not have access to their mailbox as it is moved “offline”.

The next stage is to migrate the Public Folders. To do this complete the following steps on the SBS 2003 Server:

Now that we have moved the data to the Exchange 2010 server it’s best to leave this for a day or so to a) make sure all the data is moved before we perform any other Exchange related tasks. b) allow all the outlook clients to update automatically with the new server settings.

Step 9 – Migrate SharePoint Services

If you are using companyweb for an intranet/document storage etc. then you will also need to migrate this.  If you are not using SharePoint then simply skip this step.

First thing you will need to do is to install the Windows SharePoint Services 3.0 which you downloaded as part of the pre-requisites.  This is the free version of SharePoint Services.  Only the version with Integrated Service Pack 2 will install on Windows 2008 R2.

Once you have downloaded Windows SharePoint Services 3.0, double click to start the installation on the Windows 2008 Server.  Read, agree to and accept the license agreement and click continue.  Select Basic installation.  This will install the standard single site installation.

Once the installation has finished, launch the SharePoint Products and Technologies Configuration Wizard.  Click next on the welcome screen and Yes to confirm you are OK with the services being restarted.
NOTE: While IIS restarts, the Outlook Web App will be temporarily unavailable.

On the final screen, check the box to ‘Run the SharePoint Products and Technologies Configuration Wizard now’ and click Close.

Click Next on the welcome screen and Yes to confirm you are OK with the services being restarted.  The wizard will run through again and complete the configuration.   Once finished click close.

Make sure you install the 32bit version on the Small Business Server and the 64bit version on the Windows 2008 server.

The next step we need to complete is to run a pre-scan on the current database to allow Windows SharePoint Service 3.0 to upgrade it when we move it to the Windows 2008 server.
Perform the following steps to achieve this:

Once you have done this still, working on the Small Business server perform the following tasks:

We now need to launch the SQL Server Management Studio Express, this can be done by:

Before we perform any additional steps, we are going to take a backup of the database used for companyweb.  Follow these steps to perform a backup:

On the backup screen, the only section you need to change is the destination.  Make sure the “backup to” is set to disk and then click Add.
 

If you receive the error message above, don’t panic, it’s easily solved by using the following procedure:

Close Regedit and try clicking the Add button again on the Backup Screen, specify a location for where you would like to save the backup and click OK.

We are now going to detach the database from the SBS 2003 server.  Still in SQL Server Management Studio Express, right-click on the STS_SBSSERVERNAME_1 select tasks and then Detach.

Locate the Database and Log file, which by default will be located in C:\ Program Files\Microsoft SQL Server\MSSQL$SharePoint\Data on the Small Business Server.  You need to copy the STS_SBSSERVERNAME_1.MDF  and STS_SBSSERVERNAME_1_LOG.LDF files to a folder on the destination server, don’t copy them in to the SQL Server data folder.

Working on the Windows 2008 server perform the following steps:

We now need to create the website in IIS.  To do this, do the following:

On the Add Web Site wizard, enter a site name of companyweb, specify a physical path and host name of companyweb as shown in the image above.  You can change these if you wish, but keeping the site name/host name the same will mean the URL your clients use will not change.

Launch DNS manager from Start > Administrative Tools > DNS.  Expand the forward lookup zone for your internal domain name and locate the CNAME record called companyweb.  This should currently be using the Small Business Server’s server name.  Double-click this record to edit it and change it to use the Windows 2008 server instead.

And then finally we need to setup SharePoint Service.  To do this perform the following steps:

On the screen that appears, complete the fields as listed below.  If nothing is specified, please leave the default settings.
In the IIS Web Site Section choose the following:

In the Security Configuration Section

In the Application Pool Section

In the Database Name and Authentication Section

In the Search Server Section

Click OK and your SharePoint Website will be created.  Once the wizard has finished, from an Internet Browser type inhttp://companyweb/ and the companyweb website on the Windows 2008 server will be displayed.

Step 10 – Migrate shared user data

Because this step is so generic and it could be different for every server, I am not going to go into specifics, only the more general steps that need to be accomplished.

The shares that are in use on the Small Business Server need to be recreated on the Windows 2008 server.  One way we can do this is backup the share definitions from the Small Business Server and restore them to the Windows 2008 server.  This involves working in the registry so please be careful and follow the instructions accurately.  The instructions on how to do this can be found here: http://support.microsoft.com/kb/125996

The next stage is to restore the actual data to the shares.  This is a lot easier if you ensure that the folder structure you have on the Small Business Server for shares is replicated on the Windows 2008 server.  You can simply use Windows Backup to backup and restore the data.  This will keep all permissions and ownership information intact.

