Exchange 2010 Couldn't connect to the source mailbox

So I was working on decomissioning a horribly broken and misconfigured SBS 2011 server today. Part of this was to export all of the mailboxes to PST and import on the new server (don't ask why but the customer had two SBS 2011 servers). When attempting to export a mailbox, i ran into this error:

Couldn't connect to the source mailbox.
    + CategoryInfo          : NotSpecified: (0:Int32) [New-MailboxExportRequest], RemotePermanentException
    + FullyQualifiedErrorId : CA71126,Microsoft.Exchange.Management.RecipientTasks.NewMailboxExportRequest

Well that's fun, so i re-ran the export command with -Verbose and ended up with:

New-MailboxExportRequest : Couldn't connect to the source mailbox. -->
MapiExceptionCallFailed: Unable to make connection to the server. (hr=0x80004005, ec=1249)
Diagnostic context:
    Lid: 59431   EMSMDB.EcDoConnectEx called [length=154]
    Lid: 34855   EMSMDB.EcDoConnectEx returned [ec=0x4E1][length=56][latency=0]
    Lid: 59505   StoreEc: 0x4E1
    Lid: 52465   StoreEc: 0x4E1
    Lid: 60065
    Lid: 33777   StoreEc: 0x4E1
    Lid: 59805
    Lid: 52209   StoreEc: 0x4E1
    Lid: 56583
    Lid: 52487   StoreEc: 0x4E1
    Lid: 19778
    Lid: 27970   StoreEc: 0x4E1
    Lid: 17730
    Lid: 25922   StoreEc: 0x4E1

After a bit of googling i did find someone else with a similar error, but their solution actually worked oppositely for me, so here is what i did to resolve:

Set-CASMailbox jsmith -MAPIBlockOutlookNonCachedMode:$false

After that, the mailbox exported correctly. I can't say for sure why this was blocked in the first place, but this did resolve it.

Drag and drop stops working in Windows 7 and 8

I've been struggling with this problem for a long time, and never really found a solution. Basically (and very randomly) drag and drop would stop working on my workstation. This includes dragging emails in Outlook (2007, 2010, 2013), dragging files in explorer, and even resizing columns in certain folders/views/apps. What threw me the most is that the issue persisted when i upgraded to a new workstation with a fresh OS, and also across Windows 7 and 8. I do have a lot of apps, so it's very possible one of them is to blame. A reboot would always fix it, but that's obviously annoying. Anyways, the fix: Go to explorer, click on a file, and press the escape key. That's it. I have yet to investigate why it works, but it works. The working theory is that somewhere a file is stuck in the drag state, and windows doesn't let you drag additional items. Hitting escape must clear that out and let you do it again.

Media Keyboard Shortcuts with AutoHotKey

Recently I switched to a mechanical keyboard, and though I love it, the one thing I missed were the media keys on my old keyboard. At work I frequently utilize the volume and play/pause controls when quickly answering a phone call, and stumbling to hit the volume icon in the system tray was just not quite fast enough. To solve this problem, I ended up installing AutoHotKey and setting up some very simple automation. The basic method is to create a new text file with an AHK extension (I called mine media.ahk) and add the hotkeys to the file. You can mix these up as much as you want, check the AHK docs for more info. This script uses the windows key for all of the hotkeys:

#PgUp::Send {Volume_Up 3}
#PgDn::Send {Volume_Down 3}
#End::Send {Media_Play_Pause}
#Home::Send {Volume_Mute}
#Insert::Send {Media_Next}

After making the file, you can just double click on it for AHK to pick it up. See their docs for making that happen at login. Since I'm on Windows 8, there is already an on-screen volume meter when you start changing the volume, so I did not need an OSD or anything fancy.

ASA 8.2 and Hairpin NAT

Don't ask me why people still do this, but there is occasionally the need to set up hairpin NAT on a firewall. This functionality is where a LAN user accesses another server on the LAN by its static public IP. For example, if i am 10.0.0.6 and i try to access 1.1.1.5, the firewall will turn the traffic around (and rewrite the IP) and send it down to whatever 1.1.1.5 is mapped to in the LAN. This functionality is different depending on the version of ASA software you're running, this is specifically for 8.2. This gets a little messier when you have a mixture of people with 1:1 NAT and PAT set up, but it works either way. Base config that will not work for hairpinning:

interface Vlan1
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0

interface Vlan2
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.0

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) 1.1.1.5 10.0.0.5 netmask 255.255.255.255
static (inside,outside) 1.1.1.6 10.0.0.6 netmask 255.255.255.255

The issue with this is that if any user on the LAN tries to access 1.1.1.6, the ASA doesn't really know what to do with it, and drops it. So there are a few things that need to be fixed at this point:

Allow the ASA to turn the traffic around:

same-security-traffic permit intra-interface

Allow PAT'd users to have their IP rewritten when being hairpinned:

global (inside) 1 interface

Allow static NAT users to have their IP rewritten as well:

static (inside,inside) 1.1.1.5 10.0.0.5 netmask 255.255.255.255
static (inside,inside) 1.1.1.6 10.0.0.6 netmask 255.255.255.255

At this point it should be working normally, so here is the completed config:

interface Vlan1
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0

interface Vlan2
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.0

same-security-traffic permit intra-interface
global (outside) 1 interface
global (inside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) 1.1.1.5 10.0.0.5 netmask 255.255.255.255
static (inside,outside) 1.1.1.6 10.0.0.6 netmask 255.255.255.255
static (inside,inside) 1.1.1.5 10.0.0.5 netmask 255.255.255.255
static (inside,inside) 1.1.1.6 10.0.0.6 netmask 255.255.255.255

Once this is done, you should be able to access the public IPs internally and get the traffic routed appropriately. If you are still having problems, i highly recommend the packet-trace command which can help you find out where the problem is occurring.

