This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
public:microsoft_exchange_mail_level [2018/05/04 13:35] yuk.cheng |
public:microsoft_exchange_mail_level [2019/08/20 15:13] ronnie.chan [Backup Process Overview] |
||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== Microsoft Exchange Mail Level Backup Set ====== | ||
+ | AhsayOBM allows you to back up individual mailboxes in your Microsoft Exchange Server with the MS Exchange Mail Level Backup Module. This module provides a set of tools to protect your mailboxes and public folders on Microsoft Exchange Server 2007/2010/2013. This includes backup and recovery of individual emails, contacts, calendars and other mail items in your mailboxes and public folders, with snapshots / versioning, and retention policy to protect even email that you may have accidentally deleted from your Exchange 2007/2010/2013 mailboxes or public folders. | ||
+ | |||
+ | AhsayOBM supports backup of mailboxes on both MS Exchange Server for deployed in standalone and Database Availability Group (DAG). | ||
+ | |||
+ | An MS Exchange mail level backup must be utilized in conjunction with full Information Store backup (Exchange Database backup set), as mail level backup for Microsoft Exchange Server is not designed to fully protect an Exchange Server, but to facilitate easy and fast recovery of emails, contacts, calendars for individual mailboxes and public folder items. | ||
+ | |||
+ | {{public:ahsay_wiki_exchange_mail_level_backup_set.png?640}} | ||
+ | |||
+ | ===== System Architecture ===== | ||
+ | Below is the system architecture diagram illustrating the major elements involved in the backup process among the Microsoft Exchange Server, AhsayOBM backup client, AhsayCBS backup server, and Cloud storage. | ||
+ | |||
+ | {{public:ahsay_wiki_module_exchange_2007_mail_01.png?640}} | ||
+ | |||
+ | ---- | ||
+ | |||
+ | ===== Requirements ===== | ||
+ | You are strongly recommended to check all the settings below before you proceed with the MS Exchange Mail Level 2007/2010/2013 backup and restore. | ||
+ | |||
+ | ==== Software Requirement ==== | ||
+ | For the list of compatible operating systems and application versions, refer to: [[public:8001_faq:ahsay_software_compatibility_list_scl_for_version_8.1_or_above|Ahsay Software Compatibility List (SCL)]] | ||
+ | |||
+ | ==== Antivirus Exclusion Requirement ==== | ||
+ | To optimize performance of AhsayOBM on Windows, and to avoid conflict with your antivirus software, refer to this [[public:8014_faq:suggestion_on_antivirus_exclusions|list of processes and directory paths that should be added to all antivirus software white-list / exclusion list]] | ||
+ | |||
+ | <WRAP indent><code> | ||
+ | NOTE | ||
+ | For AhsayOBM version 8.1 or above, the bJW.exe process is automatically added to Windows Defender exclusion list for Windows 10 and 2016, during installation / upgrade via installer or upgrade via AUA. | ||
+ | </code> | ||
+ | </WRAP> | ||
+ | |||
+ | ==== AhsayOBM Installation ==== | ||
+ | The latest version of AhsayOBM must be installed on the MS Exchange Server hosting the mailbox database. | ||
+ | |||
+ | For backup of mailboxes on MS Exchange Server 2010/2013 Database Availability Group (DAG), ensure the same AhsayOBM version is installed on all member servers. | ||
+ | |||
+ | For MS Exchange Server 2010/2013, Database Availability Group (DAG) backup option is available. | ||
+ | |||
+ | ==== AhsayOBM Licenses ==== | ||
+ | AhsayOBM licenses are calculated on a per device basis. | ||
+ | * For backup of mailboxes on a standalone Microsoft Exchange 2007/2010/2013 Server, one AhsayOBM license is required. | ||
+ | * For backup of mailboxes on a Microsoft Exchange Server 2010/2013 DAG setup, the number of AhsayOBM licenses required is equal to the number of members (nodes) in the DAG. For example, if there are three members then three AhsayOBM licenses are required. | ||
+ | |||
+ | ==== Backup Quota Requirement ==== | ||
+ | Make sure that your AhsayOBM user account has sufficient storage quota assigned to accommodate the storage of additional Exchange mailbox and public folder items for the new mail level backup set. | ||
+ | |||