You will then need to update any login scripts which will be located in \\LOCALHOST\SYSVOL on the Windows 2008 server to ensure that any mapped drives are updated.

You will also need to update any attributes that may be under the Profiles tab in Active Directory Users and Computers for the users themselves.

Step 11 – Uninstall Exchange 2003 from Small Business Server 2003

Hopefully you are arriving at this step a day or two after you have migrated all the mailboxes, if not then I would recommend you leave it for a day or two just to allow all client computers to automatically update the Exchange server setting in outlook.  If you uninstall Exchange 2003 from the Small Business Server and this hasn’t happened then the clients will have to be changed manually.

To perform this task we will need Small Business Server 2003 CD 2, which will be asked for during the uninstallation.  Before we can do this though, there are a few steps we need to perform otherwise we will not be able to uninstall it.

If you use Recipient Policies that are Manage Mailbox policies, then these will need to be removed.  Likewise, if you have Recipient Policies that are used for both e-mail address definition and mailbox management, the settings defined under Mailbox Manager Settings will need to be removed.  You DO NOT need to remove your e-mail address policies.

The Recipient Update Service is not used in Exchange 2010 and is therefore not required, so it can be removed.  To do this you will need to use ADSI Edit.  This can be done by using the following procedure:

Only delete the Recipient Update Service entries under the container; DO NOT delete the container itself or any other entries

The final step in preparation for uninstalling Exchange Server 2003 is to delete the routing group connectors that would have been created as part of the installation.  I have highlighted them in the image below.  Simply right click on each connector and select delete.
 

We are now ready to uninstall Exchange 2003.  To do this, navigate to Start > Control Panel > Add or Remove Programs.  From the list of installed applications, highlight Windows Small Business Server 2003 and click Change/Remove.

Click next on the Welcome screen, and next on the screen that follows.  Once the component screen opens pull down the drop down next to Exchange Server and select remove, as shown below. Then click next and next again.
 

Step 12 – Transfer all 5 FSMO roles to Windows 2008 Domain Controller

Caution needs to be taken when performing this next step.  I would advise that ALL of the previous steps need to be completed before this is done as Small Business Server MUST hold all 5 FSMO roles.
Once you are ready, the roles can be transferred as follows.  Working on the Windows 2008 server do the following:

That is 3 of the 5 roles transferred.  To do the next one, which is the Domain Naming Master we need to do the following:

4 down with 1 to go.  To move the Schema Master role we need to do the following:

That’s all the FSMO roles transferred from the Small Business Server.  The next and final step is to demote the server from being a Domain Controller.

Step 13 – DCPROMO SBS 2003 server so it is no longer a domain controller and remove from network

This is the final step of the migration process.  If you have made it this far, well done!  This is the easy bit!

The first thing we need to do is make sure the Small Business Server is not a Global Catalog Server.  Click on Start > Administrative Tools > Active Directory Sites and Services.  Locate the Small Business Server as shown in the screen shot below.
 

Right click on NTDS settings located under the Small Business Server and select properties.  Remove the check from the Global Catalog check box and click OK.  Close Active Directory Sites and Services snap-in.

The final step is to run DCPROMO.  To do this, do the following:

The server will then remove Active Directory Services from the Small Business Server and it will no longer be a Domain Controller.

Once this has finished, allow the server to restart, login and then shut it down.  You have now completed the migration.

If you are still with me, well done!  There are a few sections of additional reading below if you would like to know some more detail about some of the processes we have just completed.  There is an excellent article from EE Expert tigermatt around the purpose of the FSMO roles which you will find under the further reading section.

Further Reading

Move/Migrate Sharepoint Services: http://technet.microsoft.com/en-us/library/cc288664.aspx
Move last legacy Exchange Server: http://technet.microsoft.com/en-us/library/bb288905(EXCHG.80).aspx
Demystifying the Active Directory FSMO Roles by tigermatt: http://www.experts-exchange.com/articles/Software/Server_Software/File_Servers/Active_Directory/Demystifying-the-Active-Directory-FSMO-Roles.html

What we will cover:

1. Receiving Certificate Errors When Connecting to Clients/Servers with TS Gateway or Remote Web Workplace on SBS 2008
2. VBScript Error: 50331676
3. Connection Authorization Policies and Resource Authorization Policies.
4. Authentication Failures
5. Client Machine Requirements
6. Internal DNS Considerations
7. External DNS Considerations
8. TS Gateway Service Known Issues

