Exploring Technology

BT Farm Crash Fix

2011-06-23T23:12:00.000-07:00

BT Farm Crash Fix

Symptoms
• Unable to assign users to farm for migration
• When you try to open CMTu it doesn’t open and then eventually you get error with “System.ArgumentNullException: Value cannot be null” in part of the error
• Syslog also shows the ‘Value cannot be null’ errors
• XML service error.

Caution: Please make sure this is the issue before proceeding as the fix is a bit destructive. You should attempt restarting IIS first.most of the tome restarting IIS will resolve issue.

Resolution
1. If you have attempted to open CMTu and haven’t closed it then use task manager to kill CMT.exe
2. Connect to all farm workstations. Wait for any active migrations to finish. You can also potentially pause the migrations (I usually do this for PP migrations) so I don’t have to wait.
3. Open Access: Start > Run > All Programs > Microsoft Office Access
4. In Access on right side pane there should be a quick link to CMT_Universal.mdb (the one that links to C:\Program Files\CMT Universal\CMT_XMLServer\App_Data\CMT_Universal.mdb), click that to open the database, when prompted at Security warning click Open
5. Double-click the ‘MigrationQueueTable’
6. Go File > Export… then change Save as type to ‘Text Files (*.txt; *.csv; *.tab; *.asc)’ and name it ‘MigrationQueueTable’. Export Text Wizard pops up, accept defaults and click Finish, click Ok.
7. Right click the top left most gray table box (left of migration_id column, above arrow) then click Delete Record to delete all records
8. Close Access, save if prompted
9. Restart IIS
10. Restart the farm workstations (using ‘Restart ICS workstations.bat’ on desktop in the Batch Files folder) – only do this if you didn’t pause some migrations, if you did then just restart CMT worker process on each machine that does not have a paused migration. After machines have restarted, reconnect to them.
11. Double-click the ‘CMT Universal’ shortcut on the desktop, click on Users… button (CMTu starting is an indicator that the issue is fixed but it’s also good to check that the ‘null’ error is not showing up in Kiwi Syslog)
12. Sort by Status column then walk the list of users starting with those that indicate ‘In progress’ (none of the values will be accurate and need to be reset). Note that it’s also best practice to take care of all the Exchange migrations before doing the Proofpoint migrations.
13. Right-click user, click Properties… and look for machine user was migrated on (Migration_Details/Migrated_by)
14. Go to the workstation indicated in CMT properties open c:\program files\cmt universal\logs, sort by date, most recent first and open the last log file for that user and check migration status.
15. Go back into CMTu and take one of the following actions:
a. If log on workstation reports user as ‘Migrated successfully’ then copy that into CMT properties ‘Migration_Status’ then click in an empty field then exit properties. User should show in CMTu as Migrated successfully
b. If log shows user ‘Migrated with errors’ or log is truncated with no summary then reset user and send back to same workstation and be quick. Note that once reset the EMM auto code may pick up the user and assign them and it may not be back to the same machine however I found that the message history of already migrated messages is by this time generally in the Access table so it’s generally not an issue. It is however a good idea to check that user doesn’t have duplicates by connecting to their mailbox after migration has completed. After re-setting, check to see if migration has stated on the migration workstations.
c. If CMTu properties doesn’t have a value for ‘Migrated_by’ then likely user was pending. Reset the user but don’t manually assign it for migration as the auto send code will do this for you.
d. If there is no log in the workstation for the user, reset the user in CMT. No further action is necessary.
16. Once you’ve gone through all the users migrations then you should restart CMTu interface since it will not update status till you close and re-open. After re-opening any users you marked as ‘Migrated successfully’ should be gone (picked up by EMM).
17. Monitor migration workstations for user progress

Migration Enviornment Planning

2011-04-10T05:31:00.000-07:00

Migration Environment Planning

Introduction

Messaging platform migration to Microsoft collaboration unit or Cloud is one of the most challenging tasks for any administrator. It is not equivalent to the daily task which all the administrators perform as their routine work. It requires lots of analytics to plan for successful migrations. Email systems today are the most critical applications in any organization and treated as the backbone for successful business operations. The migration consultants have to consider various aspects of migrations upfront to cater business needs of the customer including the risk factors involved.There should be separate planning for in-house and cloud enviornment but the migration enviornment planning will remain same because we can use the same tools while migration to in-house or cloud. This white paper provides the migration consultants plan carefully the migration environment for moving legacy messaging platform to MS Exchange or Cloud. This white paper will only talk about how to carefully plan for a migration environment but not the complete migration process. The entire process of planning a migration environment involves:

1. Planning.

2. Evaluation of tool.

3. Tool testing.

4. Capacity Planning.

5. Risk Analysis.

Planning

Planning for the migration environment is the most critical part of the complete process. This step will provide the architecture of the migration environment, its location, efficiency required, It involves:

• How the migration should be carried out?

• Location for migrations (in-house, hosted, cloud)?

• Migration windows?

• No of user’s per migration window?

• Migration budget and budget allocated for migration environment?

Evaluation of tool

Evaluation of the tool is to settle on the right tool that should be used to carry out successful migrations. There are various tools from different vendors to carry out the migrations. Selecting a right tool is a difficult task and required involvement of business analyst, technical architects and migration consultants. Business analyst will handle the communication and comparison part of the tool. Technical architects will consider the feasibility of the tool and align then with the customer requirements and migration consultants are required to evaluate the tool for its configuration challenges and ease of operations. Below is the list of some common things which we can use to evaluate a tool.

Business

1. Cost of the tool- Per User Licensing of the tool with discount offered

2. Market share- How many migrations has been done so far using the tool

3. Compatibility with source platform- How compatible the tool is with source messaging platform

4. Support - What support the tool vendor will offer during the migration

Functional

1. Feature comparison - What feature tool can migrate from source platform to destination?

2. Communication - Inbuilt features for user communication during migration

3. Reporting - Reporting features provided within the tool.

4. Additional Features - What additional features are provided in the too like coexistence, directory export etc.

Technical

1. System requirements - Requirements to install the tool

2. Configuration changes - Various configuration required to use the tool

3. Usability - Ease of handling the tool for migrations

4. Performance - Performance thresholds for various activities

5. Compatibility - Compatibility with other third party tools.

The above list is a small snapshot for evaluating the tool. We can add additional parameters to these on case to case basis. Apart from listing these items we need to prioritize all items:

• How important is each item in the list?

• Can the migration take place if it’s not there?

• Business impact if the item is not available?

• Can we compromise?

We need to check with the customer for answers of these queries and provide assistance to them for possible solutions. Based on the answers of these queries we can select the best tool for migrations.

Testing of Tool Once we have selected the tool for migration we have to test if it can deliver the solution in the desired environment. One should make sure to have done the proper test with appropriate size of file before deploying the tool. Test should be conducted for:

• Speed

• Accuracy

• Performance

• Features

Many times during testing the tool we ignore minor features but they can create major problem during production migration. So it’s advisable to test all the features and perform regression testing on the tool before final deployment.

Capacity Planning The Migration Tool can be run on either the source system, an intermediate system, or the target system. Parallel instances of the Migration Tool can be run, as well, on the different locations. Capacity planning is required to create a stable migration environment. We need to consider below factors while doing the capacity planning for a migration environment.

• Memory

• Disk Space

• Network Bandwidth

• Physical or Virtualized

• No of machines

Memory - The amount of memory required to perform a migration is dependent upon such variables as the volume of data to be migrated, the profile of the message store, concurrency of the process, and size of messages. As a very general guideline, the minimum memory requirement is 512 megabytes (MB) of random access memory (RAM).

Disk Space - Temporary storage is required for concurrent migration of users. During migration, all the source data is stored locally to a temporary location and then migrated from there to the destination environment. Migrations can fail if the migration server doesn’t have sufficient temp storage.

Network Bandwidth - The Migration Tool network bandwidth requirements are the same as those for email clients, although, for high speed migrations, more bandwidth is required. To complete large mailboxes on time we need to send them to the migration consoles with higher bandwidth so plan carefully for the network bandwidth required performing migrations. Check the vendor for the maximum throughput the tool can handle because if the tool cannot handle a given throughput (MAX) then it is of no use to add additional bandwidth for user migrations.

Physical or Virtualized - You need to check the best option for your migration environment. If you have sufficient resource then choose the physical option else the best strategy is to go for virtualized environment to reduce the hardware. It will also reduce the cost for migration environment as we need to decommission the migration environment after production migration.

No of machines - Calculate the number of machines required to perform the migrations. We can calculate this from the data to be migrated in a migration window with provided throughput. A sample calculation for number of migration machine required is:

Migration machines = (Data in GB * migration hours)/Migration throughput

Also plan if we require an addition workstation for migration troubleshooting, else we can use the migration workstations for troubleshooting as well.

Risk Analysis

This is an additional phase which most of the migration consultants ignores but it is very essential for a 100% accurate migrations. This step required previous migration experiences and need to analyze all the risks in advance. It is always better that migration consultants should be able to identify the risks involved in migration upfront and plan the steps required to mitigate them. It should involve the following

• Tool issues • Post migration issues

• Environmental factors

• Resource allocation

Mail Coexistence and Migrations from Lotus Domino to MS Exchange 2007 using Quest NME

2010-12-13T19:07:00.000-08:00

This video covers all the steps involved in mail migration from Lotus Domino to MS Exchange using Quest tool ( NME).

Happy Migrations :)

Coexistenace and Migration from Lotus Domino to MS Exchange using BT- CMT for Exchange

2010-09-26T22:09:00.000-07:00

This video covers all the steps involved in mail migration from Lotus Domino to MS Exchange using Binary tree tool ( CMT for Exchange).

Happy Migrations :)

Changing SMTP Banners

2010-08-31T21:10:00.000-07:00

We use SMTP command (SEND) using telnet to servers for sending mails or troubleshooting. While using this command, once we connect to the SMTP server we receive reply like:
220 mail.domain.ext ESMTP ?version-number?; ?date+time+gmtoffset?

This is called SMTP banner. Best practice is not to reveal all information in the banner to protect it from intruders.
We will now look how to change this banner.
RFC 2821 requires all server responses to start with 220 when the service is ready to receive mail. Specifically, the recommended format is this;
220 Service ready
So when we customize our banner, we want to make sure that if our SMTP server does not prepend the response with 220 for us, we include that in our text string.

Exchange 2007-2010 SMTP service
In Exchange 2003 we can change the banner via IIS (SMTP service for 2003) but with Exchange 2007/2010 we have a inbuilt SMTP service. We must remember to start the response with the 220.
1. Open the Exchange Management Shell as an administrator.
2. Enter this command, where ‘your text’ is the response you want. Both the “From the Internet” and the “220 your text” must be enclosed in quotes
Set-ReceiveConnector "From the Internet" -Banner "220 your text" [enter]
This will take effect immediately, without requiring you to restart the service.

Lotus Domino
In Exchange we have to add 220 codes to the string but Domino itself will prepend this code.
1. From the Domino Administrator, open the Domino Directory and click the Configuration tab.
2. To modify NOTES.INI settings on the server, click the NOTES.INI Settings tab. This tab lists a number of current settings in the server’s NOTES.INI file.
3. To add or change a setting, click Set/Modify Parameters to display all settings that you can set in the Configuration Settings document. Select the variable SMTPGREETING.
4. Set the string to whatever you want. You can use %s as a variable for the system date/time.
5. Save and close the document.
This will change the default banner on your SMTP server. It will help you from anyone stealing information from SMTP servers.

MS Transporter Suite 2007 setup for coexistence and migration from lotus Domino to MS Exchange 2007

2010-06-11T22:16:00.000-07:00

MS Transporter Setup

Prerequisites

1. Install Windows Server 2003 with SP2 on two Images
2. Provide similar IP range to Image1 and Image2 so that they can connect to each other
3. Configure you Domain Controller and Active Directory on Image1
4. Configure Exchange Server on (If you are installing Exchange and Domain controller on different machines and trying to use Outlook on a domain controller then there are few additional steps you need to take so that outlook work fine.
In order to configure Outlook on a Domain Controller or on a Global Catalog server, carry the below steps on the target server,
A. Open Domain Security Policy and browse to Local Policies  User Rights Assignment, Ensure that the particular user is provided Allow Log on locally rights.
B. Open Domain Controller Security Policy and browse to Local Policies  User Rights Assignment, Ensure that the particular user is provided Allow Log on locally rights.
C. A Now we need to force Outlook to point to the closest GC, use the below steps to perform this action
a. Open Registry.
b. Locate and then click the following key:
HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exchange Provider
Note you may have to create the registry path
On the Edit menu, click Add Value, and then add the following registry value:
1. Value name: Closest GC
2. Data type: REG_DWORD
3. Radix: Hexadecimal
4. Value data: 0x00000001
Restart the System and then login with the desired user profile, now you would be able to configure the outlook for this user.
5. Install Lotus Domino Partitioned server (LotusMail and LotusBT) on IMAGE2
5.1 To install three partitioned server add two IP addresses to the same LAN card.
5.2 You have to make changes in notes.ini to properly run these Domino Partitioned servers.
Add additional lines in notes.ini “TCPIP_TcpIpAddress = 0, IP address (of the current partitioned server). Ex: If you are editing LotusMail server’s notes.ini, then use the IP address assigned for LotusMail server. So whatever IP address you specify here, will be assigned to that partition server.
5.3 Create host entries for all the domino servers in DNS so that they can recognize and trace each other.
6. Domain name for Domino and Exchange should be same
7. Install Lotus Notes Client with Admin ID on Exchange Server and outlook client on Domino Server with Admin ID’s

Installation and Configuration
8. Install transporter Suite on Exchange Server and Transporter add-in on Domino Server.( If you want to install Transporte Suite on a separate machine then you need to have Windows Management tools installed on that machine).
9. Now for Directory Synchronization create a new Directory for exchange on Domino BT server
With a virtual domain name. This same domain name will be used at the time foreign domain document creation. Create a new OU for domino names.nsf users on Exchange as contacts. Directory Synch will use the ID of lotus notes installed on Exchange server to synch with Domino Server.
10. Provide manager access to admin ID on new address book and Exchange Secuirty group full access to new OU.
11. Add a new line in notes.ini with primary and new address book
ex: names=names.nsf, exchange.nsf
12. Create a new domino connector and configure it properly. Now synchronize both the directories.
Note:
 If you face any difficulty during directory synch then check application logs for possible errors.
 To set transporter even logging level use the command : Set-TransportEventLogLevel –high
 Notes.ini path should be there in environment variables.check this by using the command get –dominodirectoryconnector
13. Users from AD will come in new directory on domino and domino users will come in new OU in exchange.
14. The Directory synchronization process uses four control files, which are located in the \Program Files\Microsoft Transporter Tools\Config\Connector folder. These files contains the attributes that will be synchronized. The files are:
a. DominoAttributes.tbl: Maps Domino attributes to “intermediate schema” attributes.
b. ExchangeAttributes.tbl: Maps Active Directory attributes to “intermediate schema” attributes.
c. DominotoExchangeRules.tbl: Defines the rules for constructing values in the Directory Connector namespace targeted for Active Directory.
d. ExchangetoDominoRules.tbl: Defines the rules for constructing values in the Directory Connector namespace targeted for the Domino directory.
Note:
a. If you edit these files using Notepad or another Text Editor, make sure that you save backup copies of the shipped files.
b. Do not use the Tab key when making changes — all white space characters should be entered using the space key.
c. Ensure that directory synchronization is not active when editing the files — stop the
Microsoft Exchange Directory Connector Service for Lotus Domino.
15. Install Microsoft Mapi Cdo on exchange server as it is required for proper functioning of free busy connector.
16. Check if there are any public folders on exchange side using the Exchange Shell command
Get-Public Folder -Identity "\NON_IPM_SUBTREE\SCHEDULE+ FREE BUSY" –Recurse
If it’s not then create a new one using exchange management console.
17. Type the following command in the Exchange Management Shell to add the Domino and Exchange server’s address space.
Add-AvailabilityAddressSpace -ForestName -AccessMethod PublicFolder
This is required when you want to do a free/busy lookup between cross forest Exchange organization. So if from an Exchange 2007 organization you want to do a free busy look up on exchange 2003 server or domino server then you need thi s command as you have to tell exchange 2007 to use public folders in the target domain because Exchange 2007 does not use public folders by default for free busy look ups but Exchange 2003 does.
Restart Microsoft System Attendant service
18. Remove SSL requirements from Public folders.
19. Open IIS and go to Public folder under “Default Virtual Directories”
Go to Public folder properties
In the “Directory Security” tab and in the secure communication click on edit.
There remove all the check boxes.
Now save and restart IIS.
20. Now create a free busy connector and start the free busy service.
* Free busy service will not start if Exchange MAPI Cdo is not installed
21. To let Domino connect to Exchange server we have to create a foreign Domain document.
1. On the General Tab Leave the Domain type as Foreign Domain. Foreign domain name should be same what you have defined in the Directory Synchronization Connector on the Exchange server and the Exchange Directory profile document
2. On Mail Information tab type the Coexistence server’s name (BT Server)as the Gateway server name, and specify mail.box as the Gateway mail file name.
3. On the Calendar Information tab, type the Coexistence server’s name, (BT Server) , as the Calendar server name, and specify mail.box as the Calendar system. best practice is to create a new mail.box(ex: transporter.box) from the Mail Router Box template(mailbox.ntf) and use it in both Mail Information and Calendar Information tab.
4. Replicate domino directory to all other mail server. You can also create connection document to schedule the replication interval between domino servers.
5. Update the router table by using the command “tell router update config”
22. Load Excalcon task on BT domino server by using this command
Load excalcon mail.box
Or add the parameter “excalcon mail.box in “server task” line in notes.ini.
*Here the exchange server name is the host name. if the host name doesn’t work then please use the fully qualified domain name.
23. To send/receive mails from Exchange end we have to perform few tasks
a. On the Hub transport server create a new Accepted domain with the domain name exchange1.exchmig.com and make this as Authorative
b. Create a new email address policy for this new domain so that all the users with exchange mailboxes, Resource mailboxes and mail enabled groups have two email addresses first @exchmig.com and second @exchange1.exchmig.com
c. Create a new send connector with the smart host routing to Domino server i.e lotusbt.exchmig.com.
d. Now create a new receive connector with the remote network server as again the domino server. Go to properties of receive connector and on the authentication tab deselect TLS and externally secured and on the permission groups tab select Anonymous users, exchange server and partners. If you will not do this option then you will receive an NDR while sending mails from domino to exchange that “ Client is not authenticated”
24. To send/receive mail from domino end we to again perform some additional steps
a. Create a new foreign SMTP domain document with following parameters
Internet domain - exchange1.exchmig.com
Domain name - SMTPExchangeDirect
b. Create a new SMTP connection document with following parameters
Source Server – LotusBT/Exchmig
Destination server – ExchAd.Exchmig.com
Domain – SMTPExchangeDirect
SMTPrelayhost – ExchAD.Exchmig.com
Replication task – disabled
Routing Task – SMTPMailrouting
1message pending and routing cost=1
Scheduled –enabled(12:01AM – 11:59PM) repeat 60 min each day
c. Enable SMTP mail routing and SMTP listener task on the coexistence server
d. Create/Edit(if exist) configuration document for coexistence server(LotusBT)
In Router /SMTP tab change these parameters
Number of mailboxes: 1
SMTP Used when sending messages outside local internet domain: Enabled
SMTP allowed within the local internet domain: Disabled
Servers within the local Notes domain reachable via SMTP over TCP/IP: Always
Address lookup: Full name then Local Part
Exhaustive lookup: Enabled
On the MIME Tab, select Conversion Options and navigate to General and change Return receipts to Enabled. Finally, on the MIME Tab, select Conversion Options and navigate to Outbound Conversions Options and change the message content to, From Notes to HTML as shown below.
e. Replicate domino directory
25. Now start with sending mails from both the sides and check the calendar synch between Exchange and Domino.

