Lock down Exchange to receive only from GFIMaxMail servers

After adding a client to the GFIMAXMail email filtering service, you should lock down Exchange to only receive e-mail from GFIMAXMail servers to prevent spammers from bypassing the filtering.

1. Open Microsoft Exchange Management Console.
2. Open Server Configuration then Hub Transport.
3. If using Microsoft Windows SBS2008 or SBS2011, find the default connector named Windows SBS Internet Receive SERVERHOSTNAME where SERVERHOSTNAME is the name of the server you are working on. Double left click on it to bring up the Properties window.
4. Click on the Network tab.
5. Under Receive mail from remote servers that have these IP addresses, remove all of the entries.
6. Add the IP netblock for your LAN (ex. server IP address 192.168.16.3, so add 192.168.16.0/24).
7. Add the following IP netblocks that correspond to GFIMAXMail's server clusters:
   
   • 174.36.154.0/24
   • 192.69.16.0/24
   • 192.69.17.0/24
   • 192.69.18.0/24
   • 192.69.19.0/24
   • 208.43.37.0/24
   • 208.70.88.0/24
   • 208.70.89.0/24
   • 208.70.90.0/24
   • 208.70.91.0/24
   • 5.10.67.0/24
   • 92.51.176.0/24
   • 94.186.192.0/24
8. When finished adding IP address ranges to the Network tab, click Okay.

A better option would be to add an ACL on your firewall for all incoming Port 25 traffic and add the IP address ranges above, but not all firewall support that type of granular control.

Updating Microsoft Windows Small Business Server 2011 (SBS2011)

There are several important updates that need to be manually installed on Microsoft Windows Small Business Server 2011. Download the files below. Before installing them, perform a full server backup. Then install the updates in this order:

1. Microsoft Windows Server 2008 R2 Service Pack 1
   (download the X64 file only as SBS2011 never came in X86/32-bit version).
2. Microsoft Windows Small Business Server 2011, Update Rollup 4
   (optional but highly recommended)
3. Microsoft Exchange Server 2010 Service Pack 3
4. Microsoft Exchange Server 2010 Service Pack 3, Update Rollup 6
   (optional but highly recommended)
5. Microsoft Sharepoint Foundation 2010 Service Pack 2

Recommended: reboot between each step and take a backup between each step.

You'll need a couple of hours for the average server to install all of the updates. 

SBS2011 error messages after installing Sharepoint 2010 updates

You may get various error messages after installing Sharepoint 2010 updates (such as SP1). This is due to the requirement of upgrading the Sharepoint database after installing updates.

To check this issue, open an elevated Sharepoint 2010 Management Shell and run the following:

(get-spserver $env:computername).NeedsUpgrade

If the the output says True, then you need to upgrade the Sharepoint database. To do that, open an elevated Command Prompt and run the following:

cd \"Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN"
PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures

It should take about 5-10 minutes depending on hardware and the size of the database. It should say successfully upgraded database. I recommend rebooting the server afterwards just to be sure.

For more info: http://blogs.technet.com/b/sbs/archive/2011/07/06/potential-issues-after-installing-sharepoint-foundation-2010-sp1.aspx

How to add Exchange Autodiscovery SRV record using WHM

In order to allow smartphones and e-mail clients (Outlook 2007, 2010, and 2013 in particular) to automatically configure the necessary Exchange server address and settings, an Autodiscovery SRV record needs to be created. If you use cPanel to host your domain name & DNS settings, then you can follow these directions to add an Autodiscovery SRV record into the DNS management in WHM.

1. Log into WHM.
2. Click on DNS Functions then find the domain you want to edit and click Edit.
3. Where it says Add New Entries, enter the following into the first text box:

_autodiscover._tcp

4. You can modify the TTL on the record if you want, or leave it at the default 14400 seconds.
5. Where it says Select choose SRV.
6. Where it says Priority enter:

10

7. Where it says Weight enter:

10

8. Where it says Port enter:

443

9. Where it says hostname enter the external FQDN of your exchange server:

remote.somedomain.com.
(don't forget the period at the end of the hostname)

10. Click Save button at bottom.

11. Use Microsoft's Exchange Autodiscovery tool to check your work:

https://testconnectivity.microsoft.com/

For more info:  https://www.thirdtier.net/2009/02/setting-up-an-external-autodiscover-record-for-sbs-2008/

Network adapter tweaks for Windows Server 2003, 2008, SBS 2008, and SBS 2011

These technologies are great if your environment support them end to end, but if not you may see some of the following issues.