1.  Receiving Certificate Errors When Connecting to Clients/Servers with TS Gateway or Remote Web Workplace on SBS 2008

For certificate related errors, please review the issues discussed in this article: http://blogs.technet.com/sbs/archive/2008/10/03/receiving-certificate-errors-when-connecting-to-clients-servers-with-ts-gateway-or-remote-web-workplace-on-sbs-2008.aspx

2.  VBScript Error: 50331676

When you try to connect to a server or machine you get the following error:

You must have a certificate installed in TS Gateway Manager. This is handled by the “Set up your Internet Address Wizard” or the “Add a Trusted Certificate Wizard” in the SBS 2008 Console. To verify you have a certificate installed for TS Gateway do the following:

1. Open TS Gateway Manager from Administrative Tools — Terminal Services
2. Select Properties on the Server Object, and choose the SSL Certificate tab from within properties. You should see a screen similar to the one below stating which certificate TS Gateway is using.

As stated beofre, you should not see this problem If you have completed the Internet Address Management Wizard, if for any reason no certificate is selected, make sure you click on Browse Certificates and select the proper certificate, for example “remote.contoso.com”.

3.  Connection Authorization Policies and Resource Authorization Policies.

You must pass the connection authorization policy to make a connection, and the resource authorization policy for the machine you are trying to connect to. This error may also display the VBSCRIPT error 50331676.

We have seen a few cases where the connection authorization policy was modified manually to only allow domain computers to make connections. This means that any machine outside the domain (e.g. their home machine) would not be able to connect. This is shown below. To access this policy:

1. Open TS Gateway Manager from Administrative Tools – Terminal Services
2. Expand your computer object
3. Expand Policies
4. Select Connection Authorization Policies
5. Right-Click on the General Connection Authorization policy on the right hand side and choose properties
6. Make sure the Client computer group membership is blank if you want non-domain joined machines to be able to use the RWW Connect To Computer feature.

4.  Authentication Failures

You must have Windows Authentication enabled on the IIS /RPC virtual directory under the SBS Web Applications web site. If it is missing, you will see a looping prompt for authentication when you try to connect.

Since both Outlook Anywhere and TS Gateway share this Virtual Directory modifying authentication settings in Exchange for Outlook-Anywhere within the Exchange Management Console can disable Windows Auth. To make sure Windows-Auth is enabled in Exchange Management Shell (Run as admin) perform the following command:

Get-OutlookAnywhere

(Ignore the warning)

Check the value for the IISAuthenticationMethods Parameter.

You can also check in IIS Manager under the RPC virtual directory, authentication.

Changing the authentication here may only help for a few minutes as Exchange will reset the settings again. You need to complete the proper Exchange configuration steps to resolve this.

If the output of the Exchange Management Shell shows that you are missing NTLM, you need to reset the Exchange setting for outlook anywhere from the Exchange Management Shell (run as admin) perform the following command (ignore the warning):

Get-OutlookAnywhere | Set-OutlookAnywhere –IISAuthenticationMethods: Basic, ntlm

After you make this change, the settings in IIS will not immediately change, it might take up to 15 minutes for this change to happen. You can safely make the change in IIS, under the authentication for RPC to enable Windows Authentication and Basic Authentication and they should remain set as expected.

If you still cannot authenticate to the TS gateway prompt, the following resources discuss some known issues:

• http://blogs.technet.com/sbs/archive/2009/02/20/the-network-policy-server-service-ias-fails-to-start-or-be-installed.aspx
• http://blogs.technet.com/sbs/archive/2009/05/18/bits-ias-vss-and-rras-may-stop-responding-on-sbs-2008-with-a-particular-nic-driver.aspx

5.  Client Machine Requirements

The client machine you are trying to connect to must have RDP enabled and listening on the default port of 3389. You must also verify that any firewalls present on the workstation are allowing the traffic inbound on TCP/3389.  Additionally, the client machine you are making the connection from must allow the ActiveX Control to run.  The easiest way to ensure that ActiveX will be enabled is by adding your remote web workplace site to your list of trusted sites in Internet Explorer.

6.  Internal DNS Considerations

You might connect to an unexpected machine when trying to connect to the remote machine.  If this happens you should verify that the DNS records for the clients on the SBS 2008 server hosting RWW are correct.  To do this open the DNS Management console from Start, Administrative Tools, DNS.  Expand the forward lookup zones, and your local active directory zone.  Verify that the host (A) records for the clients are correct.