Migrations

26. For migrations using MS Transporter Suite 2007 there are few prerequisites:
a. Create a new OU in AD for migrated users.
b. Create catalog.nsf on domino end and provide access to the migratory ID
c. The Active Directory user used to perform the migration must have permission to impersonate the users to inject mail into their mailboxes .Perform impersonation on exchange management shell so that the migratory account can perform migrations for all users.
Add-ADPermission -Identity (get-exchangeserver).DistinguishedName -User (Get-User -Identity User1 select-object).identity -extendedRight ms-Exch-EPI-Impersonation
d. Open transporter suite click on migrate->directory->users. select the user we want to migrate and click migrate users. this step will create a new AD object and exchange mailbox for this user and.
e. Now click on migrate ->mailbox and click on “migrate selected mailbox”
f. It will migrate the mailbox.
Note:
1. MS transporter suite works on multithreaded mode but threads on a single mailbox at a time. Threads are open TCP connections to the same target mailbox, not multiple concurrent mailboxes. The tool only support connecting to one target mailbox at a time; to increase this you'd need to run it on multiple workstations
2. To resolve SSL cert error. open the error source URL in internet explorer and install the certificate to resolve the issue.
3. For organizations that have message size limits greater than 4 megabytes (MB), the maximum attachment size for Web Services must be increased. We recommend that you increase this limit for the duration of migration anyway. You increase the message size limit by editing the web.config file in the exchweb\EWS subdirectory of the ClientAccess directory on each CAS, adding a line similar to the following in the section (this line sets the maximum to 10 MB):
4. If you find “matching user not found” or “IPC port error” refresh the view few times.it might be due to network latency.
5. The Transporter Suite uses Exchange Web Services to inject messages into a user’s mailbox, and the Client Access Server used is determined by AutoConfiguration in the default case.If an error indicates “Could not retrieve E12 Web Services URL,” this could be due to AutoConfiguration not being configured correctly, or that the target Client Access Server is not available.

Coexistence and Migration using MS Transporter suite 2007

2010-05-24T20:20:00.000-07:00

This Video covers all the basic steps for coexistence and migration between Lotus Domino and MS Exchange.

Happy Migrations :)

BinaryTree Coexistence Webinar April 14, 2010

2010-04-15T06:03:00.001-07:00

Check out this SlideShare Presentation:

BinaryTree Coexistence Webinar April 14, 2010

View more presentations from danalsip.

Configure Domino Partitioned Server

2009-09-22T23:59:00.000-07:00

1. Configure your network card with a new IP address
Windows:Control Panel --> Network Connections --> Local Area Connection --> Properties-- If re-using same NIC, then simply add an additional IP address to the card.-- If configurating a disabled, un-used Local Connection (NIC), then edit it's properties and assign an IP address, and enable it.

2 If the existing Domino server partitions are not already bound to specific IP addresses, update the notes.ini file.
- Under the lines:
Ports=TCPIPportname
TCPIPportname=TCP, 0, 15, 0
add this line:
TCPIPportname_TCPIPAddress=0,IPaddress

Example:
1st server:
Ports=TCPIP
TCPIP=TCP, 0, 15, 0
TCPIP_TCPIPAddress=0, 192.168.112.2(Address of first server)

2nd server:
Ports=TCPIP
TCPIP=TCP, 0, 15, 0
TCPIP_TCPIPAddress=0, 192.168.112.3(address of second server)

4. Register the new server.
- Register the new server in the appropriate OU or O.
- Make sure you don't give the server password.
- Make note where the new ID is located, so we can copy it to the new data directory once the directory exists.
Note: This could have obviously been done before now or after the next step.

5. Create additional partition for new server.
Notes:
- You can do this "manually", by using an existing data folder's ini and templates and wiping the ini you copied. However, the recommened right way is to re-run the install program, specify the same /opt/lotus, but add a new data folder when that path comes up.
- For the iSeries, verify the LOTUS_SERVERS file contains the correct data directory path and partition number, "/qibm/userdata/lotus/LOTUS_SERVERS", where each server has a "SERVER=" entry.

6. Perform the setup of the new server.
- Copy the new server's id to its data folder.
- Do NOT start the server after you finish setup. You aer going to want to update the INI with its specific IP Address.

7. Now that we have a notes.ini, let's edit it and restict the old and the new server to their IP addresses by editing each notes.ini file as in step 2 above.
- Shut down the existing domino server for a moment to update it's IP address. Alternately, you should be able to simply edit the notes.ini and restart ports.
- Edit the notes.ini of the new setup server and specify its unique IP address. Don't forget to add the POP3, IMAP, SMTP, and LDAP lines, too, if they are running.

8. Start the new server.
- Restart the ports or restart the existing (newer) server and watch its console/log for errors.
- Verify that services for the existing server are binding to the correct IP address. NPing (NConnect) tool works great for this.
- Start the new server and watch its console/log for errors.
- Verify the new server is behaving and binding (only) to its correct IP address.

Font Issues in Lotus Notes

2009-05-07T09:07:00.000-07:00

Sometimes you receive or send mails from or to external domain with distorted characters. the possible reason from the server side is incorrect MIME settings or MIME conversion. check the MIME setting on the server as well as Person document for the field
"Format preference for incoming mail:".
Please use "Keep in senders' format" in this field for best fidelity.
but if the server side settings are correct and still users face this issue then there might be some changes required from the Lotus Notes client side or OS(windows) side.

from the client check the location document for the field
"Format for messages addressed to internet addresses:" use notes rich text format for best result.but the last option which I found for the character distortion is to check the regional settings on your OS and use support for all the languages.

For the email containing the distorted characters check the Fonts for those characters and then check the font in Windows Character Map as shown below.Looking at this font in the character map in Windows, you can check if the font contain English characters (other than numerals and punctuation), If it doesnt then this may explain why it is inconsistent in display.

to resolve this Please access Control Panel -> Regional and Language Settings -> Languages tab and add support for complex script and East Asian languages. See if this affects the behavior of your client when viewing this font. ,most of the time its not an issue with the Notes client, but with the use of multiple uncommon fonts by the sender.

The best/easiest solution to resolve the issue for all users may be to simply request that the sender use more standardized and widely available fonts in the emails.

Communication between multiple Lotus Sametime Servers

2009-04-14T21:49:00.000-07:00

confirm that your Lotus Sametime servers are members of the same community

To check the "Community" settings in the Lotus Sametime Web administration client.
Open a Web browser, go to the Sametime Web Administration Utility (http://yourserver/stcenter.nsf and choose the "Administer the server" link), expand the "Configuration" heading and then choose the "Connectivity" option.
When the "Configuration - Connectivity" page opens, click the "servers in this community" tab.
If you see both the primary server and secondary server under the "Meeting Servers that are connected" section, your Lotus Sametime servers should be able to communicate with one another.

If both servers are members of the same Domino domain, then you simply need to create a Sametime connection document in your Domino directory, similar in the way to creating a replication connection document.
In your Domino Administrator client, go to the configurations tab, expand the Server's Twistie and then choose "Connections."
On the Action Bar, choose "Add Connection", make the connection type "Sametime", complete the Source (Primary server) and Destination (Secondary server) server fields and add an optional network address for the destination server.
Add another connection document going in the other direction.
Give your system a little while to detect the new configuration, and you should see both Lotus Sametime servers listed as "Connected" in the sametime Web administration utility.

If your servers are not part of the same Lotus Domino domain, then you will need to do a little more work:
Cross certify the two servers , so that the servers trust one another.
Configure Directory Assistance on both Lotus Sametime servers, so the servers can access one another's directories.
Create the Lotus Sametime connection documents described above, so the Lotus Sametime servers can communicate.

Restrict Specific Client to use SameTime Functionality

2009-01-22T03:35:00.001-08:00

In the Server document you have restricted access to the server to a limited number of users by setting the following fields:

Security tab -> Who can Access Server

Security tab -> Who can NOT Access Server

This works as expected for most Sametime functions in that it refuses access to any users not named in the Server Access field. However, users using Sametime Connect can still access the server for chat functionality.

Answer : The "Who can Access Server" and "Who can NOT Access Server" fields are working as designed. For Sametime Connect instant messaging, the only authorization required is to have an entry in the Domino Directory, which has an HTTP password.

There are various ways to secure the server to prevent unauthorized users from accessing the server.

I - Preventing usage of Instant Meeting functionality and Sametime Connect for Browsers.

II - Preventing usage of Sametime Connect

III - Restricting specific Sametime Connect client

Part I: Preventing usage of Instant Meeting functionality and Sametime Connect for Browsers

It is possible to restrict access to instant meetings and Sametime Connect for Browsers (Java Connect) by restricting access to the stsrc.nsf database. This database is used to hold design elements for the Java Connect client and instant meetings loaded via Connect clients.

Edit the Access Control List (ACL) of the stsrc.nsf database on the Sametime server.

a. Change Default to No Access and remove the "Read Public Documents" option, as well as the "Write Public Documents" option.

b. Change Anonymous to No Access and remove the "Read Public Documents" option, as well as the "Write Public Documents" option.

c. Add a Group to the ACL that contains the users who should have access to the Sametime server. Give the Group Author access.

d. Create a new entry in the ACL: Sametime Development/Lotus Notes Companion Products. This must be set to Unspecified - Manager.

Make sure this entry exists for the Meeting Center, as well STConf.nsf.Users attempting to join an instant meeting or launch Sametime Connect for Browsers will be presented with a login screen, but will see the error "You are not authorized to perform that operation" after entering their credentials.

Part II: Preventing usage of Sametime ConnectPreventing users from running/Downloading Sametime Connect

It is currently not possible to prevent the downloading of the Sametime Connect client; essentially everyone who is listed in the Domino directory can download and use the Connect client. There are many corporations that have a concern about this and do not wish to allow this type of activity. There are multiple ways to prevent this.

a. Disable download links on home pageYou can disable the links that allow users to run the Java Connect Client and also disable users' ability to download the Sametime Connect client for Desktops. This is done by going into the "Administer the Server" link on the stcenter.nsf page and then clicking into "Configuration - Community Services". In this section, uncheck the boxes that are labeled:- Display the "Launch Sametime Connect for the desktop" link on the Sametime Home page, and- Display the "Launch Sametime Connect for browsers" link on the Sametime Home page (Stcenter.nsf).

b. Fill in the Sametime server field with a bogus server nameNote: this solution is for use with Domino directories, or Domino LDAP directories. For other LDAP implementations, see Part IV below.Use an agent to populate the "Home Sametime Server" field with a valid Sametime Server name for authorized users. Fill in all of the other users' Sametime Server fields with a rogue (bogus) name such as Foo/Foo. Users may receive a confusing error message if they attempt to Chat when an invalid Sametime server name is entered in the Sametime Server field of their Person document.

Part III: Restricting specific Sametime Connect client versions.

Sametime uses a Client ID to determine the type and version of client connecting to the Sametime server. If you need to restrict access so that only Sametime clients above a certain version are allowed to connect, you can do so by using the following parameter in the sametime.ini:[Config]VPS_ALLOWED_LOGIN_TYPES=To use this parameter, specify a comma separated list of client types which are allowed to connect. A full list of client types can be found in Technote 1114318.

Clients who login to a Sametime server declare their login type upon login, as follows:
A Sametime server can be configured to allow only certain clients to login based upon their unique Client ID. The following flag can be added to the [Config] section of the sametime.ini:VPS_ALLOWED_LOGIN_TYPESto specify the allowed login types. The flags affect all logins where this Sametime server is the home server. By default (if this flag is not specified) all login types are allowed.

Example:[Config]VPS_ALLOWED_LOGIN_TYPES=1001,1002

Note: The client filter is only available on:Sametime 3.0 IF3Sametime 3.1 with a hotfix. Please contact Lotus Technical Support for a copy of the fix.Sametime 6.5.1Sametime 7.x

Lotus Notes Basic and Standard Configuration

2008-12-15T11:01:00.000-08:00

For those who are not aware, Lotus Notes version 8 comes with two versions

Lotus Notes Basic Configuration
Lotus Notes Standard Configuration

For those who are already deploying version 8, have probably noticed that the memory requirements are higher than those of previous versions. They actually doubled from 256 required to 512 required and 1gb recommended. On any machine less than 512 or less than 1gb that is having performance issues please do one of the following:
1.
Install the Notes 8 client - then modify the shortcut with the following command line parameter:
\lotus\notes\notes.exe -basic
The "-basic" command line switch will run a simplified user interface closer to version 7 but with some features of the 8 client but not all.
2.
A new feature has been added to Notes 8.0.2 that allows customers to install the 8.0.2 Notes Standard client, but launch the Basic client based on a Notes.ini parameter UseBasicNotes=1. This notes.ini parameter will allow external programs that launch notes, such as a MailTo: URL, or launching an NSF file directly, to launch notes in Basic mode if UseBasicNotes=1 is set in the Notes.ini. This will allow customers to rollout a single package, but define which users will launch Basic vs Standard via this notes.ini parameter. For example, if a machine does not meet the hardware requirements of 8.0.2 Standard, but does for Basic, this will allow the client to launch in Basic mode until hardware has been upgraded, By default, this parameter is not in the notes.ini and will launch the Standard client if it is omitted or set to 0. Notes.ini parameters can be pushed out via administrative policy, which make it easier for customers to centrally control this feature.

3.
There is one more work around where you can go to command prompt and move to data folder. launch the Notes client using command linenotes.exe -basic

General Sametime Error Codes

2008-11-17T12:00:00.000-08:00

We always check sametime.log for troubleshooting Sametime related issues but generally messed up with ambiguos error codes. I have found meaning of some general error code related to Sametime and sharing with everybody

General error/success codes
operation succeeded --- 0x00000000
operation failed --- 0x80000000
request accepted but will be served later --- 0x00000001
request is invalid due to invalid state or parameters not logged in to community --- 0x80000001 or 0x80000002
unauthorized to perform an action or access a resource --- 0x80000003
operation has been aborted --- 0x80000004
the element is non-existent --- 0x80000005
the user is non-existent --- 0x80000006
the data are invalid or corrupted --- 0x80000007
the requested feature is not implemented --- 0x80000008
not enough resources to perform the operation --- 0x8000000A
the requested channel is not supported --- 0x8000000B
the requested channel already exists --- 0x8000000C
the requested service is not supported --- 0x8000000D
the requested protocol is not supported --- 0x8000000E
the requested protocol is not supported --- 0x8000000F
the version is not supported --- 0x80000010
user is invalid or not trusted --- 0x80000011
already initialized --- 0x80000013
not an owner of the requested resource --- 0x80000014
invalid token --- 0x80000015
token has expired --- 0x80000016
token IP mismatch --- 0x80000017
WK port is in use --- 0x80000018
low-level network error occurred --- 0x80000019
no master channel exists --- 0x8000001A
already subscribed to object(s) or event(s) --- 0x8000001B
not subscribed to object(s) or event(s) --- 0x8000001C
encryption is not supported or failed --- 0x8000001D
unexpectedlyencryption mechanism has not been initialized yet --- 0x8000001E
the requested encryption level is unacceptably low--- 0x8000001F
the encryption data passed are invalid or corrupted --- 0x80000020
there is no common encryption method --- 0x80000021
the channel is destroyed after a recommendation is made connect elsewhere---
0x80000022
the channel has been redirected to another destination --- 0x00000023

Connection/disconnection errors
versions don't match --- 0x80000200
not enough resources for connection (buffers) --- 0x80000201
not in use --- 0x80000202
not enough resources for connection (socket id) --- 0x80000203
hardware error occurred --- 0x80000204
network down --- 0x80000205
host down --- 0x80000206
host unreachable --- 0x80000207
TCP/IP protocol error --- 0x80000208
the message is too large --- 0x80000209
proxy error --- 0x8000020A
server is full --- 0x8000020B
server is not responding --- 0x8000020C
cannot connect --- 0x8000020D
user has been removed from the server --- 0x8000020
EVP protocol error --- 0x8000020F
cannot connect because user has been restricted --- 0x80000210
incorrect login --- 0x80000211
encryption mismatch --- 0x80000212
user is unregistered --- 0x80000213
verification service down --- 0x80000214
user has been idle for too long --- 0x80000216
the guest name is currently being used --- 0x80000217
the user is already signed on --- 0x80000218
the user has signed on again --- 0x80000219
the name cannot be used --- 0x8000021A
the registration mode is not supported --- 0x8000021B
user does not have appropriate privilege level --- 0x8000021C
email address must be used --- 0x8000021D
error in DNS --- 0x8000021E
fatal error in DNS --- 0x8000021F
server name not found --- 0x80000220
the connection has been broken --- 0x80000221
an established connection was aborted by the software in the host machine---
0x80000222
the connection has been refused --- 0x80000223
the connection has been reset --- 0x80000224
the connection has timed out --- 0x80000225
the connection has been closed --- 0x80000226
disconnected due to login in two Sametime servers concurrently--- 0x80000227
maps to 0x80000227
retained for compatibility with--- 0x80000228
disconnected due to login from another computer. --- 0x80000229
unable to log in because you are already logged on from another computer---
0x8000022A
unable to log in because the server is eother unreachable, or not configured
properly.--- 0x8000022B
unable to log in to home Sametime server through the requested server, since your
home server needs to be upgraded.--- 0x8000022C
the applet was logged out with this reason Perform relogin and you will return to
the former state. --- 0x8000022D

Client error codes
the user is not online --- 0x80002000
the user is in do not disturb mode --- 0x80002001
can not login because already logged in with a different user name (Java only)8.3.1.4 IM error codes--- 0x80002002
cannot register a reserved type --- 0x80002003
the requested type is already registered --- 0x80002004
the requested type is not registered 8.3.1.5 Resolve error codes--- 0x80002005
the resolve process was not completed, but a partial response is available---
0x00010000
the name was found, but is not unique (request was for unique only)--- 0x80020000
the name is not resolvable due to its format, for example an Internet email
address --- 0x80030000

Replication and ACL

2008-10-16T12:12:00.000-07:00

ACL (Access Control Lists)
ACLs limit access to databases. The ACL define what actions each type of user is allowed to take. Legend: Y=Yes by default, N=No, O=Optionally

Users obtain the highest level of group or explicit access when assigned to multiple groups with different access levels. To replicate, a server needs to be at least an Editor.
Only one server should have Manager access to a database. If the ACL of databases in a replica are changed, one of them would be lost during replication.
Access lists of design elements further restrict access granted by ACLs.
Authors can edit the documents they create. If there is an Auths Authors field on the form, the user must be listed in the Authors field. Authors have Reader access by assumption.
Reader access allows you to read all documents unless there is a Rdrs Readers field on the form. Then you can read a document only if your name is listed in the Readers field.