Symptoms include:

• Sporadic Network issues.
• Service failing (Because of network login issues)
• Delay in service start (Because of network login issues)
• Unexplained issues that Seem to be network related but other areas have already been investigated

Resolution: To keep it as simple and reliable as possible

1. Update to latest drivers
2. Disable Everything that says offload or scaling in the NIC properties
3. Disable it for the OS as well

Windows Server 2008 / Server 2012 / SBS 2008 / SBS 2011

• netsh interface tcp set global rss=disabled
• netsh interface tcp set global chimney=disabled
• netsh interface tcp set global autotuninglevel=disabled

Windows Server 2003 / SBS 2003

• netsh int ip set chimney disabled

Copied from: http://exchangemaster.wordpress.com/2010/05/12/disable-toe-and-rss/
and: http://www.symantec.com/business/support/index?page=content&id=TECH197934

Windows Server 2012 R2 Core Notes

To enable PING on Server 2012 R2:

netsh firewall set icmpsetting 8

To enable File & Printer Sharing through filewall:

netsh advfirewall firewall set rule group=”File and Printer Sharing” new enable=yes

To get a list of features on Server 2012 R2:

dism.exe /online /Get-Features

To enable Remote Desktop Connections to the server over a network:

netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes

To enable remote management of Server 2012 R2 via mmc over a network:

netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

netsh advfirewall firewall set rule group="remote event log management" new enable=yes

netsh advfirewall firewall set rule group="Windows Remote Management" new enable=yes

 netsh advfirewall firewall set rule group="remote volume management" new enable=yes

sc config VDS start=auto

Create a Scheduled task to run daily at 10pm:

schtasks.exe /Create /SC DAILY /ST 22:00 /TN BACKUP /TR c:\pathto.cmd

Free GUI tool to manage Server 2012 R2 Core:

http://corefig.codeplex.com/

note: to transfer the extracted contents from the ZIP file to the server, enable the File and Printer Sharing firewall rule above, then connect to the server via SMB: \\servername\c$

Another free GUI tool that combines Corefig with Hyper-V management capabilities:

http://pshvm.codeplex.com/

A commercially available free tool to remotely manage Hyper-V on Server 2012 R2 Core:

http://5nine.com/5nine-manager-for-hyper-v-free.aspx

A free tool to diagnose issues with Remote Management:

http://blogs.technet.com/b/jhoward/archive/2008/11/14/configure-hyper-v-remote-management-in-seconds.aspx

note: when the server and client machines are on Workgroups, add the server administrator to the Credential Manager control panel applet on the client machine, and allow anonymous dcom on the client. This fixes errors such as E_ACCESSDENIED 0x80070005 when using 5Nine Manager for Hyper-V.

How to download files on the console without any additional tools:

powershell.exe "Import-Module BitsTransfer; Start-BitsTransfer -Source http://domain.tld/somefilename.exe -Destination c:\PathToAFolder" 

To download files from an FTP server using ftp.exe, enter these two Windows Firewall rules to allow ftp.exe to connect:

netsh advfirewall firewall add rule name="File Transfer Program" dir=in action=allow program=%SystemRoot%\System32\ftp.exe enable=yes protocol=tcp 

netsh advfirewall firewall add rule name="File Transfer Program" dir=in action=allow program=%SystemRoot%\System32\ftp.exe enable=yes protocol=udp

How to install Logwatch on cPanel servers running CentOS 6

Logwatch isn't included by default in CentOS 6 & cPanel installs. You can install it manually by following these instructions:

1. Go get the latest version of logwatch by going to: http://sourceforge.net/projects/logwatch/
   Make sure you download the NOARCH rpm file.
2. Log into your cPanel server, and run the command as root or with appropriate sudo permissions:
   

   $ rpm -Uvh logwatch-7.3.6-1.noarch.rpm

3. Now you need to edit the logwatch.conf file to add some lines to get it working:
   

   $ nano -w /usr/share/logwatch/default.conf/logwatch.conf

4. Add the following lines after tmpdir = /var/cache/logwatch:
   

   #Output/Format Options
   #By default Logwatch will print to stdout in text with no encoding.
   #To make email Default set Output = mail to save to file set Output = file
   Output = mail
   #To make Html the default formatting Format = html
   Format = text
   #To make Base64 [aka uuencode] Encode = base64
   Encode = 0

5. Save the file.

That is it. You can test your changes immediately by running the following command or wait until the daily cronjob is run.

$ perl /etc/cron.daily/0logwatch > /root/output.txt
$ less /root/output