7.  External DNS Considerations

The hostname section of the PTR record for the remote client machine’s public IP address cannot match the NetBIOS hostname of the SBS 2008 server. If these names match the RWW will not use TS proxy and the connection will fail or connect to an unexpected target.

The only fix is the change the PTR record for the client pc’s external IP address.

Example: Suppose you are using a Windows Vista machine on the Internet. The public IP for this client is 65.53.x.x. The PTR record for this IP is server01.contoso.com. If the SBS 2008 server this machine is trying to connect to has a NetBIOS hostname of Server01, the connection will fail. Ideally your PTR record should match your MX record and your MX record should not be the NetBIOS hostname of your server.

Note: This is a very RARE issue.

8.  TS Gateway Service known issues

TS Gateway Service Not Started After Restart in IIS Manager.

This issue is discussed on this post: http://blogs.technet.com/sbs/archive/2009/04/20/ts-gateway-service-not-started-after-restart-in-iis-manager.aspx

The Terminal Services Gateway service is not running, Contact your network administrator to resolve this issue.This error can happen due to a number of different issues other than the TS Gateway service not running or the role service not being installed.

• If IPv6 has been unproperly unbound from the network interface you might get an error that states that the TS Gateway service is not installed.  Check the following link for issues related to improperly disabling IPv6:http://blogs.technet.com/sbs/archive/2008/10/24/issues-after-disabling-ipv6-on-your-nic-on-sbs-2008.aspx
• If Client certificates has been set to Accept or Require under the SSL setttings on the Rpc virtual directory. This must be set to Ignore.
• In general, this error will happen when we cannot properly access the /RPC virtual directory or its settings have been changed from default.

Additional RWW related links:

• http://blogs.technet.com/sbs/archive/2009/02/12/how-to-enable-drive-mapping-through-sbs-2008-remote-web-workplace.aspx
• http://blogs.technet.com/sbs/archive/2009/01/09/sbs-2008-how-to-make-terminal-servers-in-application-sharing-mode-appear-in-remote-web-workplace.aspx
• http://blogs.technet.com/sbs/archive/2009/06/15/how-to-configure-the-rww-timeout.aspx
• http://blogs.technet.com/sbs/archive/2008/09/26/can-i-use-terminal-services-in-sbs-2008.aspx

Source: http://blogs.technet.com/b/sbs/archive/2009/06/19/common-remote-web-workplace-rww-connect-to-a-computer-issues-in-sbs-2008.aspx

Log Name:      Application 
Source:        Windows SharePoint Services 3 Search 
Date:          4/29/2009 4:20:05 PM 
Event ID:      2436 
Task Category: Gatherer 
Level:         Warning 
Keywords:      Classic 
User:          N/A 
Computer:      server.domain.local 
Description: 
The start address <sts3s://remote.Domain.com:987/contentdbid={d4078aab- ce82-4581-8d4f-973e1e6eac23}> cannot be crawled.

Context: Application ‘Search index file on the search server’, Catalog ‘Search’

Details: 
Access is denied. Check that the Default Content Access Account has access to this content, or add a crawl rule to crawl this content.   (0×80041205)

Cause

You receive above warning events because WSS3.0 Search service is trying to crawl the WSS content via the URL – remote.domain.com, which is mentioned in above event. Windows Server 2008 includes a loopback check security feature that is designed to help prevent reflection attacks on your computer. Therefore, Kerberos authentication on Default Content Access Account fails if this URL does not match the local computer name and is not registered in system as additional Service Principle Name (SPN).

Resolution

To resolve this issue, it is recommended to manually register the URL in your system, or even disable the Loopback check feature. To register this URL, please use the following steps,

Note: We recommend that you use this method.

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key: 
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. Right-click MSV1_0, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the URL mentioned in the above warning event, and then click OK.
7. Quit Registry Editor, and then restart the IIS service.

If you want to disable Loopback Check feature to work around this issue, please refer to the Method 2 in the following KB article

896861 You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6

More Information

WSS3.0 Search service crawls the WSS content by default Alternate Access Mapping Zone. Not like normal WSS 3.0 website, which uses http://SiteName as the default Alternative Access Mapping, SBS 2008 server uses https://remote.domain.com:987as the default Zone. This is by design, and we do not recommend changing it to http://companyweb, as it may break the SBS specific settings.

Additionally, changing the Default Content Access Account for content crawl is NOT officially supported method to work around this issue, as it has not been tested and can cause other potential issues.