Replication Type

Indexes are not replicated.
Replications can pass through another server.

Replicas can have a different filename than the database being replicated.
Replicas need not be on other machines. Several users can share an address book by making a replica of the names.nsf database with a different name (i.e., names2.nsf) on the same server. The other users get get ACL rights to open and bookmark the names2.nsf.
By default, replication is performed to all files identified with the same Replica ID displayed in Database Properties Information tab.
Replication occurs in this order:
1. ACL changes
2. Design changes
3. Document changes
To perform field-level replication, Domino compares the document's Sequence Number with the sequence number on a replication alert:
If the number is unchanged, replication is performed.
If both have been changed:
if Merging has been enabled:
...
if Merging has NOT been enabled, a conflict document is produced.
Fewest edits
Least recently modified
The Replication service:
is enabled with this line in the Notes.ini file:
ServerTask=Replica
can be scheduled in the Connection document or initiated manually:
load replica
can run a maximum on 10 replica tasks at the same time
The highest level of detail in logs is controlled with this configuration parameter:
LOG_REPLICATION=4
Here is a list of factors affecting replication, arranged in a way to better remember what goes where:

The Server Connection document specifies whether the replication task is enabled, the Replication Type Style, and the Time Limit.
Most replication problems occur because of inaccurate server ACL configuration settings in the databases. So first replicate the partner's ACL in File > Replication > Setting > Advanced > Replicate Incoming > Access Control List.

Disaster Recovery and Server Crash Recovery in Blackberry Enterprise Server with Lotus Domino

2008-09-10T22:05:00.000-07:00

Disaster Recovery and Server Crash Recovery in Blackberry Enterprise Server with Lotus Domino
Task 1 - Backup the data that is stored within IBM Lotus Domino
The following items should be backed up on a daily basis in addition to regular operating system and Lotus Domino file backups:
1. System State(OS registry backup)
2. Notes.ini
3. Server ID file
4. BlackBerry Profiles Database – BlackBerryProfiles.nsf
5. All BlackBerry State Databases – in the x:\Lotus\Domino\Data\BES\State folder
6. Bbprofiles.ntf, bbsd.ntf, blackberryqueue.ntf
7. If regular database maintenance tasks are run nightly, perform the backup before running these tasks
Ensure that the same code level is used when restoring the database
1. Unless you are running a Lotus Notes Database-aware backup product, you must shut down the BES Add-in task in order to obtain full backups while
backing up the files listed above
2. An additional database is associated with the BlackBerry Enterprise Server, the BlackBerry Outbox (BlackBerryOutbox.nsf). Since this database
is time-specific, do not restore this file; let it be re-created when the server restarts and the BES Add-in task is run.
3. Ensure that the following two items remain the same for the BlackBerry Enterprise Server: the host-resolvable name and the SRP ID and SRP Authentication Key. All BlackBerry users who use the BlackBerry Desktop Manager connect to the same server each time they start the application.The name of the BlackBerry Enterprise Server is hard-coded into the registry of their client computer. It is critical that the host resolvable name remains the same so users have a seamless startup after a server has been restored. To avoid making all users insert their handhelds in the cradle and generate a new Triple-DES encryption key, the SRP ID must also remain the same. Each BlackBerry Enterprise Server is assigned its own unique SRP ID when it is installed. This SRP ID is associated with the connection to the wireless network, and is coded into each BlackBerry handheld that is added to the BlackBerry Enterprise Server.
** For Safer side you can create a backup of the BlackBerry Enterprise Server or BlackBerry Enterprise Server folder stored within the Lotus\Domino\Data directory.

Task 2 - Backup the BlackBerry Enterprise Server Configuration Database
The configuration database is a SQL database that contains configuration information, which is used by the BlackBerry Enterprise Server services that do not connect to the mail server directly. The configuration database includes the following information:
• Details about the connection to the wireless network
• User list
• PIN to email mapping for Mobile Data Service push functionality
• A read-only copy of each user security key
If you are using a Full SQL Server, follow the steps below:
Open Enterprise Manager.
Right-click the BlackBerry Configuration Database (the default name is BESMgmt).
Select Backup Database.
Click Add to specify the Directory Name and File Name. Click OK to accept your settings.
Click OK to perform the backup.
Close Enterprise Manager.

If you are using an MSDE Server, follow the steps below:
Open a command prompt.
Type osql –E
At the 1> prompt, type the following commands:
1> backup database to disk = "C:\.bak"
2> go
1> quit
Close the command prompt.
You can also create a new database and use the out of box tools from RIM like nbesmigration.exe.(I have never used this tools so can comment )

Recovery Procedure
There are two strategies for disaster recovery of a BlackBerry Enterprise Server:
Backup and restore
Source less move
Note: These strategies do not include disaster recovery for the Microsoft® SQL Server® database. An independent disaster recovery strategy for the Microsoft SQL Server database is required to ensure the availability of the BlackBerry Configuration Database.

Backup and restore
For the backup and restore disaster recovery strategy, complete the following steps:
Note: This option requires performing a cutover without moving BlackBerry Smartphone users. Regular backups of the Microsoft SQL Server database and the IBM Lotus Domino database are required; data are only as current as the last backup. The failover BlackBerry Enterprise Server instance in this scenario must not be started while the active BlackBerry Enterprise Server instance is running, as they are using the same IBM Lotus Domino server name, machine name and Service Routing Protocol Identifier (SRP ID).
1. Install IBM Lotus Domino on the computer to be used as the failover BlackBerry Enterprise Server instance using the same version as the active BlackBerry Enterprise Server instance.
2. Bring the active BlackBerry Enterprise Server instance offline.
3. Change the IBM Lotus Domino server name on the computer to be used as the failover BlackBerry Enterprise Server instance to the same name used on the active BlackBerry Enterprise Server instance.
4. Ensure the machine name used on the computer to be used as the failover BlackBerry Enterprise Server instance is the same name used on the active BlackBerry Enterprise Server instance.
5. Install BlackBerry Enterprise Server software on the computer to be used as the failover BlackBerry Enterprise Server instance using the same version as the active BlackBerry Enterprise Server instance and the same SRP ID.
6. If using Microsoft SQL Server, point the failover BlackBerry Enterprise Server instance to the same Microsoft SQL Server and BlackBerry Configuration Database as the active BlackBerry Enterprise Server instance server. If using Microsoft SQL Server Desktop Engine (MSDE), copy the BlackBerry Configuration Database from the active BlackBerry Enterprise Server instance to the failover BlackBerry Enterprise Server instance.
7. Copy the BlackBerry State Database and BlackBerry User Profile Database from the active BlackBerry Enterprise Server instance to the failover BlackBerry Enterprise Server instance.
8. Bring the failover BlackBerry Enterprise Server instance offline.
9. Bring the active BlackBerry Enterprise Server instance online.

Source less move
For the source less move disaster recovery strategy, complete the following steps :
Note: Two BlackBerry Enterprise Server instances are required, each with a separate SRP ID and using the same BlackBerry Configuration Database. Both BlackBerry Enterprise Server instances are online at the same time. If one BlackBerry Enterprise Server instance fails, all BlackBerry Smartphone users can be moved to the other BlackBerry Enterprise Server instance.
1. Set up the active BlackBerry Enterprise Server instance and the failover BlackBerry Enterprise Server instance as stand-alone BlackBerry Enterprise Server instances, sharing the same BlackBerry Configuration Database. The active BlackBerry Enterprise Server instance would have all the BlackBerry smartphone user accounts. The shared BlackBerry Configuration Database allows both BlackBerry Enterprise Server instances to be viewed through the BlackBerry Manager.
2. Perform a one-way replication from each of the BlackBerry Enterprise Server instance for the BlackBerry State Database folder.
Note: Do not replicate the BlackBerry User Profiles Database as this will cause the Profiles documents to duplicate.
3. During a failover situation, in BlackBerry Manager, select the BlackBerry Smartphone user from the active BlackBerry Enterprise Server instance by clicking Account and select Move User to move the BlackBerry Smartphone user to the failover BlackBerry Enterprise Server instance.
Note: The BlackBerry Smartphone user will not have to reactivate the BlackBerry Smartphone. BlackBerry Smartphone user can be moved back to the other BlackBerry Enterprise Server instance server using the same method.

false new mail notifications in Lotus Notes

2008-09-08T00:13:00.000-07:00

false new mail notifications in Lotus Notes

check the notes.ini setting
NewMailSeqNum=

1. First, verify that you are using the correct Location document. Then, within the Location document, verify that the 'Mail file' field specifies your mail file. (The Mail file field specifies which database your Notes client should poll for new mail.)

2. Check the All Documents view at this point to determine if new mail is actually received, but does not appear in the Inbox due to Mail Rules.

3. Set debugnewmail=1 in the client notes.ini file. This parameter, along with the debug_outfile parameter (capturing output to a text file as in, debug_outfile=c:\newmail.txt) captures the following information: Time of polling, server polled, mail file polled, and the previous and new value of the NewMailSeqNum.If the NewMailSeqNum increases normally, focus on user perception (#2).When polling for new mail, the Notes client compares the NewMailSeqNum variable in the notes.ini file against the delivery sequence number in the mail file. If the number is different, a new mail indication is received. Refreshing your mail view after receiving new mail but before the mail file is polled does not update the NewMailSeqNum notes.ini variable. When the mail file is next polled on schedule, you receive a new mail notice because the number kept in the mail file is still different than the NewMailSeqNum at polling time. This can be seen in the captured outfile when debugnewmail=1 is in place.

4. Re-synchronize the value stored in your notes.ini with the value stored in your mail file. Do this by completely removing the NewMailSeqNum parameters from your notes.ini file. When you restart Notes, a plain NewMailSeqNum parameter (without Replica ID) is added back to your notes.ini file.When Notes is first set up, the NewMailSeqNum does not exist. When you access your mail file for the first time, this variable is added to your notes.ini file. If switching to Location documents pointing to different mail files, separate NewMailSeqNum variables are added that include the database replica ID.

5. If your workstation is shared by multiple users (who switch Location documents but share the same notes.ini file), false mail notifications may occur because the NewMailSeqNum is updated with the current mail file's number. Separate INI variables are kept specific to each replica and should prevent this from occurring.

6. Check for multiple notes.ini files. (Check both your local C: drive and mapped drives.) The NewMailSeqNum in the notes.ini in use is compared against the internal number in the mail file and is updated by the polling function.

7. In the notes.ini file look for an entry that begins either:AltMailApp=
or
$MailStEd=If either entry exists, comment it out - by inserting either a REM or a semi-colon at the front of the line. (In one case, this resolved the problem for a client that was getting mail notifications every two minutes.)

8. Check to see if a Readers field prevents the user from seeing the message. In this case, a new mail message has been received, but cannot be viewed by the user. You can try to access the user's mail file from the server's workstation with the server's ID. If the server is reader, the documents will be displayed. If this cannot be done, another troubleshooting method is to add a "Log_Mailrouting=30" line on the mail server's notes.ini, and when a "false" mail notification arrives, check the log or server console to determine if the message has arrived undetected by the recipient, and the identity of the sender.

Replicas UNREAD MARKS are out of synch.

As you know, in 5.x unread marks where stored in workspace file, starting from release 6.x, Unread Marks architecture was completely rebuild, and now their are stored in Notes Database. To synchronize Unread Marks, you need to UNSTACK REPLICA ICONS. Press CTRL+SHIFT, select databases that you want to synchronize, then EDIT-> Unread Marks->Exchange Unread Marks.

This Option is a hidden option, and it is available only when DATABASE properties REPLICATE UNREAD MARKS is SET to NEVER. If DB is in Cluster, and you selected ALL SERVERS or CLUSTERED SERVERS ONLY.

2008-09-07T23:03:00.000-07:00

Accessing Lotus Sametime in Blackberry

Prerequisites for accessing Lotus Sametime on Blackberry

You must have a full IBM Lotus Sametime license and an IBM Lotus Sametime user name.
1. The BlackBerry Enterprise Instant Messaging client must be installed on your BlackBerry device.
2. You must have Blackberry Collaboration service properly configured and running on Blackberry Enterprise Server.
3. BlackBerry Device Software 3.8 or later must be installed on your BlackBerry device.
4. BlackBerry Device Software 4.0 or later is required to support wireless deployment using software configuration.
5. The IBM Lotus Sametime server host name and port information for the BlackBerry Collaboration Service properties in the BlackBerry Server Configuration panel must be configured.
6. You must add the IP address of each computer on which you plan to install the BlackBerry Collaboration Service to the Community Connectivity document on the IBM Lotus Sametime server.

Step 1
Install the Blackberry Collaboration service on your Blackberry Enterprise server. To install this service you server version should be at least v4.1.
Now check the configuration settings
1. In the BlackBerry Server Configuration Panel, click Collaboration Service.
2. Make sure the IBM Lotus Sametime host name is spelled correctly.
3. Make sure the port setting is correct.
4. Save the changes.
5. You can also check this in Blackberry manager under collaboration services properties.

Step2
1. On the IBM Lotus Sametime Server, double-click the Community Connectivity document.
2. In the Community Trusted IPS field, type the IP address for each BlackBerry Enterprise Server connected to the IBM Lotus Sametime Server, as shown in the image below.
3. Restart the BlackBerry Collaboration Service.
4. Restart the IBM Lotus Sametime Server.
If it is not done user will not be able to login to the sametime server from Blackberry hand held and will get an error in sametime.log
E Server 08/Jun/05, 16:28:32 Rejecting server component xx.xxx.xxx.xxx, not in trusted ips list

Step 3
Now Use the Enterprise Messenger on your Blackberry Handheld. You can deploy it using Desktop manager on your Local desktop or you can wirelessly deploy it from the server.
Deploying Enterprise Messenger Wirelessly
IBM Lotus Sametime software is located in the IM folder on the BlackBerry Enterprise Server software installation CD. Files included on the CD are the following:
· Sametime.zip - used for deployment through a software configuration in BlackBerry Manager
· SametimeOTA.zip - used for deployment through a web site accessed by the BlackBerry Browser or the customized web page loader.htm
You should install and configure BlackBerry Enterprise Server software version 4.1 with the BlackBerry Instant Messaging Connector for IBM Lotus Sametime before deploying the software to BlackBerry devices.ProcedureTo install and distribute the software, complete the following five tasks:Task 1- Create a Network Path
1. On the network drive, create the network path :\Program Files\Common Files\Research In Motion\Shared\Applications\Sametime.
2. Double-click the Sametime.zip file on the installation CD.
3. Extract the ALX and COD files to the network path you created in step 1.
Task 2 - Make Applications Available
1. Open a command prompt and type cd :\Program Files\Common Files\Research In Motion\Apploader
2. Type loader.exe/index The BlackBerry Application Loader builds the software index structure in the network drive and adds any missing index files.
3. Share the Research in Motion network drive and set the permissions to Read-Only.
Task 3 - Create a Software Configuration for Lotus Sametime
1. In BlackBerry Manager, click BlackBerry Domain in the left pane.
2. On the Software Configurations tab, click Add New Configuration.
3. In the Configuration Name field, type a name, such as Sametime Messenger.
4. Click Change, type the Universal Naming Convention (UNC) that indicates the location of the software, and click OK. Note: The UNC of the shared directory uses the format \\\Research In Motion
5. In the Application Name list, select the BlackBerry Enterprise Messenger for Sametime check box.
Task 4 - Assign the Software Configuration through a USB Cable
1. Connect the BlackBerry device to the computer using a universal serial bus (USB) cable.
2. In BlackBerry Manager, click a BlackBerry Enterprise Server name in the left pane.
3. In the User list, select the BlackBerry user account to which the software configuration will be assigned.
4. In the bottom pane, expand Device Management.
5. Click Assign Software Configuration.
6. Select Sametime Messenger, and then click OK.
Task 5 - Assign the Software Configuration WirelesslyYou can assign the application to BlackBerry devices that have BlackBerry Device Software version 4.0 or later installed and that have at least 16 MB of flash memory.
In BlackBerry Manager, click BlackBerry Domain in the left pane.
1. On the Software Configurations tab, in the Configuration Name list, click Sametime Messenger.
2. Click Edit Configuration and expand the application.
3. Select BlackBerry Enterprise Messenger for Sametime.
4. Click Wireless in the Delivery drop-down list, and then click OK.
5. Select the user under the Users tab.
6. Expand Device Management and click Assign Software Configuration.

Restricting access to local Domino databases

2008-08-12T04:28:00.000-07:00

Restricting access to local databases

If you create a local database (for e.g. archive database) on your hard drive, or create a local replica, you can encrypt it so the database can be viewed only by you. It is a good idea to encrypt local databases if they are stored in a portable computer or if you share your computer with other users.
When you provide local security for a database that you have Manager Access to, Notes encrypts the database using your public key from your User ID. You are the only one who can then decrypt the database because you have the corresponding private key in your User ID. Nobody else's User ID can open the database.

