Tuesday, 8 January 2013

Installing Exchange 2007 on Windows Server 2008

What you need to know about installing Exchange 2007 on Windows Server 2008.
In this article I will cover the installation of Exchange 2007 SP1 on Windows Server 2008. I will lay out which versions of Exchange are supported on which OS version and also which domain controller version they can use. I will detail the supported methods to move from Exchange 2007 on Window Server 2003, to Exchange 2007 on Windows Server 2008 and finally I will cover the prerequisites needed, before showing the actual install.
Note:At this time, neither Windows Server 2008 nor Exchange Server 2007 SP1 have released to manufacturing. As I am therefore working with beta code, certain elements of what follows (in particular the screenshots, may change before the final version.

Introduction

It is nearly a year after the release of Exchange 2007 and many of us now have complete Exchange 2007 implementations. I guess that means we are looking for something new to do! If this is the case then you won’t be disappointed, as very soon we will be presented with the new challenge of moving our existing Exchange 2007 systems onto Windows Server 2008.
Table 1 lists the various supported scenarios for Exchange and OS versions.

Exchange Version	Server OS Supported for Installation
Exchange 2003	Windows 2000 Server SP4 Windows Server 2003 (All SP levels and R2)
Exchange 2007 RTM	Windows Server 2003 SP1 + SP2 (inc R2)
Exchange 2007 SP1	Windows Server 2003 SP1 + SP2 (inc R2) Windows Server 2008 RTM

Table 1: Exchange/OS versions supported for install
The first thing to note is that Exchange 2007 RTM is not supported on Windows Server 2008. To install Exchange 2007 on Server 2008 you must run Exchange 2007 SP1. This service pack, as many of you may know, is a little different from previous service packs in that it is a complete installation of Exchange. Effectively SP1 is RTM with the SP1 code slipstreamed into it. Having established that Exchange 2007 SP1 is required to install on Server 2008, what other considerations are there?
Probably the biggest consideration is Active Directory. Table 2 sets out the different Domain Controller versions supported by different versions of Exchange.

Exchange Version	Domain Controller OS Supported
Exchange 2003	Windows 2000 Server SP4 Windows Server 2003 (All SP levels and R2) Windows Server 2008 RTM
Exchange 2007 RTM	Windows Server 2003 SP1 + SP2 (inc R2) Windows Server 2008 RTM
Exchange 2007 SP1	Windows Server 2003 SP1 + SP2 (inc R2) Windows Server 2008 RTM

Table 2: The Exchange/Domain Controller support matrix
One new Active Directory feature of Windows Server 2008 which I haven’t mentioned is Read Only Domain Controllers (RODC) (and Global Catalog servers). These are servers which do not hold a writable copy of the AD and also do not hold account passwords. They are most likely to be used in branch office scenarios to prevent security breaches either intentional or accidental. So how do these RODCs affect Exchange? Simply put, Exchange doesn’t use them! When left to automatically associate with a domain controller (or global catalog server) Exchange will ignore the RODC or ROGC. The important thing for administrators to remember is not to manually set Exchange to work with a RODC as things simply will not work correctly.
One other area that will be welcome to administrators is that with the release of Exchange 2007 SP1, the Exchange Management Console will finally be supported on Windows Vista, and for that matter on Server 2008 as well.
Before moving on to how we upgrade, I think it is worth clarifying that Exchange 2007 SP1 will not install on Windows Server 2008 Server Core. Server Core, for those who haven’t heard, is a cut down version of Windows Server 2008 which only presents a command line interface. It has been stripped down to run various server roles including amongst others Domain Controller, DHCP, DNS, File and Print. However, because a lot of functionality has been stripped out to ensure a small footprint and less need for patching, important components such as the .Net Framework are not present to support Exchange.
Note:As I mentioned we are currently working with beta code. It is because of this that the Unified Messaging role does not currently install on Server 2008. This will be rectified before release.