Source : http://blogs.technet.com/b/sbs/archive/2009/05/07/event-2436-for-sharepoint-services-3-search.aspx

This week June 7 – 11th there is a big Technet Event in New Orleans. There are a lot of good technical Microsoft Product sessions. Here are some interesting links to a few worth watching.

• Keynote Day 1 by Bob Muglia. http://www.msteched.com/2010/NorthAmerica/Keynote01
• Keynote Day 2 by Ted Kummert. http://www.msteched.com/2010/NorthAmerica/Keynote02
• Optimizing the Branch Infrastructure with BranchCache. http://www.msteched.com/2010/NorthAmerica/WSV322
• Living in a Mixed Environment: Integrating Your Heterogeneous Infrastructure. http://www.msteched.com/2010/NorthAmerica/WSV318
• Failover Clustering Pro Troubleshooting with Windows Server 2008 R2. http://www.msteched.com/2010/NorthAmerica/WSV314
• Effectively Monitor and Manage Power Utilization and Efficiency with Windows Server, Windows 7, and Microsoft System Center. http://www.msteched.com/2010/NorthAmerica/WSV312
• Windows Server 2008 R2 SP1. http://www.msteched.com/2010/NorthAmerica/WSV307
• DirectAccess Configuration, Tips, Tricks, and Best Practices. http://www.msteched.com/2010/NorthAmerica/WSV306
• Death of a Network: Identify the Hidden Causes of Lousy Network Performance. http://www.msteched.com/2010/NorthAmerica/WSV303
• Windows Small Business Server 2008 Migration Overview. http://www.msteched.com/2010/NorthAmerica/WSV206
• 10 Hot Topics Every IT Admin Needs to Know about Windows Server 2008 R2. http://www.msteched.com/2010/NorthAmerica/WSV201
• Windows 7 + MDOP: Optimized Desktop Solutions Demo. http://www.msteched.com/2010/NorthAmerica/WCL320
• Using Windows Preinstallation Environment (PE) 3.0 to Troubleshoot and Fix Problems, and to Capture and Deploy WIM Images. http://www.msteched.com/2010/NorthAmerica/WCL318
• Keeping Windows Running Effeciently with the Microsoft Diagnostics and Recovery Toolset. http://www.msteched.com/2010/NorthAmerica/WCL309
• How to Manage and Deploy the Find and Organize Features in Windows 7. http://www.msteched.com/2010/NorthAmerica/WCL307
• Best Practices Guide to Managing Applications. http://www.msteched.com/2010/NorthAmerica/WCL304
• Planning and Deploying Microsoft VDI with Management Technologies. http://www.msteched.com/2010/NorthAmerica/VIR311
• Networking and Windows Server 2008 R2 Hyper-V: Deployment Considerations. http://www.msteched.com/2010/NorthAmerica/VIR310
• Getting the Most out of Windows Server 2008 R2 Hyper-V with the Integration of the System Center Suite. http://www.msteched.com/2010/NorthAmerica/VIR307
• Microsoft RemoteFX: Rich Windows Desktop Experience for VDI and Session Virtualization. http://www.msteched.com/2010/NorthAmerica/VIR305
• Hyper-V and Dynamic Memory in Depth. http://www.msteched.com/2010/NorthAmerica/VIR304
• Microsoft Application Virtualization 4.6 and Microsoft Office 2010. http://www.msteched.com/2010/NorthAmerica/VIR209
• Virtualization 360: Microsoft Virtualization Strategy, Products, and Solutions for the New Economy. http://www.msteched.com/2010/NorthAmerica/VIR206
• Understanding How Microsoft Virtualization Compares to VMware. http://www.msteched.com/2010/NorthAmerica/VIR204
• What You Need to Know about Exchange Web Services. http://www.msteched.com/2010/NorthAmerica/UNC310
• What’s New in Archiving, Retention, and Discovery in Microsoft Exchange Server 2010 SP1. http://www.msteched.com/2010/NorthAmerica/UNC307
• Microsoft Exchange Server 2010 High Availability Design Considerations. http://www.msteched.com/2010/NorthAmerica/UNC305
• Upgrading from Microsoft Exchange Server 2003/2007 to Exchange Server 2010: Tips, Tricks, and Lessons Learned. http://www.msteched.com/2010/NorthAmerica/UNC303
• Microsoft Exchange Server 2010 SP1: An Overview of What’s Coming. http://www.msteched.com/2010/NorthAmerica/UNC201
• Business Ready Security: Microsoft Exchange Server 2010 and the Microsoft Forefront Secure Messaging Solution, Better Together. http://www.msteched.com/2010/NorthAmerica/SIA324
• Business Ready Security: Securely Collaborate with Partners and Employees Using SharePoint, Microsoft Forefront, and Windows Server 2008 R2 Active Directory. http://www.msteched.com/2010/NorthAmerica/SIA323
• Microsoft Forefront Identity Manager 2010: Deploying FIM. http://www.msteched.com/2010/NorthAmerica/SIA318
• Microsoft System Center Configuration Manager v.Next: Software Distribution. http://www.msteched.com/2010/NorthAmerica/MGT309
• Microsoft System Center Configuration Manager v.Next: Overview. http://www.msteched.com/2010/NorthAmerica/MGT308
• Microsoft System Center Configuration Manager 2007: Overview. http://www.msteched.com/2010/NorthAmerica/MGT304
• Useful Hacker Techniques: Which Part of Hackers’ Knowledge Will Help You in Efficient IT Administration?. http://www.msteched.com/2010/NorthAmerica/SIA333