To encrypt new local databases as they are created
You can set Notes to automatically encrypt new local databases when you create them.
1. Choose File - Security - User Security.
2. Click Notes Data -> Databases.
3. Select "Locally encrypt using..." and then one of the following options:
• Simple encryption provides protection against casual snooping.
• Medium encryption provides the right balance among security, strength, and fast database access. This level is probably the right choice for most users.
• Choose strong encryption when security requirements are paramount and the resulting database access performance is acceptable.
Tip To turn off encryption for new local databases, select "Do not locally encrypt."

To encrypt existing local databases
1. Open the local database (for e.g. archive database).
2. Choose File - Databases - Properties.
3. Click the "Database Basics" tab, and then click the "Encryption Settings" button.
4. Select "Locally encrypt this database using" and then one of the following options:
• Simple encryption provides protection against casual snooping.
• Medium encryption provides the right balance among security, strength, and fast database access. This level is probably the right choice for most users.
• Choose strong encryption when security requirements are paramount and the resulting database access performance is acceptable.

5. (Optional) By default, your User ID is listed as the only User ID that can open the database when encrypted. If you would rather give a different person access to the database, click the For button, then choose an address book and person from the "Select name" dialog box.
Caution: If you choose a different user to have access to the database, you will lose your access to the database.
Tip: To turn off encryption for this local database, select "Do not locally encrypt."

Upgradation to Domino 7.0.2 from Domino 6.5.5

2008-08-12T01:54:00.000-07:00

Lotus Domino Upgradation
Before up gradation stop the design replication of system databases like
Names.nsf, admin4.nsf, events4.nsf

1.1.1 Steps to be performed prior to Upgradation

a) Ensure that ‘Fixup’, ‘Updall –R’, & ‘Compact’ tasks run on all the databases of the server.

b) Take a suitable downtime of Mail Server.

c) Set this parameter in notes.ini to restrict the users by accessing the server & ensure that no users are connected. At the domino console type
set config server_restricted=1
d) Flush out the AdminP queue to ensure that there are no pending administration requests. This can take some time as delayed requests are the weekly requests for name changes, i.e. Readers and Authors fields. If possible start this a few hours prior to upgradation. At the Domino server console type the following and watch the console for actions:Tell adminp process all
When actions are finished type:
Tell adminp process delayed
Wait a couple of minutes for delayed actions to kick off some actions (especially on slow machines), such as “performing delete in author and reader fields”. Then type
show ta
And check for Admin process to see if it is running. When this process is idle perform the whole adminp process again until there are no more tasks to be performed.

e) Disable the replication ‘to or from’ the server which you are upgrading.

f) Disable the ‘Program Document’ (if any) for the server.

g) Disable any OS based Anti-Virus Software in the Windows Services, and stop the service

h) Make sure server’s Mailx.boxes are empty – and all mails are routed. Delete the dead mails if any.

i) Stop the Domino server. Right Click on stop from the Windows services panel (make sure that Domino Server Service is in manual start mode), or type quit on the server console
Quit
j) Take the full backup of ‘Lotus’ folder.

k) From the data directory please delete the following databases (even if you have taken a backup of them), and let the installation rebuild them:
· Log.nsf
· Mailx.box (as many as you have)
· Statrep.nsf

l) Delete all directories with a .ft extension, and let ND7 rebuild from scratch
m) Restart the Server at OS level.

1.1.2 Steps to be performed during Upgradation.

a) Browse the installation folder for the lotus domino 7.0.2 & navigate up to its executable.

b) Double click on its executable i.e. setup.exe follow the steps.

c) When it asks for the installation path for the ‘Data’ & “Program’ files set the path which locate the existing ‘Domino’ & ‘Data’ folder.
In our case it is ‘D:\lotus\domino’ for program files & ‘D:\lotus\domino\data’ for data files.

d) Click on ‘Next’ & continues with the installation.

e) Click on finish & make sure that you are not immediately starting the domino services.

f) Add the following to the notes.ini, to ensure you are not prompted at the first server restart to replace your Domino Directory design
Server_Upgrade_NoDirectory_ReDesign=1

g) Start the Domino server manually (Start, Programs, Lotus Applications, Domino Server, or nserver.exe). We set the service to automatic later.

h) Run Fixup on all databases. At the server console type.
load fixup

i) Update all database view indexes (this is not indexed databases).All databases view indexes will need to be updated to make them faster to open the first time after the upgrade. As this is a new version, it is recommended the –R parameter to rebuild the index. At the server console type
Load updall –R
This operation is likely to degrade server performance and may run for some hours before completion, depending on the volume of data on the server.

j) Open the System Databases to make sure they open correctly, and that views and documents look correct.

k) Check the no of Mailboxes listed, from the console Perform:
Sh ser

l) Check that mail routing is working.

m) Enabled all the program & connection documents if disabled.

n) Enabled all the windows services which we have disabled prior to upgradation viz antivirus.

o) Shut down the domino server by typing quit at the console.

p) Set The Lotus Domino Server service startup to automatic.

q) Restart the Server at OS level.

1.1.3 Steps to be performed POST Upgradation

a) As soon as the domino server starts it asks for the upgrade of ‘Address Book’s Design’ click ‘Y’.

b) Check all server tasks is running Properly using sh ta commands.

c) Open the System Databases to make sure they open correctly, and that views and documents look correct

d) Check that mail routing is working.

e) At the domino console type set config server_restricted=1 to restrict the server access.

f) Type the following command to replace the templates of the existing mail database with the ‘Domino Web Access 7’ template.
l convert mail\* * dwa7.ntf

g) Once this commands execution has finished , at the domino console type set config server_restricted=0 for unrestricted access to the server.
h) Test the web access through internet as well intranet, calendaring & scheduling, & Notes client access to databases.

1.1.4 Rollback (If any disaster occurs during upgradation)
a) Uninstall domino 7.0.2 using Add & Remove programs.

b) Delete the lotus folder from D drive.

c) Install domino 6.5.5 to the following path D:\Lotus

d) Restore the lotus folder from the backup.

e) Restart the server at OS level.

ID Recovery

2008-08-03T23:25:00.000-07:00

ID Recovery

To prevent problems that occur when users lose or damage ID files or forget passwords, set up Domino to recover ID files.
Note You can only use the ID recovery process to recover user ID files. You cannot recover certifier ID files.
Setting up ID recovery
Before users can recover their ID files, you must set up ID recovery. Perform these steps before anyone loses or corrupts an ID -- ideally before you begin registering users.
1. From the Domino Administrator, click Configuration, and then click Certification.

2. Click Edit Recovery Information.
3. In the "Choose a Certifier" dialog box, click Server and select the registration server name from the Domino Directory (only if the correct server name does not appear).
4. Choose the certifier for which you are creating recovery information.
• If you are using a server-based certification authority, click "Use the CA process" and select a certifier from the drop-down list. You must be a Certificate Authority (CA) administrator for the certifier in order to change ID recovery information.
• If you are not using a server-based certification authority, click "Supply certifier ID and password." If the certifier ID path and file name does not appear, click Certifier ID and select the certifier ID file and enter the password.
5. Click OK. The "Edit Master Recovery Authority List" dialog box appears.
6. Enter the number of recovery authorities that are required to recover an ID file. It is recommended that you choose at least three.
7. Select the length of the recovery password from the drop-down list. The default is 16 characters.
8. Click Add and select the names of the administrators who are the designated recovery authorities.
9. Choose whether you want to use an existing mailbox for recovery information or create a new one.
• If you have a mail or mail-in database already set up for recovery information, click "I want to use an existing mailbox." Click Address and select the database from the Domino Directory.
• If you want to create a new database to store recovery information, click "I want to create a new mailbox." In the "Create New Mailbox" dialog box, enter the name of the server on which the database is to be created, and the database title. You can use the file name that is created from the database title, or you can create a new one.
10. In the Custom Recovery Message field, type a customized message for the "Enter passwords" dialog box that appears during the ID recovery process. For example, you may want to specify help desk contact information. Message length is limited to 512 characters.
Note Whenever you make changes in this dialog box, the Export button is disabled. You cannot export recovery information until you save the new or updated information.
11. Click OK.
12. If you are using a server-based certification authority, at the server console type:
load ca
This starts the CA process with the new recovery information, or refreshes it if it is already running. Then type:
tell adminp process all
to process the request to add recovery information to the certifier.
13. In the mail-in database ACL, set the -Default- access to No access and give administrators Reader access.
Note If you have created additional O-level Notes certifiers, be sure to cross-certify them with the initial Notes certifier prior to setting up recovery information.
After you specify recovery information in the certifier ID, when you register users, the user IDs automatically contain recovery information. However, if you specified recovery information after generating user IDs, users must update their user IDs with recovery information supplied by the administrator. Updating IDs with recovery information automatically sends an encrypted backup of the user ID to the centralized mail or mail-in database.
There are two ways that users can update their user IDs with recovery information:
• (Only for Domino 6 servers and later) Users authenticate to their home server after an administrator has added recovery information to the certifier. The recovery information is automatically added to their Notes ID.
• The administrator sends recovery information to users to incorporate into their user IDs. You must complete these steps before a user loses or damages an ID or forgets a password.
In Domino 7, users can determine whether recovery information is present in their user ID by seeing whether the "Mail Recovery ID" button on the User Security dialog box is active. They can then click the button to send an encrypted backup of the user ID to the centralized mail or mail-in database.

To send recovery information to the user
The administrator completes these steps.
1. From the Domino Administrator, click the Configuration tab, and then click Certification.
2. Click Edit Recovery Information.
3. In the Choose a Certifier dialog box, if the correct server name does not appear, click Server and select the registration server name from the Domino Directory.
4. Choose the certifier for which you are creating recovery information.
• If you are using a server-based certification authority, click "Use the CA process" and select a certifier from the drop-down list.
• If you are not using a server-based certification authority, click "Supply certifier ID and password." If the certifier ID path and file name do not appear, click Certifier ID and select the certifier ID file and enter the password.
5. Choose Export, and then enter the certifier ID's password.
6. Complete these fields, and then click Send:
Field Enter
To Names of users and groups whose ID files you want to back up.
CC Names of users and groups to whom you want to send a copy of
the message.
Subject Information for users and groups that will appear in the Subject
field of the message. If this field is blank, Notes uses the following
text: New ID file recovery information is attached. Please add it to
your ID file by using the Actions menu "Accept Recovery
Information" option.
Memo Information for users and groups that will appear in the Body field
of the message. Domino automatically attaches the encrypted
backup file information to the message -- you do not need to
specify it in this field.

To accept recovery information in the ID file
The user completes these steps.
1. After the administrator sends the recovery information, open the message in your mail database.
2. Choose Actions - Accept Recovery Information, and then enter your password.
3. Complete these fields, and then click Send.

Field Enter
To Name of the mail or mail-in database that will store the backup copy of
your ID. Domino enters the name of the database specified by your
administrator.
CC Names of users and groups to whom you want to send a copy of the
message.
Subject Information for administrators that will appear in the Subject field of
the message. If this field is blank, Notes uses one of the following
messages: • Backup of newly changed recovery information for user
name
• Backup of recent changes to ID file for user name
Memo Information for administrators that will appear in the Body field of the
message. Domino automatically attaches the backup of the ID file to the
message; you do not need to specify it in this field.
Domino automatically sends the encrypted backup ID file to the centralized mail or mail-in database specified by the administrator.
Note You can store multiple copies of the ID file in the centralized mail or mail-in database. Domino creates a new document every time an ID file is backed up. When attempting to recover an ID file, use the most recent backup. If this fails, use the older versions.

To obtain the ID file recovery password
For security reasons, it is recommended that administrators complete these steps from their own workstations, rather than from the same workstation. Using separate workstations prevents an unauthorized user from using a program to capture the keystrokes that the administrators enter on the same workstation. If an unauthorized user obtains an administrator's ID file and password, the unauthorized user can obtain the administrator's recovery password for all ID files. Therefore, you must protect the administrator's ID file and require that multiple administrators work together to recover any given user ID file.
1. Detach the encrypted backup of the user's ID file from the mail or mail-in database to the local hard drive.
2. If the user's ID file is damaged, send a copy of the ID file from the centralized mail or mail-in database to the user.
3. From the Domino Administrator, click the Configuration tab, and choose Certification - Extract Recovery Password.

4. Enter the password to the administrator's ID file.
5. Specify the ID file you want to recover. This is the same ID you detached in Step 1.
6. Note the recovery password. Give the user the recovery password that is displayed.
Note The Extract Recovery and Recover ID File dialog boxes now display timestamp information for the recovery information contained in the copy of the ID file being recovered. Each time recovery information is generated or regenerated for an ID file, the recovery passwords all change. Occasionally, the recovery cookie acquired by an administrator can't unlock a user's ID file; the recovery information had been regenerated at some point, and administrator is using a copy of the ID file that has a different set of recovery information. In situations like this, administrators can check the timestamp information displayed in these dialog boxes to see if they are trying to recover an ID file with outdated recovery information.

ID Security in Domino

2008-08-01T04:05:00.000-07:00

ID Security

ID security provides better security for Domino users who use Lotus Notes client for accessing mails.without the Id security ID file is used only for client authentication.(logging to your loyus notes client locally)so if a user has three copies of ID file at different location , he can use lotus notes client at all the three locations with these different ID files. pu think in security prspective. If somebody else have your ID previos ID file(even though you have chnaged the password in current file). he can access your mail box.
so in ID file security it checks your ID file password with the password of the server Password digest field(it contains the latest password of the ID file). so if you change the password of your ID file then no body else can use a different Id becsause that ID file contains a different password.

You can enable password verification through the use of a security policy settings document, which allows you to enable this feature for multiple users, or you can enable password verification on an individual basis through the Domino Directory. You can also choose to lock out a user's ID, which prevents the user from logging into the server.
To enable password verification for individual users

1. Make sure that:
• The Administration Process is set up on the server
• You have at least Editor access and the UserModifier role in the Domino Directory.
• Password verification is enabled on the servers with which these users authenticate.
2. From the Domino Administrator, click People & Groups.
3. Select each Person document for which you want to enable password checking.
4. Choose Actions - Set Password Fields, and then click Yes to continue.

5. In the Check Notes Password field, select "Check password."
6. Complete these fields, and then click OK:
Field Action
Required change interval Enter the length of time, in days, that a Password can

be in effect before it must be changed. Default is zero.
Allowed grace period Enter the length of time, in days, that users have to

change an expired password before being locked out.

7. (Optional) You can also choose to force individual users to change their Internet passwords the next time they log in. In the "Force users to change Internet password on next login" dialog box, click Yes.
Caution Do not enable password expiration for users whose ID files are locked with Smartcards. Otherwise, it is possible that a user's ID could be locked out until password expiration can be cleared. You should also be sure that the required change interval and allowed grace period is set at zero.

To enable password verification on servers
To use password verification for Notes users, you must enable password verification for both users and servers. Do the following to enable password verification on each server with which these users authenticate:
1. From the Domino Administrator, click Configuration.
2. Open the Server document of the server for which you want to enable password verification.
3. Click Security, and then in the "Check passwords on Notes IDs" field, select Enabled.

4. Repeat for each server on which you want to enable password verification.
If admin process didn’t work for long then you may have to restart the server to enable password verification on the server.

To disable password verification for a server
When you disable password verification for a server, Domino does not check passwords for any users who access the server, even if the user has password verification enabled.
1. From the Domino Administrator, click Configuration.
2. Open the server document of the server for which you want to disable password verification.
3. Click Security, and then in the "Check passwords on Notes IDs" field, select Disabled.
4. Repeat for each server on which you want to disable password verification.

ID File and Notes Certificate

2008-08-01T04:02:00.000-07:00

Domino uses ID files to identify users and to control access to servers. Every Domino server, Notes certifier, and Notes user must have an ID. When you register users and servers, Domino automatically creates their IDs. An ID file contains:
• The owner's name. A user ID file may also contain one alternate name. A certifier ID may contain multiple alternate names.
• A permanent license number. This number indicates that the owner is legal and specifies whether the owner has a North American or International license to run Domino or Notes.
• At least one Notes certificate from a certifier ID. A Notes certificate is a digital signature added to a user ID or server ID. This signature, which is generated from the private key of a certifier ID, verifies that the name of the owner of the ID is correctly associated with a specific public key.
• A private key. Notes uses the private key to sign messages sent by the owner of the private key, to decrypt messages sent to its owner, and, if the ID belongs to a certifier, to sign certificates.
• (Optional Notes client only) Internet certificates. An Internet certificate is used to secure SSL connections and encrypt and sign S/MIME mail messages. An Internet certificate is issued by a Certification Authority (CA) and verifies the identity of the user. The user's private key associated with an Internet certificate is stored with that certificate.
• (Optional) One or more secret encryption keys, created and distributed by users to allow other users to encrypt and decrypt fields in a document.
Note If a user is in the process of requesting a new private key or a name change, the pending information is also stored in the ID file. If a Notes private key is changed, then the obsolete information is also stored in the ID file for backwards compatibility. For example, you would need the obsolete information to read old encrypted e-mail.

Certificates
A certificate is a unique digital signature that identifies a user or server. Server and user IDs contain one or more Notes certificates. In addition, user IDs may contain one or more Internet certificates that identify users when they use SSL to connect to an Internet server or send a signed S/MIME mail message.
A certificate contains:
• The name of the certifier that issued the certificate.
• The name of the user or server to whom the certificate was issued.
• A public key that is stored in both the Domino Directory and the ID file. Notes uses the public key to encrypt messages that are sent to the owner of the public key and to validate the ID owner's signature.
• A digital signature.
• The expiration date of the certificate.
Certificates are stored in ID files and in Person, Server, and Certifier documents in the Domino Directory. They are also referred to as Notes certified public keys.
Public keys are not secret. Any user may look up another user's public key and use it to send encrypted mail to or authenticate the user. It is important that someone looking up a public key learn it reliably since Domino uses it for identification. Users must be able to obtain the public key of the certifier that issued the certificate before they can authenticate the certificate's owner. If a user has a certificate issued by the same certifier as another user or server, the first user can verify the public key for the certificate and then reliably know the public key associated with the server or user name. If a user doesn't have a certificate issued by the same certifier, the user needs a cross-certificate for authentication.
When you register users and servers, Domino automatically creates a Notes certificate for each user and server ID. In addition, you can use a Domino or third-party certificate authority (CA) to create Internet certificates for user IDs. Domino uses the x.509 certificate format to create Internet certificates.
Notes certificates have expiration dates. Therefore, you must recertify Notes IDs when their expiration dates approach. In addition, if a user or server name changes, you must recertify the corresponding Notes ID so that a new certificate will bind the public key to the new name.
Changing a name on a user ID may also affect Internet certificates. For example, a user who has changed the name on a user ID may receive warning messages when sending signed S/MIME mail, warning the user that recipients of the message may receive a signature by a name that isn't on the original certificate used for signing.