The upgrade path

So how do you actually get from Exchange 2007 running on Windows Server 2003 to Exchange 2007 SP1 running on Windows Server 2008?
Unfortunately, although understandably given the massive architecture changes involved, you cannot simply upgrade Exchange 2007 to Exchange 2007 SP1 and then upgrade the OS to Windows Server 2008. This simply breaks Exchange completely!
Even when you have a clustered mailbox server, you cannot perform a rolling upgrade by upgrading one node of the cluster failing over and then doing the other node.
The only way is to perform a migration! In other words you must do a clean install of Windows Server 2008 on a new server and then migrate your data. Mailboxes can be moved using the Move-Mailbox cmdlet and public folder data must be replicated.
This has caused a fair amount of discontent on various online forums but it is the only way!

Installation

Having looked at all the background, let’s get started with the installation. The first thing to cover is preparing your Windows Server 2008 machine for Exchange 2007. There are a bunch of prerequisites which must be met as listed below:

.Net Framework v2.0 or 3.0
PowerShell RTM
MMC 3.0 (installed by default)
IIS 7 (Various components needed by different roles)

For a much more detailed look at the requirements for each Exchange server role see Exchange 2007 System Requirements.
For now we are going to install an Exchange 2007 SP1 server in a new domain and new organisation. We will install the CAS, HT and Mailbox roles. In order to install the prerequisites we will run the following commands one after the other at a command prompt:
ServerManagerCmd -i RSAT-ADDS
ServerManagerCmd -i PowerShell
ServerManagerCmd -i Web-Server
ServerManagerCmd -i Web-ISAPI-Ext
ServerManagerCmd -i Web-Metabase
ServerManagerCmd -i Web-Lgcy-Mgmt-Console
ServerManagerCmd -i Web-Basic-Auth
ServerManagerCmd -i Web-Digest-Auth
ServerManagerCmd -i Web-Windows-Auth
ServerManagerCmd -i Web-Dyn-Compression
After the first command (RSAT-ADDS) you will need to reboot as shown in Figure 1.

Figure 1: Installing Active Directory Management Tools and being prompted to reboot
After the reboot, I used a simple batch file to run the other commands in sequence. Part of the output from the commands is shown in Figure 2.

Figure 2: Part of the output from the prerequisite installation
For more detailed information about the Windows Server 2008 roles/features required for the other Exchange 2007 roles (Edge Transport Server and Unified Messaging Server) see How to Install Exchange 2007 SP1 Prerequisites on Windows Server 2008.
Having successfully completed the installation of prerequisites, it is time to install Exchange. Start setup and click “Install Microsoft Exchange Server 2007 SP1” as shown in Figure 3.

Figure 3: Starting Setup of Exchange Server 2007 SP1
Next run through the usual setup steps as shown in Figures 4 – 11.

Figure 4: The SP1 Setup introduction screen

Figure 5: Accepting the license agreement

Figure 6: Opting into the Microsoft Error Reporting scheme

Figure 7: Selecting a typical install which installs CAS, HT, Mailbox roles and the management tools

Figure 8: Setting the new Exchange Organisation name

Figure 9: Opting not to create public folders for legacy clients

Figure 10: Exchange Readiness checks in progress

Figure 11: The not for production use warning before install about using a 32 bit version of Exchange 2007
Having completed the steps in Figures 3-11 installation begins. However, it is at this point that an error occurs as shown in Figure 12. It would appear that for whatever reason, the registry key “HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent” does not exist!

Figure 12: The registry key doesn’t exist error message
Note:It is highly unlikely that this problem will still exist once the products ship.
To rectify this problem locate the relevant area in the registry and create the required key as shown in Figure 13.

Figure 13: The newly created registry key
Having resolved the problem with the registry key you are left with no other option than to exit setup. On doing this you will be prompted to reboot, which you should do.
When the server is backed up, restart setup which will start in Exchange Maintenance Mode as shown in Figure 14.

Figure 14: Exchange setup restarting in Maintenance Mode
At this point, step through the remaining setup screens as shown in Figures 15-17.

Figure 15: Selecting the relevant roles for installation

Figure 16: Again making the choice not to create public folders for legacy clients

Figure 17: Setup completed!
Once setup completes you will have a working Exchange 2007 SP1 install on Windows Server 2008 as shown in Figure 18.

Figure 18: Exchange 2007 SP1 installed on Windows Server 2008
Before completing this article I thought it might be interesting to show the registry key that we created earlier. As can be seen in Figure 19, it is now populated with various values.

