Restoring an accidentally migrated mail user to On-Prem Exchange

We recently migrated most of our users to Office 365, and due to a miscommunication, three users that should have stayed on premises were migrated, converted to the RecipientTypeDetails RemoteUserMailbox, and had their local mailboxes disconnected.

Reconnecting their mailboxes failed as they were of the wrong user type:

Connect-Mailbox -Identity "Name Surname" -Database "DB10" -User "Name Surname"
This task does not support recipients of this type. The specified recipient Name Surname is of type User. Please make sure that this recipient matches the required recipient type for this task.
    + CategoryInfo          : InvalidArgument: (Name Surname:UserIdParameter) [Connect-Mailbox], RecipientTaskException
    + FullyQualifiedErrorId : E9DDBACA,Microsoft.Exchange.Management.MapiTasks.ConnectMailbox

The solution was to remove the Exchange properties from the user object:

Get-Recipient -Identity "Name Surname" | Disable-RemoteMailbox

After confirming this is what we want to do, the mailbox could be safely reconnected.

However: After reconnecting the mailboxes, the users still couldn’t start Outlook: The program failed to start with an error message “The set of folders cannot be opened”.

The issue here is that DSAccess caches an erroneous query, and the solution is to update the status of disconnected or soft-deleted mailboxes:

Clean-MailboxDatabase -Identity "DB10"

After this, the users could continue working as usual.

Fixing “No DKIM keys saved for this domain” in EOP and Office365

Sometimes a newly added domain in Microsoft EOP will not let you enable DKIM from the web user interface. The only workaround I know of is to prepare the domain using PowerShell.

To connect a PS session to O365, I use the following script, ripped straight from Microsoft’s documentation:

$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking

After waiting for an eternity for the necessary stuff to load, run the following command – and wait another eternity for it to finish:

New-DkimSigningConfig -DomainName "mydomain.tld" -Enabled $true

Note: Unless you’ve already added the necessary _domainkey CNAME records to your DNS zonefile, this command will succeed in generating the DKIM keys, but will fail to enable DKIM signing for the domain. Without looking into it I suspect that the Set-DkimSigningConfig cmdlet could be used to enable signing.

Finally disconnect from your O365 PS session:

Remove-PSSession $Session

Your domain now signs mail sent through O365 or via Exchange Online Protection.

Bonus knowledge: With a recent version of PowerShell Core installed, you can manage situations like this from a regular Mac or Linux box.

DNS/DHCP issues in modern Windows versions

Static IP addresses are a solid way to configure machines if you have few enough of them to manage them manually. But the more ability you want to have to change things on the fly, the more limiting such a configuration scheme becomes.

Unfortunately I’ve had severe problems with getting servers with DHCP leases (or even DHCP reservations) to have their names stick in DNS over time. Suddenly, after a reboot a machine would seemingly drop off the network even though it had the same IP address as earlier. Rebooting or manually re-registering its DNS record would solve the problem, but it wasn’t an acceptable solution to the underlying issue.

I found a discussion that gave a few pointers on how to get these things working in Windows, and I’ve shamelessly ripped the relevant points to present them here:

Step one: Define a user in whose context the DHCP server will run

Simply add a domain user with no special rights, and give it a properly strong password. Then open the DHCP management console, right-click the protocol you want to change (IPv4 or IPv6), and select Properties and the Advanced tab. Click Credentials and enter the relevant information for the account.

Step two: Tell DHCP to always attempt to update DNS records

In the same properties window, select the DNS tab. Ensure the following choices are ticked:

Enable DNS Dynamic Updates(…) -> Always dynamically update DNS records
Dynamically update DNS records for DHCP clients that do not request updates

Step three: Ensure DHCP server AD group membership

The DHCP server(s) should exist in the group DNSUpdateProxy. No other user or computer accounts may exist in this group.

Other tips

Make sure DHCP leases are longer than 24 hours, or bad things are likely to happen. A concrete example given is that Microsoft KMS servers have a 24 hour update cycle.


Exchange – another lesson learned

This is why we test things before going live:
After migrating a test box from the old Exchange environment, it could receive mail just fine, and sending mail out of the organization worked flawlessly too. Unfortunately any mail sent from this account to recipients within the old Exchange environment got stuck in the mail queue.

Logically as usual, the fix was to complement the default receive connectors on the old servers with the explicit addresses of the new Exchange servers, even though they naturally were well within the range. Way to go, Microsoft!