License Tracking and assiging users new Client Licences

2008-07-13T22:43:00.000-07:00

License tracking and new client license type

Using the Domino Administrator, you can track the number of Notes and non-Notes clients who are authorized to access your Domino servers. First, you assign license types to each client. Then you view this licensing information in the Domino Directory.
You can assign the following types of licenses:
Lotus Notes
Lotus Notes Mail
Lotus Notes Desktop
Lotus Notes Designer
Lotus Notes Administration
Lotus iNotes/Domino CAL
The default license type is Lotus Notes.
Assigning license types
You can assign license types manually, or you can create an agent or action to assign license types to multiple users simultaneously.

Assigning license types manually
To assign license types manually, you edit Person documents.
1. From the Servers pane of the Domino Administrator, choose the server from which you want to work.
2. Click the People & Groups tab.
3. Select the Person document to which you want to assign a license type, and click Edit Person.
4. Click the Administration tab.
5. In the "Notes client license" field, choose one or more license types.
6. Click Save and Close.

Assigning license types by using an agent
To use an agent to assign license types, you first create a form in the Domino Directory. The form includes a dialog box from which you can choose license types. Then you create and use the agent in the Domino Directory to assign the license types to Person documents you select. The procedures below describe one way of creating the form and the agent.
Creating the formTo create a form in the Domino Directory, you should first create a copy of the Domino Directory template file and then create the form in the copy of the template file. For directions and rules about creating a coy of the Domino Directory template file, see the topic "Customizing the Domino Directory template" in Domino Administration Help or in the book Administering the Domino System.
1. From the Domino Designer, open the copy of the Domino Directory template file you created. 2. Open the Forms view.
3. Click New Form.
4. Choose Create->Layout Region->New Layout Region.
5. Do the following to add text to the layout region:
Choose Create->Layout Region->Text. Choose Edit->Properties. Enter the following text in the Text field: Chose the license type for the selected users. Click the Font tab, and choose Bold to make the text bold. Close the properties box, and then drag the text to the upper left corner of the layout region. If necessary, drag the right side of the text object until it is wide enough to display all of the text.
6. Choose Create->Field. 7. Choose Edit->Properties, and do the following in the Field properties box:
In the Name field, type ClientType. In the Type fields, choose Listbox from the first drop-down list, choose Editable from the second drop-down list, and select "Allow multiple values."
8. Click the Control tab in the Field properties box, and add the following keywords in the Choices section:
Lotus Notes 0
Lotus Notes Mail 1
Lotus Notes Desktop 2
Lotus Notes Designer 3
Lotus Notes Administration 4
Lotus iNotes/Domino CAL 5
9. Click the Field Info tab in the Field properties box, and adjust the Width and Height so that the field will accommodate the keywords you entered in step 8.
10. In the Layout properties box, adjust the Width and Height of the layout region to the size you want.
11. (Optional) In the Form properties box, click the Form Background tab, and change the background color of the form region. Light gray is the most commonly used color for this purpose.
12. Choose File->Save, name the form "(SetLicenseType)" and then click OK.
13. Add the form to the Domino Directory. For directions, see the topic "Applying template customizations to the Domino Directory database" in Domino Administration Help or in the book Administering the Domino System.

Creating the agent
1. From the Domino Designer, open the Domino Directory.
2. Open the Agents view.
3. Click New Agent.
4. In the Name field, type Set License Type.
5. In the "When should this agent run?" field, choose Manually From Actions Menu.
6. In the "Which document(s) should it act on?" field, choose Selected documents.
7. In the Run field in the Programmer's pane, choose Lotuscript.
8. Click Initialize, and then add the following code to the Programmer's pane

Sub Initialize
Dim NDB_currentDB As NotesDatabase Dim NV_currentView As NotesView
Dim NDC_collection As NotesDocumentCollection
Dim ND_document As NotesDocument
Dim NI_item As NotesItem
Dim NS_session As New NotesSession
Dim NW_workspace As New NotesUIWorkspace
Dim NV_Values As Variant

'enumerate currently selected notes
Set NDB_currentDB = NS_session.CurrentDatabase Set NV_currentView = NDB_currentDB.GetView ("People")
Set NDC_collection = NDB_currentDB.UnprocessedDocuments
Set ND_document = NDC_collection.GetFirstDocument

'launch the dialog that uses the SetLicenseType form and get the values set by the administrator
Call NW_workspace.DialogBox ( "(SetLicenseType)", True, True, True, True, False, False, "Set License Type", ND_document ) NV_Values = ND_document.getItemValue( "ClientType")

'loop the collection
Do Until ND_document Is Nothing
'set the ClientType field to the value retrieved from the dialog box
Call ND_document.replaceItemValue( "ClientType", NV_Values) Call ND_document.save( True, True)

'ND_document is the current note handle
Set ND_document = NDC_collection.GetNextDocument(ND_document) Loop
End Sub
Choose File - Save to save the agent. Using the agentTo use the agent to assign license types, do the following:
1. From the Domino Administrator, click the People & Groups tab, and then open the People view.
2. Select the people to whom you want to assign the same license type(s).
3. Choose Actions->Set License Type.
4. Choose the license types you want to assign to the people you selected.
5. Click OK to assign the license types, or press ESC to cancel assigning the license types.
Viewing the assigned license typesYou can view how many of each type of license you have assigned and to whom you have assigned each type of license.
1. Open the Domino Directory.
2. Open the Server\Licenses view.
3. Expand each section to view the people to whom you assigned each type of license.
The Server\Licenses view displays only one license type per person, even if you assign multiple license types to a person. The following section describes how the view determines which license type to display for a person. Precedence of license types in the Server\Licenses viewThe following table shows the precedence for determining which license type to display in the Server\Licenses view. The table also shows the category in which each license type is displayed in the view. Precedence License type Category in the view
1
Lotus Notes Mail Clients\Lotus Notes Mail
2
Lotus Notes Desktop Clients\Lotus Notes Desktop
3
Lotus Notes Clients\Lotus Notes
4
Lotus iNotes/Domino CAL Client (alternate access)\Lotus iNotes/Domino CAL
5
Lotus Notes Designer Lotus Notes Administration Client (alternate access)\Other*
OR
Client (alternate access)\Unknown*
* Lotus Notes Designer and Lotus Notes Administration are displayed in the Client (alternate access)\Other category if the Person document contains at least one of the following:
A Notes certificate or public key
A mail file
A mail server
An Internet password An Internet certificate (using the X.509 certificate format)
If none of the above exist in the Person document, Lotus Notes Designer and Lotus Notes Administration licenses are displayed as Unlicensed/Unknown in the view.

Sametime Chat Logging

2008-07-13T22:35:00.000-07:00

How to enable and disable chat logging on a Sametime server

To enable chat logging on a Sametime server:
1. Stop the Sametime server.
From the Domino server console, type the following command: Tell STADDIN QuitThis will stop the Sametime add-in task and shut down the Sametime server cleanly.

2. Use a Lotus Notes® client to open the Sametime Configuration database (stconfig.nsf) on the Sametime server.

3. In the right hand pane, open the CommunityServices document by double-clicking on the date associated with the document.
4. Double-click on the CommunityServices document to put the document in edit mode.
5. For the "Chat Logging Flag" parameter, select either "relax" or "strict" for the chat logging mode.
6. For the "Capture Service Type" parameter enter the value "0x1000" (e.g. Capture Service Type = 0x1000).
Note: If the "Chat Logging Flag" is set to "strict" and "Capture Service Type" is "0x1000" in the CommunityServices document of the stconfig.nsf and the Chat Logging service becomes unavailable for any reason, users will receive "Chat services unavailable" when attempting to chat. This is by design; the strict setting is being enforced.
7. Save and close the CommunityServices document. 8. In some versions of Sametime, a sample or "dummy" chat logging DLL is installed, STChatLog.dll, which needs to be replaced.
IMPORTANT: Chat logging in Sametime 3.1, 6.5.1 and 7.0 is intended to be a "proof of concept" to demonstrate that the Sametime API Toolkit can log chats between users. There are three
possible options for chat logging: Using the sample DLL is provided in the Sametime API Toolkit for basic logging, for deployment purposes, a customer may utilize a third party logging application, or a customer can develop their own using the Sametime API Toolkit.
-- If one exists, rename the STChatLog.dll to STChatLogOld.dll. This file is typically located in the C:\Lotus\Domino or C:\Sametime directory.-- Rename the file STChatLogFile.dll (located in C:\Sametime\DatabaseBB\File) to STChatLog.dll and copy the file to C:\Lotus\DominoNOTE: If the parameter "bb_cl_library_path=" is not used to specify the path of the chat log files, the default directory is "CLData" under the C:\Lotus\Domino folder (C:\lotus\domino\CLData). This directory must be manually created or the log files will not get generated.
9. Add the following INI parameter to the [Library] section of the Sametime server's sametime.ini file:
[Library]BB_CL_Library_Path=[Path to the directory where the chats are to be stored]
*This directory must already exist; it will not automatically be created.
10. Restart the Sametime server.

To Disable chat logging on a sametime server

To disable chat logging, you must do the following:
1. Use a Lotus Notes client to open the Sametime Configuration database (stconfig.nsf) on the Sametime server.
2. In the right hand pane, open the CommunityServices document by double-clicking on the date associated with the document.
3. Double-click on the CommunityServices document to put the document in edit mode.
4. For the "Chat Logging Flag" parameter, select "off" for the chat logging mode.
5. For "Capture Service Type", delete the current value so that there is no entry for this parameter.
6. Save and close the CommunityServices document.

For Windows servers:
7. Replace the chat logging DLL that you have been using with the original "dummy" chat logging DLL.
8. Stop and restart the Sametime server in order for the changes to take effect.

Domino 7 to Exchange 2007 Migration

2008-07-11T02:37:00.001-07:00

Migrating from Domino to Exchange 2007

In Exchange 2007 we have the new Microsoft Transporter Suite for Lotus Domino which offers new and updated tools in one convenient suite. In the same way that Exchange 2007 comes equipped with the Exchange Management Console, the transporter suite comes equipped with the Transporter Management Console. This ensures that administrators are presented with a familiar interface that they can quickly adapt to using. Furthermore, in the same way that Exchange 2007 comes equipped with the Exchange Management Shell, the transporter suite offers its own Transporter Command Shell meaning that administrators can take full advantage of the powerful shell commands to perform tasks such as the scripted migration of mailboxes from Domino to Exchange 2007.

transporter suite consists of five components. These are:
1. Directory Connector. This synchronizes objects between the Domino Directory and Active Directory in much the same way the Microsoft Connector for Lotus Notes does in Exchange 2003.
2. Free/Busy Connector. Like its Exchange 2003 counterpart, this gives users running the Outlook and Lotus Notes clients the ability to perform calendar free/busy queries across the two systems.
3. Directory Migration. The directory migration component allows you to create new Active Directory user accounts for the Domino Directory users.
4. Mailbox Migration. This performs the actual migration of user data from Domino mail databases to Exchange 2007 mailboxes.
5. Application Migration. The application migration component allows for the migration of Domino applications to Microsoft SharePoint.

One thing you may notice from the above list is the lack of anything that actually allows bi-directional message transfer between Domino and Exchange 2007. This is because message routing between Domino and Exchange 2007 now uses SMTP rather than the more traditional method of routing messages across the Microsoft Connector for Lotus Notes.

Prerequisites and Version Support
In most coexistence and migration scenarios, the particular version of the source messaging system that is supported by the migration tools is always of concern. Microsoft states that it is a requirement that the Lotus Notes 6.x or 7.x client is installed on the server that will run the Directory Connector; the Directory Connector is something we will create later on.
There are also things to note around Microsoft’s support for the versions of Lotus Domino. Only Lotus Domino 6.x and 7.x are supported for interoperability. In other words, you cannot use Lotus Domino 5 for directory synchronization, free/busy lookups or message routing using SMTP.

Coexistence & Migration Scenario
In this article, We are going to use the scenario of two organizations called Contoso and Fabrikam. Contoso is already using Exchange 2007 and has recently purchased Fabrikam who is using Domino 7. Contoso has an SMTP domain name of contoso.com, whilst Fabrikam has an SMTP domain name of fabrikam.com. Contoso decides to enter an initial coexistence phase with Fabrikam as it cannot migrate all users from Domino to Exchange immediately. There are four major steps required to complete the process of coexistence and migration from Domino to Exchange. They are:
1. Directory synchronization. This is where Contoso and Fabrikam share address books across the two systems.
2. Free/Busy lookups. Configuration of the free/busy connector allows users on either system to check the availability of users on the opposing system.
3. Migrate users to Active Directory. This process ensures that the Domino users’ email addresses are represented in the Exchange Global Address List (GAL).
4. Migrate mail to Exchange. When Fabrikam is ready to move users from Domino to Exchange, this process moves the users’ mailbox items from one system to the other.

To simulate this environment in the lab we have used just a single domain controller running Exchange 2007 and another server running Domino 7.0.2. Of course, in real-world environments it is likely that the various components, such as the transporter suite itself, will be spread across different servers. Also, We are going to use the initial Domino administrator account that was first set up as the account that we will be using to run the transporter suite – this will have all required Domino permissions. In a live environment, a dedicated account would likely be used and so where appropriate will detail the Domino permissions required for this account.

Installing the Transporter Suite
Before we get on with directory synchronization and then the actual migration, we need to install the transporter suite on the Exchange 2007 server. Before we do that, do not forget that you will need the Notes client installed onto the Exchange 2007 server as well. As this is an article focused on Exchange, I will not give full details of that here – there is plenty of online help in this area. The process of installing the transporter suite is a simple process which is achieved as follows:
Download the transporter suite from this location. Note that there are two versions of the file, namely transporter.msi for 64-bit systems and transporter32.msi for 32-bit systems.
On the Exchange 2007 server, run the relevant MSI installer and go through the opening welcome screen followed by the license agreement screen.
At the Select Components and Install Location screen, ensure that the Microsoft Transporter Tools option is selected for installation but that the Free Busy Connector Add-In Task for Lotus Domino is not. Do not forget on this screen to make sure that the installation location is set to your desired location. The default location is C:\Program Files\Microsoft Transporter Tools. This screen is shown in Figure 1.
Finally at the Ready to Install screen, click Install.

Figure 1: Transporter Suite Component Selection
Once installed, you will notice a new program folder called Microsoft Transporter Suite for Domino that contains the management console and shell.

Directory Synchronization
In our sample scenario, the first step for Contoso having acquired Fabrikam is for the two organizations to have a consistent GAL across the two systems. In other words, all users should be able to see every other user from within the Exchange and Domino systems.
Domino users will be synchronized into Contoso’s Active Directory as mail-enabled contacts, so it makes sense to create a specific Organizational Unit (OU) for this purpose. There can only be a single target OU defined as the import container and within this article this OU will be called Domino Users. Similarly, Exchange-related Active Directory objects such as users, groups and contacts will be synchronized into the Fabrikam Domino system, specifically into the default NAMES.NSF directory. You will see later on that there are check boxes for configuring whether or not Active Directory mail-enabled groups and contacts are synchronized into Domino, so these choices are optional.
Let us run through the process of creating the Directory Connector to allow this synchronization process to occur. To successfully complete the process from the Exchange side, the account used must be delegated the Exchange Server Administrator role.
Actually creating the Directory Connector is a very straightforward affair as there aren’t any options to configure. You can either create the connector with the Transporter Command Shell or via the Transporter Management Console. Let us look at using the console first:
With the management console open, select the Connect option from the console tree.
Either right-click the Connect option and choose Create Directory Connector… from the context menu, or choose the same named option from the Action pane.
You will now be at the Create Directory Connector wizard introduction screen. Click Next here and then click Create at the Progress screen. Job done! You can then click Finish to exit the wizard.
To do the same via the shell, just run the New-DominoDirectoryConnector cmdlet. It is as easy as that, although you can create the connector and configure it with the various settings at the same time. The result is a newly created Directory Connector as seen in Figure 2. It is not configured though, which is something we will be looking at in part two of this article.
Figure 2: Newly Created Directory Connector

Domino Permissions
Before we start configuration of the Directory Connector, it is worth noting the permissions required within Domino for this to work. We are using the default Domino administrator account that has all required permissions. If you want to use a different Domino account, Microsoft states that this account must have at least Editor access to the Domino directory which in Fabrikam's case is names.nsf. Additionally, the account will require the UserCreator and UserModifier roles as well as the ability to delete documents. How this is configured for the default Domino administrator account is shown in Figure 3, where the access control list for names.nsf is depicted. As you can see, the Domino administrator account has Manager access by default, which is higher than the required Editor access.

Figure 3: Domino Directory Access Control List

Configuring the Directory Connector
Now let's go back to the Transporter Management Console and configure directory synchronization. In the main transporter suite window, you will see the newly created Directory Connector listed as shown in Figure 2 in part one of this article. Configuring the Directory Connector is more complicated than creating it. Let's walk through the process required by Contoso to complete the synchronization process with Fabrikam.
Highlight the Directory Connector that was just created, right-click it and choose Properties from the context menu. Alternatively, choose the Properties option from the Actions menu.
The properties of the Directory Connector are displayed and you will see four tabs to be configured. The General tab has various settings that are configured as follows. A screen shot of Contoso's configuration is shown in Figure 4.
Sync Schedule. This is a drop-down selection box that has pre-defined options ranging from 15 minutes to 24 hours, as well as a 'never' option which is the default. Of course, you will want to choose an option that reflects how often you would like the address books updated. Let's choose 15 minutes for this article.
Global Catalog. This is the global catalog server that will be used for the Active Directory reference when performing directory synchronization. Click the Browse: button and choose the relevant global catalog server.
Domino Server. Obviously this is the name of the Domino server that you wish to connect to for directory synchronization purposes. In our example, this is DOMINO/FABRIKAM.
Notes Password. Here you type the Notes ID password for the account that is configured on the Notes client installed on the server containing the Transporter Suite. Since we are using the Domino administrator account, we type that account's password here.
Figure 4: Directory Connector General Tab
The Sync to Active Directory tab controls which Domino directories are synchronized into Exchange. The specific options to configure are:
Source Domino Directory. To complete this configuration, we should first click the Add button which presents the New Source Domino Directory Entry window. The fields in this window are configured as follows:
In the Domino Directory field, we enter names.nsf which is the default Domino Directory that contains Fabrikam's users. These are the users that are required to be synchronized into Active Directory.
In the Domain Name field, Fabrikam's Domino domain name is entered, which in this case is fabrikam.
In the SMTP Domain field, Fabrikam's SMTP address space is entered, which is fabrikam.com. The completed window is shown below in Figure 5.