Figure 19: The values in the registry key created to solve the installation error

Summary

Creating a new Child Domain in Windows Server 2008 R2

There are times when you need to separate or delegate some parts of your Active Directory infrastructure, and the best way in those cases is to simply create a new child domain in the existing AD forest. This way you don’t have to create trusts between the two domains; trusts are created automatically and are created in a two-way direction, meaning domain A automatically trusts domain B, and vice versa. Now I don’t want to bore you with a lot of theory here, so I will get to work. In this lab I have a Domain Controller in site A, and a Windows Server 2008 R2 server in site B. Site A and B are connected trough VPN. The server in site B will hold the child domain “amsterdam.vkernel.local”.

Before we go to Amsterdam (I don’t know, I just like the name) we need to create and configure sites by opening Active Directory Sites and Services from Administrative Tools. Right-click the Sites folder and choose New Site.

In the Name box type the name of the new site, which is Amsterdam in this example, then select the DEFAULTIPSITELINK and click OK.

An information screen pops-up telling us that we need to add a subnet to the site we just created. Click OK, because this was my next step anyway.

Right-click the Subnets folder and choose New Subnet.

In the Prefix box type the subnet for the branch office then select a site object for this prefix. In this case the subnet for the branch office is 192.168.100.0/24 and the site object is Amsterdam.

Now let’s take care of the main office site too. Right-click the Default-First-Site-Name and choose Rename. Give it a name that represents the main office location, and in this case is Cluj-Napoca.

Go to the Subnets folder again, right-click the folder and choose New Subnet. In the Prefix box type the subnet for the main office, then select the site object.

Now your Active Directory Sites and Services should look like this.

On the branch office server configure the IP’s. Of course in the DNS box you need to put the IP address of the Domain Controller in the main office so we can find the domain.

I assume you have a proper VPN connection between the two locations, and both servers can communicate. Now we can start creating the child domain in the branch office. Do a Start > Run > dcpromo and click OK.

After the binaries are installed the Active Directory Domain Services Installation Wizard appears. Check the Use Advanced mode installation box and click Next.

In Windows Server 2008 and 2008 R2 a new security setting was implemented and older clients may be affected. This is what the Operating System Compatibility page is telling us, but is not our case since we have only 2008 R2 operating systems. Click Next to continue.

On the Deployment Configuration page choose Existing Forest > Create a new domain in an existing forest. Do NOT check the box Create a new domain tree instead of a new child domain, because we are not creating the child domain in a separate tree.

Type the domain name in the main office, then provide the proper credentials to connect to the domain. The user account must be a member of the Domain Admins group or the Enterprise Admins group.

In the fist box click the Browse button to select the parent domain. In the second box type the name of your child domain, and in this example is Amsterdam.

Leave the defaults here and click Next to continue.

If you have the intention of creating additional domain controllers in this domain (amsterdam.vkernel.local) with older operating systems (2000-2003), leave the domain functional level at 2000 or 2003. Since we have only Windows 2008 R2 we can set the domain functional level at Windows Server 2008 R2.

As you can see the site, the correct site was automatically selected based on the subnet we created earlier. If the wizard selected the wrong site, uncheck the box Use the site that corresponds to the IP address of this computer, and select the proper site from the list. Never had to do that; you will only have to do it if you do not configure Active Directory Sites and Services correctly.

Check the Global Catalog box here, so we have faster searches for objects in AD. More information about Global Catalog servers can be found here.

Select the replication partner in the other domain. If you have multiple Domain Controllers in the main office you should set only one of them to be the replication partner with the one in the branch office.

Here you can change the Active Directory database and logs location, if you don’t like the default one.

Type a password for the Active Directory Restore Mode then click Next.

Review your selections on the Summary screen, and if everything it’s OK click Next button to start creating the child domain.

If during the Active Directory Domain Services installation process you get the error The operation failed because: Active Directory Domain Services could not replicate the directory partition… “Could not find the domain controller for this domain”, join the server to the domain, reboot then resume the dcpromo operation.

After the domain controller reboots, login using the Administrator account. You will be asked to change the password, and you will need to provide a complex password to be able to continue.