Cisco ASA 5505's and "No more processes"

Today i received an error when trying to upgrade the ASDM image on an ASA 5505.  I was copying the new binary via FTP, and this is what i got:

#copy ftp://xxxxx:xxxxx@x.x.x.x/cisco/asm-649-103.bin flash:
Accessing ftp://xxxxx:xxxxx@x.x.x.x/cisco/asm-649-103.bin
%Error reading ftp://xxxxx:xxxxx@x.x.x.x/cisco/asm-649-103.bin (No more processes)

Of course there were no hits on google for this particular error, and "No more processes" sounded very strange.  In the end, the issue was that i misspelled the filename, leaving out the d in asdm.  Obviously this was my fault, but it seems fairly shortsighted for Cisco to use such an obscure error message when something along the lines of "File not found" would have made more sense.

Spam filter blacklists and ISP DNS

This is something that i discovered a long time ago, however every once in a while i forget it's an issue and it bites me in the ass. If you implement a DNS Blacklist (DNSBL/RBL) or URL Blacklist (URIBL/URLBL), you better make sure that the DNS servers your mail server and/or spam software use are not trying to be smarter than they are.

I had a client where we recently deployed an exchange server on-site. Everything was tested and working fine, then the next day they inform us that all of their emails are going to their junk folders. So i pull up the logs, and sure enough every email is either getting caught in the DNS Blacklist or URI DNS Blacklist. The culprit in this case was Roadrunner's DNS servers.

During my investigation i sent a mostly blank email from Outlook through my Gmail account to see what it would do. Based on the debug logs, i found that (as it should) the spam filter (GFI MailEssentials in this case) extracted multiple URLs from my email. Most of them were nonsense (references to Microsoft classes), but one of them was causing the issue. The spam software had found that www.w3.org is listed on a SPAM URI Blacklist (multi.surbl.org) and so the message was deemed to be spam.

A little closer investigation found the following when looking it up:

> www.w3.org.multi.surbl.org
Server:  UnKnown
Address:  ::1

Non-authoritative answer:
Name:    www.w3.org.multi.surbl.org
Address:  204.232.137.207

As some of you may know w3.org are the people in charge of the standards for the web, so obviously their site is legitimate. As some of you may also note, DNS Blacklists are supposed to respond with localhost IPs (127.0.0.0/8), not a routable address. Sure enough, if you browse to that IP returned, you get a Roadrunner search page. This could be considered partially the fault of GFI for accepting it even though it's not a localhost address, but i'll blame Roadrunner in this case.

The solution for the client was of course to change their DNS servers to something else and clear the cache. I don't know how Roadrunner (and i know they're not the only one) can be so naive to think that they can just send people to a search page when they're being stupid, but hopefully this will save someone a headache.

Adtran Total Access Console Wiring

So Adtran has a series of CSUs and Channel banks under the Total Access line that do not have the "modern" DB9 for accessing the console. As far as i can tell, this involves anything under the Total Access 600 series (600R, 604, 608, 612, 616, 624). I needed to get into one today but found that it only has an RJ45 "Craft" port, and none of my DB9/RJ45 adapters and cable combinations worked. I also found that the internet is plain wrong, and none of their solutions worked correctly, so i took it upon myself to figure it out. Note that the manual indicates that this is a proprietary adapter, however they were kind enough to give the pinouts of the unit itself.

Basically if you don't care about flow control, you can set it up pretty easily with just 3 wires. To make my life easy, i did this with a section of Cat5e and two RJ45 keystones, but you can easily adapt this to be an inline cable or something else.

The first thing i did was map out how my RJ45 to DB9 adapter was wired. I believe this is pretty standard (i checked a few of mine), but you may have to pull yours apart to make sure. In the table NC means not connected and i'm assuming that you are using EIA/TIA-568B for wiring.

DB9 Pin	RJ45 Pin	Cat5e Color
1	NC
2	3	Green/White
3	6	Green
4	8	Brown/White
5	5	Blue/White
6	NC
7	7	Brown
8	1	Orange/White
9	NC

The next step was to make the adapter to work for this proprietary Craft port. I took the two keystones and a small length of Cat5e and did the following:

1. Punch in one end as EIA/TIA-568B (Orange/White, Orange, Green/White, etc.)
2. Punch in the other end as follows:
   

   Keystone Pin	Keystone Color	Cable Color
   1	Orange/White	Blue/White
   3	Green/White	Green/White
   5	Blue/White	Green

At this point use any straight-thru cable to go from the keystone to your adapter, and to the unit, and you should be done. Note that this is a basic implementation and does not provide flow control, so you will need to disable that. The settings you would want to use are 9600/1/none/none (baud/stop/parity/flow). Also note that this cable can't be reversed, the side terminated normally should plug into the Adtran.

In case anybody is interested, Pin 1 is the Ground, and Pins 3/5 are Transmit and Receive. In this case, the RJ45 Craft port on the Adtran uses 3 for RX and 5 for TX, so you have to swap those around for the sending side. Pins 2 and 8 are used for Flow Control which i did not wire in. Pins 4 and 6 are DTR (Data Terminal Ready) and CD (Carrier Detect) which i also left unattached.


Update: Here is how you would make it if you want to use a pre-made Cisco console cable (one of the teal RJ45 to DB9 ones). Still terminate the first keystone with EIA/TIA-568B, then use this pinout for the second one:

Keystone Pin	Keystone Color	Cable Color
1	Green/White	Blue/White
3	Green	Green/White
5	Blue	Orange/White