Figure 5: New Source Domino Directory Configuration
Target Active Directory. This option is used to choose the target OU that will be used to store the mail-enabled contacts that represent the Domino users. You will remember that we created the Domino Users OU specifically for this purpose so that's the OU that is specified here, chosen by clicking the Browse: button and selecting the relevant OU. The completed Sync to Active Directory tab is shown in Figure 6.

Figure 6: Directory Connector Sync to Active Directory Tab
The Sync to Domino tab is used to configure directory synchronization from Exchange to Domino. The specific options to configure are:
Source Organizational Units. Here we choose the OUs in Active Directory that contain the Exchange users, groups or contacts that we wish to synchronize into Domino. In Contoso's case the Head Office OU is selected which results in all objects from this OU and all objects from all sub-OUs of the Head Office OU also being added. This is shown below in Figure 7. This is achieved by clicking the Add button and then browsing to the relevant OU in the New Source OU Entry window that is displayed.
Target Domino Directory Names and Addresses (NSF) File. This field is used to select the name of the Domino Directory that will receive the Exchange users, groups and contacts configured in the previous step. By default, this is set to names.nsf although this can be changed to an alternative Domino Directory if required. In our case, Fabrikam requires that the Exchange information is synchronized into names.nsf.
Routable Exchange Domains. Here we configure Contoso's SMTP domain name of contoso.com as a routable Exchange domain. If Contoso had additional SMTP domain names such as contoso.org, we would need to make sure that these were included as well. These can be added simply by clicking the Add button and entering the relevant SMTP domain name into the field in the Add Routable Exchange Domain Entry window.

Figure 7: Directory Connector Sync to Domino Tab
The final tab to configure is the Advanced tab. This is shown below in Figure 8. Note the options to choose whether to synchronize groups and contacts. You can also choose a list of Domino groups that you do not want to synchronize into Active Directory. We will leave the defaults within this article.
The configuration of the Directory Connector is now finished. Just click OK to return to the main transporter suite window.

Figure 8: Directory Connector Advanced Tab
You can also create and configure a Directory Connector at the same time via the New-DominoDirectoryConnector cmdlet. I will not repeat all the various parameters here, but the Syntax portion of Figure 9 will show you what the parameter names are. Many of the parameter names are self explanatory as they can be linked to the options you've seen from within the Transporter Management Console. The transporter suite help file has full details if you are unsure.

Figure 9: New-DominoDirectoryConnector Syntax

Performing a Synchronization
Once the Directory Connector has been configured, the service must be started before any synchronization can take place. The service name is Microsoft Exchange Directory Connector Service for Lotus Domino and note that, by default, the service startup parameter is set to Manual so you will want to change this to Automatic. If you do not start the service yourself, you can see the timeout error shown in Figure 10 when attempting to synchronize directories.

Figure 10: Directory Connector Timeout Error
You can either wait for the synchronization process to run according to your configured schedule, or, as is more likely the case when first setting up the Directory Connector, you can force a synchronization process immediately. In the console, right-click the Directory Connector within the Transporter Management Console and choose the Synchronize Now: option from the context menu or Action pane. Doing this invokes the Synchronize Directories Now wizard which has an introduction screen followed by:
Synchronization Options screen. Here you will see different types of synchronizations to perform such as 'update' or 'full' synchronizations, together with the direction in which you wish to perform them. Since this is the first time we are running the directory synchronization process between the two systems, we should choose the Full Synchronization option followed by the Full two way synchronization: option. This performs a fresh synchronization run, so clearly you wouldn't want to run this process too often unless you had a specific need to. It will also delete existing objects from a previous synchronization run and re-create them if they still exist. The more likely on-going option to choose is the Update Synchronization option which merely changes updated or modified objects. Since this is the first directory synchronization run, you should choose to synchronize in both directions at this time. This screen is shown in Figure 11. Once you are happy with your choice, click Next.
The Progress screen is then displayed. Here, just click the Synchronize button. The connector will then begin the synchronization process, hopefully culminating in a successful synchronization. Then just click the Finish button to close the wizard.

Figure 11: Synchronize Directories Now Wizard
You can use the shell to do the same thing via the following simple cmdlet:
Start-DominoDirectoryConnector -FullReloadToAD -FullReloadToDomino
You do not need to use the -Identity parameter in this case since there is only a single Directory Connector. You can use the UpdateToAD and UpdateToDomino parameters to perform an update synchronization.
Now that we have run the directory synchronization process, let's check that it has completed successfully. The first thing to do is to check the contents of the Domino Users OU and as you can see from Figure 12 this is now populated with mail-enabled contacts representing the Fabrikam Domino users and groups. Similarly, checking the Domino Directory reveals that this is now populated with the Exchange users and Groups as shown in Figure 13.

Figure 12: Domino Users in the Notes Users OU

Figure 13: Exchange Users in the Domino Directory
Diagnostics Logging
As you might expect, the transporter suite can also place information into the event log during the directory synchronization process which you can use for troubleshooting failed synchronization attempts. There are three different categories for the DominoDirectoryConnector application, which you can see if you perform the following cmdlet:
Get-TransporterEventLogLevel fl
The result of this is shown in Figure 14, where you can see the three categories listed as Service, Controller and DirSync.

Figure 14: Results of Get-TransporterEventLogLevel
You will see that the first two categories are set to a Low diagnostics logging level, which is the default. If you want to ramp up the diagnostics logging for one of the categories you need to use the Set-TransporterEventLogLevel cmdlet with the -Identity parameter. You will see in Figure 14 that the DirSync category is set to High. This was achieved by the following cmdlet (note the format of the -Identity parameter and that it includes the application name of DominoDirectoryConnector):
Set-TransporterEventLogLevel -Identity DominoDirectoryConnector\DirSync -LoggingLevel High
Doing this results in much more information in the event log, such as the directory synchronization event example shown in Figure 15.

Figure 15: Example DirSync Logging Information

Free/Busy Connector
The Directory Connector doesn’t allow for the querying of free/busy information across systems – that’s the job of the Free/Busy Connector. Now that Contoso and Fabrikam users can see each other in their respective address books, they may start to attempt to book meetings with each other. Imagine that a user within Contoso, called Exchange User 1, attempts to book a meeting via Outlook Web Access with the Fabrikam user called Domino Administrator. Without the Free/Busy Connector, the Contoso user will get the familiar ‘no information’ hatched line when querying for free/busy information as seen in Figure 16.

Figure 16: Life Without the Free/Busy Connector
Before we go ahead and install the Free/Busy Connector, there are a few things to note about it:
A separate process of the transporter suite, excalcon.exe, must run on a Domino server to allow free/busy requests to work.
It’s required to create a foreign domain document in Domino for free/busy information, something that isn’t a requirement for the Directory Connector.
Microsoft states that the Domino server must be started as a service and not as an application for free/busy lookups to work.

Prepare the Domino Environment
Let’s look at creating the foreign domain document. Here’s the process that needs to be performed on the Fabrikam Domino server. The assumption here is that this task is performed using the Domino Administrator program.
Run the Domino Administrator program.
Click the Configuration tab and then expand Messaging in the left-hand pane.
From the list of options presented under Messaging, select Domains. This option is shown in Figure 18.

Figure 18: Notes Domain Configuration
Click the Add Domain button which then presents you with the New Domain window.
The Basics tab should now be selected by default. Make sure that the Domain type: field is set to Foreign Domain and then type “Exchange” (without the quotes) into the Foreign domain name: field. It’s probably best that you use “Exchange” as the foreign domain name in Domino, otherwise you have to run the Set-DominoDirectoryConnector cmdlet with the –ForeignDomain parameter to alter the Directory Connector configuration. The relevant portion of the completed Basics tab is shown in Figure 19.

Figure 19: Foreign Domain Basics Tab
Next click the Mail Information tab. Enter the name of the Domino server running excalcon.exe into the Gateway server name: field. Now, we haven’t installed excalcon.exe onto a Domino server yet, but in this case we know that the Fabrikam administrator will install it onto the server called domino/fabrikam so that’s what is entered here. In the Gateway mail file name: enter mail.box. The relevant portion of the completed Mail Information tab is shown in Figure 20.

Figure 20: Foreign Domain Mail Information Tab
Finally, click the Calendar Information tab. The Calendar server name: field should again contain the Domino server running excalcon.exe, namely domino/fabrikam in this article. The Calendar system: field should be configured with a name for the Exchange calendar system. Microsoft recommends using a name of ExchFreeBusy, so let’s stick with that in this article as the name explains the usage fairly well. The relevant portion of the completed Calendar Information tab is shown in Figure 21.

Figure 21: Foreign Domain Calendar Information Tab
Once these tabs have been completed, just click the Save & Close button to complete the foreign domain creation process.

Installing Excalcon.exe
Whilst we’re in Domino configuration territory, we might as well perform another of the required Domino configuration steps, namely the installation of the excalcon.exe process. This needs to be installed onto Fabrikam’s Domino server and is achieved by running the transporter.msi file (or transporter32.msi if you’re using the 32-bit version) on the Domino server. Here are the steps required:
Skip through the welcome screen, then onto the Licensing screen where you’ll obviously need to accept the license.
At the Select Components and Install Location screen, make sure that the Microsoft Transporter Tools component will not be installed and that the Free/Busy Connector Add-In Task for Lotus Domino will be. Doing this makes sure that only excalcon.exe is installed onto the Domino server and not the rest of the transporter suite. This is shown in Figure 23 below.

Figure 23: Installing Free/Busy Components
Complete the installation by clicking the Next button and then the Install button on the Ready to Install screen.
When the installation has finished, it’s now time to modify the notes.ini file found on the Domino server so that the excalcon.exe process is always loaded. By default, the notes.ini file will be found in the \Program Files\Lotus\Domino folder on whatever drive you installed Domino onto. One of the lines in notes.ini begins with the string ServerTasks= such as the example shown below in Figure 24.

Figure 24: Default notes.ini File
The highlighted line in notes.ini shown in Figure 24 needs to be modified to include the excalcon.exe process. The additional text required to make to the notes.ini file is in the following format:,excalcon In our example, Contoso’s Exchange server is called W2K3BASE and is within the contoso.com domain. You’ll remember that we’ve just created the foreign domain name with a name of Exchange, so this text becomes:,excalcon w2k3base.contoso.com exchangeTherefore, the modified notes.ini file will look like the one shown in Figure 25.

Figure 25: Modified notes.ini File
Once notes.ini has been modified and saved, you can either restart the Domino server application or invoke the excalcon.exe process without restarting Domino by entering the following command at the Domino server console:load excalcon So in our case this command becomes:load excalcon w2k3base.contoso.com exchangeHowever, it’s not worth doing this yet as you’ll get an error when you attempt to load excalcon on the Domino server. If you think about it, we’ve not actually created the connector yet and the required service isn’t running on the Exchange server. The error is shown in Figure 26.

Figure 26: Loading excalcon.exe on the Domino Server
now we continue our look at how Exchange 2007 and Lotus Domino 7 can coexist with the future aim of migration from Domino to Exchange. In our sample scenario, Fabrikam is running Lotus Domino 7 and Contoso is running Exchange 2007. earlier, we prepared the Fabrikam Domino environment so it was ready for the Free/Busy Connector. In this part, we’ll prepare the Contoso Exchange environment so it is also ready, then we’ll proceed to create and configure the Free/Busy Connector so that users can swap calendar free/busy information.

Prepare the Exchange Environment
The first requirement that must be met is to download and install the Exchange MAPI Client CDO 1.2.1 package from Microsoft, available here. From the link you should download a single file called ExchangeMapiCdo.exe that can be run to extract ExchangeMapiCdo.msi. The MAPI and CDO 1.2.1 package is required to be installed onto the Exchange 2007 server because the transporter suite requires it for some functionality; starting with Exchange 2007, MAPI and CDO are no longer supplied by default. The actual installation of this package consists of nothing more than a welcome and license screen within a wizard, so I’ll not detail this any further.
You may remember from your reading that it’s possible when installing Exchange 2007 to install it without creating a public folder store. Outlook 2007 no longer relies on system folders found in a public folder store to store free/busy data and so if all clients are running Outlook 2007 it’s no longer strictly necessary to have a public folder store. This is the case for Contoso since it has all desktop clients running Outlook 2007 and has installed Exchange 2007 without configuring a public folder store. Why is this of importance to Contoso’s coexistence with Lotus Domino? The answer to that lies in the fact that the Free/Busy Connector requires the free/busy system folder for functionality. Therefore, it’s a requirement to have a public folder store in Contoso’s environment.
Let’s first go over how to create this public store using the Exchange Management Console. You can obviously skip this part if you already have a public folder store.
Run the console. In the console tree navigate to Server Configuration and then Mailbox.
In the work pane, right-click the relevant storage group and choose New Public Folder Database… from the context menu. This brings up the New Public Folder Database wizard.
In the Public folder database name: field, type a suitable name for the new public folder database. In this example, we’ll call it Exchange Free Busy since that is all it is going to do; you might choose a different name if the store is to hold user public folders too. Click the Browse… button next to the Database file path: field and ensure that the public folder store will be located where you want it to be. Once you’ve got the right location, click the Save button which will then take you back to the opening screen of the wizard. Ensure that the Mount this database check box is selected then click the New button. The completed screen is shown in Figure 27.

Figure 27: New Public Folder Database Wizard
The new public folder database should then be created and mounted successfully. If you want to use the Exchange Management Shell to create the public folder database, use the New-PublicFolderDatabase cmdlet.
We now need to use the shell anyway to complete the configuration. To define the access method used for free/busy requests across forests, the Add-AvailabilityAddressSpace cmdlet must be used. The parameters we need are as follows:a. ForestName. This needs to be the SMTP domain used by Fabrikam’s Domino users, namely fabrikam.com.b. AccessMethod. The AccessMethod parameter should be set to a value of PublicFolder.Therefore our full cmdlet becomes:Add-AvailabilityAddressSpace –ForestName fabrikam.com –AccessMethod PublicFolderIf all has gone well you should see a screen similar to that shown in Figure 28.
Figure 28: Add-AvailabilityAddressSpace cmdlet
Disable Public Virtual Directory SSL
There is one more step required before we proceed to create the Free/Busy Connector. This step may or may not be required, depending on the Exchange 2007 configuration. Microsoft states that if the Mailbox and Client Access Server roles exist on the same server, it’s a requirement to disable SSL on the Public virtual directory in Internet Information Services (IIS) Manager. Here’s what to do:
Run IIS Manager.
Navigate to the Default Web Site and locate the Public virtual directory.
Right-click the Public virtual directory and choose Properties from the context menu. The Public Properties window appears.
Go to the Directory Security tab and click the Edit… button found in the Secure communications section. This brings up the Secure Communications window.
Clear the Require secure channel (SSL) check box as shown in Figure 29. Once this has been done, click OK twice and then exit IIS Manager.

Figure 29: Clearing SSL on the Public Virtual Directory

Creating the Free/Busy Connector
That was quite a few steps required to configure the Exchange and Domino environments and we’ve not actually created the Free/Busy Connector yet! The actual creation of the Free/Busy Connector is very easy. However, before we get to that, here’s a quick note about permissions. You’ll remember that for this article I’m using the default Domino administrator account when connecting back to Domino. The account connecting back to Domino requires a minimum of Editor access to the Domino directory file, names.nsf. Fortunately, the default Domino administrator account has Manager access and thus this requirement is met; this was shown in Figure 3 from part two of this article. In a similar manner, Microsoft states that the account used to connect back to Domino requires at least Reader access to the Domino Local free time info database file called busytime.nsf.
Now it’s time to create the Free/Busy Connector. From within the Transporter Management Console the steps are as follows:
Select the Connect option from the console tree.
Either right-click the Connect option and choose Create Free/Busy Connector… from the context menu, or choose the same named option from the Action pane.
You’ll now be at the Create Free/Busy Connector wizard introduction screen. Click Next here and then click Create at the Progress screen. Like the Directory Connector created in part one, that’s all there is to it. You can then click Finish to exit the wizard.
The result is a newly created but un-configured Free/Busy Connector that’s shown below the previously created Directory Connector. This is shown in Figure 30.

Figure 30: Newly Created Free/Busy Connector

To create the connector within the Transporter Management Shell all you need to do is to run the New-DominoFreeBusyConnector cmdlet.

Configuring the Free/Busy Connector
Like the Directory Connector, you can configure the Free/Busy Connector at the same time it is created by using the various command line parameters. Later we’ll look at the cmdlet used to create the Free/Busy Connector created via the management console. For now, here’s how to configure the Free/Busy Connector from within the management console.
Highlight the Free/Busy Connector that was just created, right-click it and choose Properties from the context menu. Alternatively, choose the Properties option from the Actions menu.
The properties of the Free/Busy Connector are displayed and you will see two tabs to be configured. The default General tab is displayed which can be configured as follows. A completed screen shot is shown in Figure 31.a. Schedule. This is obviously how often the free/busy process runs. You have a choice here of never, every 30 minutes, or every 1, 6, 12 or 24 hours. We’ll choose every 30 minutes for this article.b. Days of Free/Busy information. By default, 60 days worth of free/busy information will be retrieved but this can be changed if required. The default is fine for this installation.c. Maintain information in cache (seconds). This is set to 900 seconds by default, which is 15 minutes. Retrieved schedule information is held in cache for 15 minutes using this default value, which means that any if other schedule requests for users whose details are already held in the cache occur within 15 minutes, that information will be returned from the cache rather than being retrieved again.d. Timeout (seconds). The Exchange server will wait 15 seconds whilst contacting the Domino server for free/busy information, otherwise a timeout will occur.e. Domino Server running the ExCalcon.exe task. In this case, this is obviously Fabrikam’s Domino server that we just installed excalcon.exe onto. It’s important to enter this information using the hierarchical Domino server name, which is domino/fabrikam in this case.f. Notes Password and Confirm Password. Here we need to enter the Notes ID password for the account that’s configured on the Notes client installed on the server containing the transporter suite.
Figure 31: Free/Busy Connector General Tab
Finally, switch to the Advanced tab and enter any Domino connected SMTP domains via the Add button. In this case, fabrikam.com is entered as this is the SMTP domain name in use by Fabrikam. The completed screen is shown in Figure 32.
Figure 32: Free/Busy Connector Advanced Tab
Once all parameters and fields have been configured, click OK to close the properties window and you’ll then be returned to the main transporter suite window.
You can also create and configure a Free/Busy Connector at the same time via the New-DominoFreeBusyConnector cmdlet. Like the Directory Connector there are a lot of parameters that I won’t repeat here; the Syntax portion of Figure 33 should give you an idea of what the parameter names are. The transporter suite help file has full details.
Figure 33: New-DominoFreeBusyConnector Syntax
You can now start the Microsoft Exchange Free Busy Connector for Lotus Domino service on the Exchange server. Don’t forget to set it to a startup type of Automatic as well.