For more sessions from TechEd North America see http://www.msteched.com/

• When attempting to customize the deployment of a virtual machine the radio buttons are disabled (grayed out)
• When a virtual machine is deployed from a template, the SID is always the same, despite the fact that you chose the option to generate a new SID during template deployment and guest operating system customization
• When attempting to create a new virtual machine from a template in ESX 3.5, you receive the following error message:

Warning: Windows customization resources were not found on this server

• You see this error in the guestcust.log file:

deploy doesn't contain known sysprep files

Purpose

This issue may occur if Microsoft’s Sysprep files are not found on the VirtualCenter host, are not the correct version, or are not in the location they are expected.

This article guides you through the process of determining the correct version of Sysprep to use and the correct locations for these files.

Resolution

Microsoft has a different version of Sysprep for each release and service pack of Windows. You must use the version of Sysprep specific to the operating system you are deploying. The differences are not immediately visible in the packaging and documentation of the service packs, so it is necessary to manually investigate.

The contents of the Sysprep deploy.cab file must be extracted to the Sysprep Directory on the VirtualCenter Server host. If the file downloaded from the Microsoft Web Site is a .cab file, the Installing the Microsoft Sysprep Tools appendix of the Basic System Administration guide details how to install the Sysprep Tools.

If the file downloaded from the Microsoft Web Site is a .exe file the following additional steps must be executed to extract the files from the .exe:

1. Open a Windows command prompt. For more information, see Opening a command or shell prompt (1003892).
2. Change to the directory where the .exe file is saved.
3. Enter the name of the .exe file with the /x switch to extract the files. For example: WindowsServer2003-KB926028-v2-x86-ENU.exe /x 
4. When prompted, choose a directory for the extracted files.
5. Browse the directory and copy the extracted files directly to the Sysprep Directory or extract the files from the deploy.cab and copy to the Sysprep Directory.

When the contents of the of the Sysprep deploy.cab file have been extracted to the Sysprep Directory on the VirtualCenter Server:

1. Log in to the VirtualCenter Server as Administrator.
2. Click Start > Programs > Accessories > Windows Explorer.
3. Navigate to the Sysprep Directory as listed in the table below.
4. Right-click on the sysprep.exe file and choose Properties.
5. Click the Version tab. Record the number at the top next to File Version:.

The table below lists the Sysprep Version for the Windows Versions that are supported for Image Customization. Compare the Sysprep Version number with the Windows Version it is intended for:

Notes:

• If vCenter Server is installed on Windows Server 2008, <directory_path> is %ALLUSERSPROFILE%\VMware\VMware VirtualCenter\sysprep which translates to C:\ProgramData\VMware\VMware VirtualCenter\sysprep by default.
• If vCenter Server is installed on any other Windows operating system, <directory_path> is %ALLUSERSPROFILE%\Application Data\VMware VirtualCenter\sysprep\ which translates to C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\sysprep\ by default.

Additional Information

For additional information, see:

• The Basic System Administration guide, which contains further information regarding the installation of Sysprep tools
• The Operating System Compatibility for vSphere Client, vCenter Server, and VMware vCenter Update Manager table in the vSphere Compatibility Matrixes for a list of supported operating systems for virtual image customization.
• Troubleshooting template deployment or cloning when it fails (1004050), which provides troubleshooting information for template deployment or cloning

Source: VMware knowledge base http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1005593