Testing Free/Busy Access
Earlier in Figure 16 from part three of this article, you saw the situation where Exchange User 1 attempted to book a meeting with the Fabrikam user called Domino Administrator. Without the Free/Busy Connector, the Contoso user saw the familiar ‘no information’ hatched line when querying for free/busy information. What happens now? Let’s have a look at Figure 34 and see what has happened.

Figure 34: Free/Busy Information Across Systems
As you can see, Exchange User 1 can now see that the Fabrikam Domino user is busy at a potential meeting time.

If you’ve been following this article so far you’ll remember that we’ve installed the Transporter Suite for Lotus Domino onto our Exchange 2007 server, configured two-way directory synchronization between Exchange and Domino and also configured calendar free/busy access across the two systems. This has allowed Contoso, running Exchange, and Fabrikam, running Domino, to happily coexist but it has now become a requirement to migrate the Fabrikam Domino users to Exchange. However, before we migrate the mailbox contents from Domino to Exchange, we must first migrate the Domino users to Active Directory and that will be the focus here in part five of this article.

Domino Directory Migration
The transporter suite can be configured to migrate information from the Domino directory into Active Directory, either into existing user accounts or new user accounts. For this article, new Active Directory user accounts will need to be created in Contoso’s Active Directory domain. To support this, let’s create a new Organizational Unit (OU) called Migrated Domino Users. This OU will contain the newly created user accounts, whilst the Domino Users OU maintains the mail-enabled contacts created as part of the directory synchronization process.
Let’s look at the steps required to complete the directory migration process. They are as follows:
Run the Transporter Management Console.
In the console tree, expand Migrate and then click Directory. You should be presented with the Enter Domino Credential window as shown in Figure 35. Enter the credentials of the Domino user in use by the Notes client, just as you’ve done before, and then click OK. In this case, this is the password belonging to the Domino Administrator account.

Figure 35: Enter Domino Credential Window
Back at the main transporter suite window, you should now see the Domino users listed as seen below in Figure 36. Note that the Active Directory Account field is currently blank since no Active Directory account has been created yet; that will change shortly. You can now select the users that you wish to migrate to Active Directory. I use the term ‘users’ since you can shift-select or ctrl-select multiple users at the same time. As you can see from Figure 36, Domino User 1 has been selected for directory migration.

Figure 36: Selecting Users to Migrate to Active Directory
With the user(s) selected, right-click and choose Migrate selected user… from the context menu or choose the same option from the Action pane. This is the process to use if you want to create new Active Directory accounts for the Domino users. We’ll cover the main difference with the other option, Migrate with manual Active Directory lookup… later in this article. Right now, having selected the migrate user option, you should now see the Domino User Migration wizard which commences with the Introduction screen.
The next screen is the New Account Options screen which should be completed as follows. A completed screen is shown in Figure 37.a. Active Directory container. Choose an OU to store new user accounts. In this example we’re going to store ours in the Migrated Domino Users OU.b. New account initial password. Since we’re creating new Active Directory accounts, we can choose to set the initial password at this point. Also note the option that forces the users to change their passwords at their first logon.

Figure 37: New Account Options Screen
Next up is the Mailbox Options screen, which allows you to create an Exchange mailbox for the Domino user account being migrated to Active Directory. You don’t need to create a mailbox at this time since that can also be done when you move the mailbox contents from Domino to Exchange later on. Let’s choose to create a mailbox now though, since we know we’re going to migrate the mailboxes from Domino to Exchange anyway. The completed screen is shown in Figure 38.

Figure 38: Mailbox Options Screen
The penultimate screen is the Progress screen, which simply requires you to click the Migrate button to complete the overall process. If all goes well, you should end up at the Completion screen with a successful migration as shown in Figure 39.
Figure 39: Completion Screen
Back at the main transporter suite screen, notice how the Active Directory Account field is now populated for the migrated Domino user as shown in Figure 40. Also, we can confirm the successful migration of the users by first checking the Migrated Domino Users OU for the presence of the Active Directory accounts as shown in Figure 41, and second by checking that the mailboxes were in fact created as shown in Figure 42. You can also confirm that the mail-enabled contact for Domino User1 is no longer present in the Domino Users OU.
Figure 40: Domino User Migrated to Active Directory

Figure 41: Migrated Domino Users OU After Migration to Active Directory

Figure 42: Migrated Domino Users Mailboxes After Migration to Active Directory

Migration With Manual Active Directory Lookup
Earlier in this article I stated that I’d cover the main difference between the Migrate selected user… and the Migrate with manual Active Directory lookup… menu options. If you would like to associate the Domino users with existing Active Directory accounts you’d choose the second option for manual Active Directory lookups. If you do this, the second screen in the wizard is then the Manual Active Directory Lookup screen as shown below in Figure 43. To choose an existing account you simply click the Browse… button and select the relevant account.
Figure 43: Migrating Domino Users With Manual Active Directory Lookup

Command Shell Migration
As you can guess, you can also move users to Active Directory via the Move-DominoUser cmdlet. Do not confuse this with the Move-DominoMailbox cmdlet that we’ll mention in the next and final part of this article. Let’s move Domino User3 via the Transporter Command Shell. However, before we do, you should note that to supply the initial password requires a secure string – in other words you can’t simply type the text. Let’s use a variable called $password as follows:
$password = Read-Host “Enter Initial Password” -AsSecureString
Note that the password is shown as each character being an asterisk, just as you’d expect. This is shown in Figure 44.

Figure 44: Setting Secure String Password
Now we can pass this password into the Move-DominoUser cmdlet as follows. The result is shown in Figure 45.
Move-DominoUser –SourceIdentity “Domino User3/Fabrikam” -TargetOU “Migrated Domino Users” -DominoDirectoryServer dom-domino.contoso.com -InitialPassword $password
Figure 45: Migrating Domino Users via the Transporter Command Shell
One thing to note with the previous cmdlet is that I’ve elected not to create an Exchange 2007 mailbox on this occasion. If I wanted to do this, I’d add the –TargetMailboxDatabase parameter to the cmdlet.
We’ve covered the installation of the transporter suite, the configuration of directory synchronization and calendar free/busy sharing between Contoso’s Exchange system and Fabrikam’s Domino system, and also the migration of users from the Domino directory to Active Directory. In this final part we’ll cover the actual migration of the Domino mailbox contents into an Exchange 2007 mailbox. There are a couple of things to consider before we actually migrate the mailbox data, so let’s start with the enabling of Exchange impersonation.
Exchange Impersonation
Before you migrate the Fabrikam users’ mailbox contents to the Contoso Exchange system, you must enable Exchange impersonation. This is a process that allows the user account that you are using to temporarily be authenticated as the mailbox owner. If you don’t do this, you’ll see the error below when attempting to migrate a mailbox.
Figure 46: Impersonation Error When Migrating a Mailbox
To set Exchange impersonation, you need to use the Exchange Management Shell. The cmdlet to use is the Add-ADPermission cmdlet. In my example scenario, the user account that I am using to migrate the mailboxes is Contoso’s Administrator account. In this case, the cmdlet syntax is as follows:
Add-ADPermission – Identity (Get-ExchangeServer).DistinguishedName –User (Get-User –Identity Administrator Select-Object).Identity –ExtendedRight ms-Exch-EPI-Impersonation
That’s quite a complicated cmdlet so be sure to type it correctly unless you are pasting it in. If you do paste it in, make sure you change the account name if you need to; the account name in my example is ‘administrator’ found roughly in the middle of the overall cmdlet. In Figure 47, you can see the cmdlet being run and the resulting output:
Figure 47: Running Exchange Impersonation Cmdlet

Handling Large Attachments
The final thing to consider before performing the actual migrations is the handling of large attachments. Exchange Web services are used to migrate the mailbox contents but by default Web services will not migrate attachments that are larger than 4MB unless some additional configuration is made. The error that you will see when attempting to migrate attachments greater than 4MB is shown in Figure 48. Note the warning error text that includes the subject of the message, which in this case was ‘Large attachment’ as well as the error detail of ‘maximum request length exceeded’.

Figure 48: Attachment Migration Warning
To raise the limit past 4MB requires a change to be made on every Client Access Server within the Exchange organization. The change is to add an additional line into the web.config file that is part of the EWS virtual directory on a Client Access Server. You can either make this by browsing for the file within the file system itself, or via IIS Manager. The latter option ensures that you are modifying the correct file so that’s what we’ll use here. The change is achieved by the following series of steps:
Run IIS Manager.
Expand the Client Access Server name, which is W2K3BASE in this example. Under that, expand Web Sites followed by the Default Web Site object to reveal the virtual directories underneath. One of these will be the EWS virtual directory.
Right-click the EWS virtual directory and choose Explore from the context menu. In the right-hand pane several files should now be visible as shown in Figure 49.
Figure 49: Exploring the EWS Virtual Directory
Notice that one of the files is named web.config. Right-click this file and choose Open from the context menu. In the resulting window, select the Select the program from a list option and click OK.
You should now be at the Open With window. Choose the Notepad application to open the web.config file with, and optionally the check box to Always use the selected program to open this kind of file.
The web.config file should now be open in Notepad. Locate the string that is found towards the end of the file. Under this text, add the following string. Note that in the example I’m using below the value is set to 20480, which is in KB. Thus, I’m allowing attachments up to 20MB.
Your web.config file should now look like the one shown in Figure 50 below. Assuming you’re happy with this, save the file and then close both Notepad and IIS Manager.
Figure 50: Modified web.config File

Mailbox Migration
We are finally there – the point where we can now migrate the mailbox contents off of the Domino server and onto the Exchange 2007 server. The Contoso administrator will be running the migration process from the actual Exchange 2007 server itself, since this is where the Notes client has been installed. It is possible to run the migration process from a workstation, although the Exchange Management Console and Notes clients must also be installed there. The Notes client ID file must have Reader access or higher to the databases containing the mailbox information that is to be migrated.
Here are the steps required to complete the mailbox migration:
Run the Transporter Management Console and navigate to the Mailboxes object in the console tree.
In the work pane, right-click the mailbox or mailboxes to be migrated and choose Migrate Selected Mailbox… from the context menu. In actual fact, even the context menu text changes to Migrate Multiple Mailboxes… if you select multiple mailboxes for migration. This will invoke the Domino Mailbox Migration wizard, which has an opening Introduction screen.
The next screen, the Migration Options screen, should be configured as follows. A completed screen is shown in Figure 51.a. Target Exchange Mailbox Database. Here you need to click the Browse… button and in the resulting Select Mailbox Database window choose the relevant database to store the new mailbox. This is a required action even if you created a mailbox when migrating the Domino user from the Domino directory to Active Directory.b. Filter Options. Choose the date range for mailbox data that you want migrated. If you want everything migrated, leave the check boxes deselected.

Figure 51: Mailbox Migration Options Screen
The next screen is the Progress screen. Just click the Migrate button to commence the migration process. If the migration process completes successfully, you should see the Completion screen looking like the one shown in Figure 52.

Figure 52: Successful Domino Mailbox Migration
Of course, as you’ve guessed by now you can also use the command shell to migrate mailboxes as well. The Move-DominoMailbox cmdlet is the one to use. For example, to migrate the mailbox belonging to the Domino Administrator account to Exchange 2007, we’d use a cmdlet such as:
Move-DominoMailbox –SourceIdentity “Domino Administrator/Fabrikam” –TargetMailboxDatabase “W2K3BASE/First Storage Group/Mailbox Database”
I’ve wanted to focus more on using the management console in this article but as you can see the command shell is very useful for performing tasks such as the bulk migration of users from Domino to Exchange.
Just to satisfy ourselves what things look like when migrated, Figure 53 shows Domino User 9’s Inbox after migration. The calendar and tasks items also migrated too.
Figure 53: Migrated Domino Mailbox

Exchange 2007 Installation

2008-07-11T02:15:00.000-07:00

MS Exchange 2007 Installation

Installing previous versions of Exchange was never a difficult task as long as you were prepared. You would install the required IIS components then prep the domain and you were ready to go.

Exchange 2007 changes the installation procedure, but it is still as easy as previous versions, as long as you understand the differences.

System-wide Requirements
As with any application, Exchange 2007 has a certain set of requirements that must be met before you can proceed with the installation and these requirements can be spilt into two types, system-wide and server-specific. System-wide requirements ensure that your Active Directory is ready to accept Exchange 2007 servers and server-specific requirements ensure that the server that Exchange 2007 will be installed on can support it.
One of the bigger requirements is that Exchange 2007 requires the domain functional level to be at Windows 2000 native mode or higher (see figure 1). On top of that Exchange 2007 also requires that the Schema master and the Global Catalog servers run Windows Server 2003 with SP1 applied. It goes without saying that you also need a functional DNS infrastructure in place. If you are installing Exchange 2007 into an existing organization, the Exchange mode must be set to native-mode. This means no Exchange 5.5 servers anywhere in the Exchange organization. If you still have any Exchange 5.5 servers, you will need to upgrade them to Exchange 2000/2003 or remove them completely before proceeding with the installation of Exchange 2007.
Figure 1: Domain Functional Levels
As with Exchange 2000 and 2003, the forest and domain needs to be prepared with schema extensions. However, unlike the previous versions, Active Directory does not need to be prepped beforehand, it is done automatically during setup, but the option does exist to allow for manual schema upgrades. During the setup process the server will connect to the Schema Master in an effort to update the schema and this requires that the Schema Master is available and that the account you are running setup with has permissions to modify the schema.
If you wish to prep the domain manually, you can do so with the /PrepareAD switch on any server in the same domain that the Schema Master is in but it is recommended to do this on the Schema Master. Once you have completed this, you will have to wait for the schema updates to replicate throughout the forest before you install any additional Exchange 2007 servers in the organization.
Finally, as with all Exchange installations, you require certain administrative rights in order to install an Exchange 2007 server. The following is a list of required permissions required to install an Exchange 2007 server into a new, or existing organization.
Local Administrator on the server
Enterprise Administrator
Domain Administrator
Schema Administrator (only required for first install to extend the Schema)

Server-specific Requirements
Server-specific requirements for Exchange 2007 include both hardware and software. In order to install Exchange 2007 the server must be running Windows Server 2003 x64 and have SP1 installed. You must also install the .NET 2.0 Framework and MMC 3.0 but if you do not have these two components installed, you can install them during setup.
Exchange 2007’s hardware requirements have been upgraded from Exchange 2003 with the biggest change being the requirement for x64 CPUs. The minimum hardware requirements are as follows:
Any Intel Xeon or Pentium 4 64-bit processor
Any AMD Opteron or Athalon 64-bit processor
1GB of RAM plus 7MB per mailbox
1.2 GB of available disk space on the drive on which you install Exchange
200 MB of available disk space on the system drive
DVD-ROM Drive
SVGA or higher-resolution monitor
NTFS File System

Note:Exchange Server 2007 Beta 2 includes 32bit builds but the RTM will be x64 only. You also need KB904639 (for x64 systems) and KB868060 installed.
Exchange has always relied on IIS services, but Exchange 2007 requires less out of IIS and in some cases, IIS is not required at all.
Exchange 2007 no longer requires the IIS SMTP and NNTP services installed as it has its own built in SMTP server and, for messages being transported between Exchange 2007 servers with the organization, uses MAPI. Depending on the role or roles installed on the server, different components are required. The following chart shows which additional services each role requires.
Role Additional Components
Edge Transport None
Hub Transport None
Mailbox Server Network COM+, IIS, World Wide Web
Client Access Server World Wide Web
Unified Messaging Server Speechify (installed by E2007 Setup)

Preparing Active Directory
As previously mentioned, the installer will do all the AD preparation automatically. That does not mean that you cannot do it manually, in fact I’d suggest doing it manually on the Schema Master while it is disconnected from the domain. That way, if something goes wrong while the schema is being extended you can simply blow away the server and seize the role on a different server.
Preparing Active Directory manually offers more options than before and there maybe more commands for you to run, depending on your current environment. If you are currently running any Exchange 2000 or 2003 server the first command you must run is
Setup.com /PrepareLegacyExchangePermissions
This command must be run under an account with Exchange Admins permissions and the domain must be able to communicate with all other domains in the forest while being run. Finally, you will need to wait for the permissions to replicate before continuing.
The next command will prepare the schema, and this means the account you run this command from, must be a member of the Schema Admins group as well as the Exchange Admins group.
Setup.com /PrepareSchema

Figure 2: PrepareSchema
This command must also be run in the domain that contains the forests Schema Master, and again, you should wait for the changes to replicate throughout AD before continuing. Replmon, from the Support Tools, is a great tool you can use to determine when the changes have been replicated.
The third command that you need to run preps the current domain, adds the Exchange Universal Security Groups and configures the Exchange objects with AD. The command
Setup.com /PrepareAD

Figure 3: PrepareAD
This command requires different permissions, depending on your current configuration. You need to run this with Enterprise Admin privileges, and if you have any Exchange 2003 servers within your current organization, you need to be a member of the Exchange Organization Administrators group. Again you will need to wait for the changes to replicate before proceeding. You can check for this by looking for the following new Security Groups in the root domain in an OU called Exchange Universal Security Groups (EUSG).
Exchange Organization Administrators
Exchange Recipient Administrators
Exchange View-Only Administrators
Exchange Servers
Exchange2003 Interop
The final step is optional and is only required to run if you have multiple domains within the forest. This command configures the other domain, or domains, in the forest. It does not need to be run on the domain that you run /PrepareAD in, but any additional domains will need this command run. You have three command line options with this command.
Setup.com /PrepareDomain – Prepares the current domain
Setup.com /PrepareDomain:FQDN of target domain to be prepped
Setup.com /PrepareAllDomains – Prepares all domains in the forest.
Once you have completed all the commands, you can verify that you are ready to start installing Exchange 2007 by looking for the following.
The Microsoft Exchange Systems Objects container contains a global group called Exchange 12 Domain Servers
The ESUG has the Exchange 12 Domain Servers global group as a member.
The ESUG will have permissions to the Manage Auditing and Security Log settings on all DCs in all domains that the commands were run against.

With all the prerequisites taken care of we can begin the Exchange 2007 installation. The GUI-based installation is pretty straightforward. Insert the CD and run Setup.exe from the root of the disc. You will need certain permissions depending on your current configuration and how you prepared the domain. You will need Enterprise and Local Administrator privileges, and if you have not already prepared the domain you will also need Schema Administrator permissions as well. If you already have an Exchange 2007 server in the domain you will also need to be a member of the Exchange Organization Administrator group.
The Welcome screen will appear and you will see right away if you have the required software prerequisites. Figure 1 shows that the .NET Framework 2.0 is installed (it is grayed out) and MMC 3.0 is also installed but Microsoft Shell (MSH) is missing. If you are missing either of these components, you can simply click on the item to install it.

Figure 1: Prerequisites
Once the install wizard starts you can read over the Introduction then read and accept the EULA. Next you have the option of enabling Error Reporting, make your choice and then click next. You will be given two install choices; Typical and Custom (see Figure 2). The typical install will install all the roles with the exception of the Edge Transport role. If you wish to customize the installation, choose the Custom install option. Here you can also change the install location if you wish to do so.

Figure 2: Install Options
When you choose the custom option and click next you will be given a number of selections and you can choose which role, or roles, to install. You can also select to install Active or Passive Mailbox server clusters, or just install the Management Console (see Figure 3).

Figure 3: Server Roles
Before you can continue, you will have to provide the name of the Exchange Organization and be asked if you have any computers running versions of Outlook 2003 or earlier (see Figure 4). This option will create Public Folders if you select yes, but choosing no will not create any Public folders.

Figure 4: Outlook Versions
You will need to be aware of a few things when choosing what roles to install where. If you are running a multi-site AD environment you need to install a Hub Transport and Mailbox server in each AD Site. You also must install a Client Access server in each site that contains a Mailbox server. Finally, all the roles can be installed on the same server (except Edge Transport) or on individual servers.
The installation will now run a set of pre-checks to determine if the domain and server are ready to accept an Exchange 2007 server. Figure 5 shows an example of some common errors you will see if IIS is missing, or if the domain is not at the required functional level (notice the Install button is grayed out).

Figure 5: Failed Readiness Check
When all of the Readiness Checks pass, the Install button will appear and you can press it to start the installation (see Figure 6).

Figure 6: Successful Readiness Check
You can watch the install progress and depending on the roles installed it can take a while. Once complete, click Finish and you are ready to begin configuring your Exchange 2007 server (see Figure 7).

Figure 7: Install Progress
CLI and Unattended Installation
Exchange 2007 also supports installation from a command line interface (CLI), which can be used to perform unattended installations as well. There are a number of switches that are required depending on the type of Exchange 2007 installation you are performing.
/roles – specifies which server roles will be installed. Can be substituted with /r
ET or E – Gateway Server
HT or H – Bridgehead Server
CA or C– Client Access Server
MB or M – Mailbox Server
UM or U – Unified Messaging
MT or T – Admin Tools
/PrepareAD – is used to prep the Active Directory schema manually. This switch is optional as the schema is extended automatically during installation. Can be substitued with /p
/TargetDir – specifies the directory in which to install Exchange 2007. Can be substituted with /t
/SourceDir – specify the location of the install files
/DomainController – allows you to specify a DC to use. Can be substituted with /dc
/AnswerFile:filename
/mode – Determines if the install is a default install or a recovery install. Required if you wish to use the /RecoverServer switch
Install – this is the default mode used when no /mode switch is provided
Upgrade – this mode is used when upgrading an Exchange 2007 installation
Uninstall – this mode is used to uninstall Exchange 2007 or one of its roles
RecoverServer – this mode is used when recovering a failed Exchange 2007 server
The basic syntax of a CLI or unattended installation is as follows:
Setup.exe /console /roles: /mode: [/targetdir:] [/prepareAD] [/RecoverServer] [/?]
To install Exchange 2007 with the Bridgehead, Client Access and Mailbox server roles, you would use the following from a command prompt:
Setup.exe /roles:ET,MB,CA or
Setup.exe /r:E,M,C
Let’s say you wanted to install a Gateway server and put the program files in a directory on the D drive called E2007 and you wanted to read and write from DC1; you would use the following switches with Setup.exe:
Setup.exe /r:E /targetdir:D:\E2007 /dc:dc1.thelazyadmin.lab
This last example demonstrates what command you would use to install a new Exchange 2007 server during a disaster recovery operation.
Setup.exe /mode:recoverserver
Once the command is executed, setup will proceed to determine if .NET 2.0 Framework, MMC 3.0 and the Microsoft Shell is installed. If any of the other prerequisite checks fail, setup will stop and display an error message.
Verifying Installation
Once you have completed the installation, you should verify that everything completed successfully. To do this there are a few things you can check out. The first thing you can do is open up MSH and run the following command which will list the roles installed (see Figure 8)
Get-ExchangeServer

Figure 8: MSH Get-ExchangeServer
Next look in the Application Log in Event Viewer for event ID 1003 and 1004 which verify that install was successful. Finally there are a number of log files created that you can browse to verify that the install was successful and if it was not, what might be wrong.
%SystemDrive%\Exchange\ExchangeSetupLogs\Setup.log – will tell you if the prerequisite checks passed and what roles were installed.
%SystemDrive%\ExchangeSetupLogs\ExchangeServerMSI.log – will tell you if the file extraction was the cause of any errors.
%SystemDrive%\ExchangeSetupLogs\Exchange Server Setup Progress.log – will tell you what system changes were made during the installation.
%SystemDrive%\Program Files\Microsoft\Exchange Server\ Logging\SetupLogs\setup.log – tracks operations during install, look here when an install fails.

BLackberry Hand Held Troubleshooting

2008-07-11T01:21:00.000-07:00

Q. how to search Search Corporate Global Address Book
If your company uses a BlackBerry Enterprise Server, you can search your company’sGAL or NAB from within the Address Book application, or when you are composingan e-mail message to a recipient from your Address Book. To perform a search fromthe Address Book application, use the following procedure:1. Enter the name of the person (full or part) you wish to search2. Click the trackwheel, then scroll the trackwheel to Lookup and click again toselect3. When the handheld retrieves the person’s details from the GAL/NAB, clickreturn to use in your e-mailNote: When the handheld is searching the GAL/NAB, if there are more people inthe company with the same name, you will then be notified of the amount ofmatches with a Matches list (20 at a time, if there are more). The same mayhappen if you have only entered part of the person’s name, the Matches list willthen be of people’s names that match the part of the name you have entered. Toview the Matches list, click the trackwheel and select View List. When the listappears, highlight the correct person, then press return and press again ifcomposing an e-mail.

Q. personal address book synchronization doesn't work
though its automatic in Blacberry but somtimes if you are using Lotus as a mail server, it doesnt work. In that case open you Lotus Notes Client. go to Actions->synchronize address book, It will synchronize you personal address bokk with Blackberry hand held.

Q. I've set my alarm, but it doesn't go off.
When you set your alarm, make sure you change the Alarm On/Off field to ON.When the alarm is turned on, a bell icon appears on the home screen below the date.Verify that the Tune and Volume fields are set correctly. Some tunes are longer thanothers, so if you think you may be missing the alarm, you can select a longer one.

Q. The handheld's LCD is very faint. Can I make it brighter?
There are two ways you can make it brighter, depending on when you find the LCD tobe faint:1 If the LCD is faint all the time, even in bright, indoor light, you can adjust thescreen contrast. From the Handheld Options screen, choose Screen/Keypadand adjust the screen contrast to your preference.2 If the LCD is faint when you use it in a poorly-lit or dark area, you can turn onthe backlighting. Press the ALT key three times. Backlighting turns offautomatically if you don't press any key or roll the trackwheel for 10 seconds.

Q. The handheld attempted to register (either automatically or manually), and Ireceived an error message saying "Registration request failed: please try again".I think I am in coverage.
For some reason, your attempt to register on the network has failed. You can registeragain manually by scrolling to and clicking Options on the Home screen, then HostRouting Table. Click to view the menu and select Register Now.With 5820 & 7230 handhelds this procedure slightly differs in that, when in Options,you need to actually select Network Settings rather than Host Routing Table, thencontinue with the above procedure. You will receive a message indicated that yourhandheld is successfully registered. You must be in coverage for registration to work.If you don't receive a confirmation message you may not be in coverage. Ensure thatyou are in an area of sufficient coverage for receiving email messages

Q. My handheld is continuously initializing. What should I do?
Reset your handheld by inserting the end of a paperclip into the small hole at the backof the handheld.

Q. I selected More from the open message menu on my handheld and an errormessage appeared saying "Could not receive 'More': original message wasdeleted".
The handheld tried to retrieve the original message from your mailbox, but found itwas missing or was moved to another location, like an archive folder. Check yourdesktop PC’s mail client (Outlook/Lotus Notes) to check where the message mayhave been moved to.

Q. I tried to receive a message on my handheld and/or send a message, but itdidn't work. I received an error message saying "Please connect the handheld toyour PC". I just received this handheld.
If you receive this message, your handheld has a different encryption key from yourdesktop PC. You cannot send or receive messages until you connect your handheld toyour PC, launch BlackBerry Desktop Manager, and update the key encryption.

Q. A message I sent on my handheld has an X beside it on the Messages screen.What does that mean and what should I do about it?
When a message you sent from your handheld has an X beside it, some problemprevented the message from sending properly.You can find out what specifically went wrong by opening the message and scrollingto the top. The Message Status field will say what went wrong. Check the FAQ forthat message for more information.

Q. I composed a message on my handheld and selected Send from the menu, butit hasn't been sent yet.
There are a few reasons your messages may not be sendng.:
1 Make sure your handheld's radio is turned on and check that the networksettings are correct.
2 If there is a clock icon next to the unsent message, you are not in coverage.You need to be in a place with coverage for your messages to be sent.
3 If there is an X next to the unsent message, something happened during thetransmission. Open the message and scroll to the top. The Message Status fieldwill indicate what happened. Check this list of FAQs to get more informationon the Message Status field.

Q. "Handheld is not registered: please register now". This is the first message Ihave tried to send, and I have never received any messages.
When you first receive your handheld and turn it on, it will attempt to register on theGPRS network. If it is out of coverage, connected to your computer, or turned offbefore it could register, you need to register it manually. Scroll to and click Optionson the Home screen, then Host Routing Table. Click to view the menu and selectRegister Now.With 5820 & 7230 handhelds this procedure slightly differs in that, when in Options,you need to actually select Network Settings rather than Host Routing Table, thencontinue with the above procedure. You will receive a message indicated that yourhandheld is successfully registered. You must be in coverage for registration to work.

Q: What is the largest message size that can be sent to the handheld?
A: Messages are sent to the handheld in 2 KB parts; however, users are able torequest more of the message, to a maximum size of 32 KB is received.

Q: I will be out of coverage for a short period of time. What happens to mymessages?
The wireless data network has a store and forward capability that preventsmessages from being lost. When the radio is turned off, or the handheld is in an areawith minimal or no coverage, messages sent from the handheld will be held at thehandheld and messages sent to you will be stored by the network until the signalbecomes strong enough to successfully communicate with the handheld.

Q: I do not want to back up everything on my handheld. How do I back up onlythe messages on my handheld?
To only backup the messages on the handheld:1 From your computer, click Start > Programs > BlackBerry > DesktopManager > Backup and Restore.2 Click Advanced.3 Under Handheld Database, Name column, select Messages and click the leftarrow button.4 Click File > Save As to save the backed up file to the desired location on yourcomputer.

Q: how to map Fields?
You can customize field mappings for synchronization:
1. Open the BlackBerry Desktop Manager.
2. Double-click the Intellisync icon. The Intellisync window appears.
3. Click Configure PIM.
4. Select the application that you want to customize, and click Advanced.
5. Click Field Mapping.
6. An Intellisync warning appears. Click OK.
7. In the right column, select the field that you want to map to the handheld.
8. Drag it to match the field in the handheld column.
9. Verify that there is a double-headed arrow between the fields. This indicates that the two fields will synchronize.For example, The handheld Address Book has four additional user-defined fields. You can customize the field name, by followingthese steps:
1. Open the Address Book on your handheld.
2. Select a contact and click the trackwheel to view the menu. Click Edit Address.
3. Scroll to the User1 field and click the trackwheel.
4. Click Change Field Name.
5. Delete User1 and type a name.
6. This change is applied globally in your Address Book. The change in the User1 field changes all other entries aswell.
7. You can repeat these steps for up to four user-defined fields.

Q You receive duplicate messages on your BlackBerry deviceDuplicate messages are caused by one of the following:
1 The BlackBerry device is in an area of insufficient wireless coverage.(come to wirelless coverage).
2 Rules or filters forward duplicated messages to multiple folders.(check rules).
3 Multiple instances of BlackBerry Desktop Redirector are running for the same mailbox(use only one instance),

Q not able to delete messages from Blackberry
There is some dicrepeny in the link between the mails in the mail box and Blackberry hand held.wipe you hand held and reactivate with the enterprise server. otherwise cross check all the mails in your mail box with the hand held.

2008-07-10T22:40:00.000-07:00

Install BES 4.1.3 or higher in an Domino Environment

1 Click on setup.exe from the installation CD. provide the user, organization and country information and agree the license agreement.

2. Choose the setup type

3. Accept the license Agreement

4.Check the preinstallation check list and click next.

5. Provide the windows login information and check the installation and log file folder.

6. Select your database environment(SQL or DB2)

7. Check server installation summary and click next.

8 (a). Install the blackberry server

8(b).once the installation is complete click on continue.

It will prompt to restart the server. Even if it does not give any prompt restart the server for an automatic configuration window.

Configuration:
Choose the database location Local or remote If local then give the hostname of local machine. and if remote then provide the host name of the remote machine.
If it’s a new server then provide the configuration database name. also choose the database authentication (windows or SQL).

Type the CAL key from the CD or provided by RIM.

3.Type the SRP address given in the CD or provided by RIM

Provide SRP ID and authentication key from the CD or provided by RIM

Click the check box if you are using WLAN

Provide the SMTP connection for WLAN.

6. If you have selected any messaging connect at the time of setup type then provide the IM connector settings

7. If you are using Proxy to connect to internet then provide the information.

8. Finish the installation

2008-07-10T22:25:00.000-07:00

Install BES 4.1.3 or higher in an Exchange 2007 Environment

Note: In an Exchange 2007 environment BlackBerry Enterprise Server cannot be installed on the mail server as the BES software is not 64BIT compatible.
1. On the server you have selected to load BlackBerry Enterprise Server download and install “Microsoft Exchange Server MAPI Client and Collaboration Data Objects 1.2.1” which is available from the Microsoft Download site (a.k.a ExchangeMapiCdo.EXE). This will install the CDO and MAPI DLLs which are no longer available in Exchange 2007. This replaces the previous requirement to have Exchange System Manager installed as in Exchange 2000 or 2003 environments. The current download link

2. Log onto your Exchange Server using an account which has permissions to create an account. Open the Exchange Management Console and create a service account called BESadmin.

3. From the Exchange 2007 server open the “Exchange Management Shell” which can be found in the Exchange program group. From EMS run the following two scripts to set the delegate control and required permissions:get-mailboxserver “” add-exchangeadministrator “BESAdmin” –role ViewOnlyAdminget-mailboxserver “” add-adpermission –user “BESAdmin” –accessrights ExtendedRight –extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

4. Open Active Directory and from the View menu select "Advanced Features". Then go to each user that will be added to the BES and open their properties, go to the security tab and add the user BESadmin and add the security permission "Send As". (This will overcome some MS patches that prevent BES sending emails). Methods are available to add BESadmin "Send As" rights to all users if required but this method ensures only the required users have permissions added.

5. Make BESadmin a local Administrator of the server where you will be installing the BES software. This is done by right mouse clicking my computer and selecting “Manage”. From Computer Management expand “Local Users & Groups” and select Groups. From Groups double click “Administrators” and add BESadmin.

6. On the BES server go to “Administrative Tools” and open "Local Security Policy" and then expand the "Local Policies" and "User Right Assignment". You need to add BESadmin to "Log on Locally" and log on as Service".

7. Log onto the server where you will be installing the BES using the BESadmin account. Extract the install files and run the install file. Normally you select "BlackBerry Enterprise Server" as the install option once prompted as most sites don't use the MDS services for custom applications (MDS is a much heavier install). Follow the prompts of the install and the server will be required to restart half way through the install. Restart the server and log back on as BESadmin and the install will continue. (Make sure the Connect Test works and the SRP ID etc is validated during the install)

8. After the install is finished open BlackBerry Manager, an error will appear about MAPI client which you can just hit OK. The MAPI setting windows will appear so just add the server name back in and select "Check Name", if it resolves just hit OK and the manager will start.

9. Within Blackberry Manager click on Blackberry Domain in the left column and then the users SERVERS tab in the centre section, select your server within this tab and view the properties below. Ensure that "SRP Status:" is Connected (This can take a few minutes the first time so refresh the screen a few times). Once your status is connected you can start adding users.

10. Within Blackberry Manager click on your server name (The blue server) in the left column and then the users TAB in the centre section, just add a user and the click on that user. You will see all the users’ properties and a drop down menu called "Service Access” and select “Set Activation Password” and set a password of “a” for example.11. Turn on you BlackBerry device and ensure Wireless is enabled. Go into “Options/Settings” and “Time & Date” and set the correct zone and time etc. Then from the home screen go to enterprise activation and enter the users email address and enter the password that was set in step 10. Press the track wheel and select Activate. Within a minute you should get data returned which indicates the process is functioning correct.