+ | ==== Microsoft Exchange Mailbox Add-On Module ==== | ||
+ | One Microsoft Exchange Mailbox license is required for the backup of each user mailbox. | ||
+ | |||
+ | Make sure the Microsoft Exchange Mailbox feature has been enabled as an add-on module in your AhsayOBM user account and there is sufficient Microsoft Exchange Mailbox license quota to cover the backup of your mailboxes. | ||
+ | |||
+ | {{public:ahsay_wiki_module_exchange_2007_mail_02.png?640}} | ||
+ | |||
+ | ==== Scheduled Backup for Exchange Server in Data Availability Group (DAG) Option ==== | ||
+ | Scheduled backup is required if you choose to backup MS Exchange server 2010/2013 setup in DAG option, as AhsayOBM on all DAG members will use the scheduled backup time to start backups on all individual DAG members at the same time. | ||
+ | |||
+ | An MS Exchange server 2010/2013 DAG backup cycle is considered complete only when scheduled backup on all DAG members have been run successfully. A backup report will be generated and emailed to the recipients when a complete MS Exchange server 2010/2013 DAG backup cycle has taken place. | ||
+ | |||
+ | Please keep in mind that manual backup will only be considered as individual mail level backup, and therefore will not be counted as part of the DAG backup cycle. | ||
+ | |||
+ | ==== Temporary Directory Folder ==== | ||
+ | The Temporary Directory folder is used by AhsayOBM for storing backup set index files and any incremental or differential delta files generated during a backup job. To ensure optimal backup/restoration performance, the temporary directory folder is located on a local drive with plenty of free disk space. | ||
+ | |||
+ | ==== Backup Source ==== | ||
+ | Ensure “Hide from Exchange address list” is unchecked for user mailboxes, otherwise the mailbox will not be visible in the AhsayOBM backup source and therefore cannot be selected for backup. | ||
+ | |||
+ | {{public:ahsay_wiki_module_exchange_2007_mail_03.png?640}} | ||
+ | |||
+ | ==== Mailbox Access Permission ==== | ||
+ | The Active Directory account used to authenticate the backup must have full access to the mailboxes. To grant full access right for the account, enter the following command in Exchange Management Shell. | ||
+ | |||
+ | Open the Exchange Management Shell by clicking Start > Microsoft Exchange Server > Exchange Management Shell. | ||
+ | |||
+ | <WRAP indent> | ||
+ | === Exchange Server 2007 === | ||
+ | Enter the following command in Exchange Management Shell | ||
+ | <code> | ||
+ | Get-MailboxServer | Add-ADPermission -User "%os_username%" - | ||
+ | AccessRights GenericAll -ExtendedRights ms-exch-store-admin,receive-as,send-as -InheritanceType All | ||
+ | </code> | ||
+ | where %os_username% is the username of the operating system account for backup. | ||
+ | |||
+ | Example: granting permission to local account "system" | ||
+ | <code> | ||
+ | Get-MailboxServer | Add-ADPermission -User "system" - | ||
+ | AccessRights GenericAll -ExtendedRights ms-exch-store-admin,receive-as,send-as -InheritanceType All | ||
+ | </code> | ||
+ | |||
+ | Other useful commands: | ||
+ | <WRAP indent> | ||
+ | 1. To show added permission for an AD account | ||
+ | <code> | ||
+ | Get-MailboxServer | Get-ADPermission -User "%os_username%" | ||
+ | </code> | ||
+ | Example, to show added permission for local account "system" | ||
+ | <code> | ||
+ | Get-MailboxServer | Get-ADPermission -User "system" | ||
+ | </code> | ||
+ | |||
+ | 2. To remove permission from an AD account | ||
+ | <code> | ||
+ | Get-MailboxServer | Remove-ADPermission -User "%os_username%" - AccessRights GenericAll -ExtendedRights ms-exch-store-admin,receive-as,send-as -InheritanceType All | ||
+ | </code> | ||
+ | |||
+ | Example, to remove permission from local account "system" | ||
+ | <code> | ||
+ | Get-MailboxServer | Remove-ADPermission -User "system" - AccessRights GenericAll -ExtendedRights ms-exch-store-admin,receive-as,send-as -InheritanceType All | ||
+ | </code> | ||
+ | </WRAP> | ||
+ | Reboot the Exchange Server after executing the command. | ||
+ | |||
+ | === Exchange Server 2010 / 2013 === | ||
+ | Enter the following command in Exchange Management Shell | ||
+ | <code> | ||
+ | Get-Mailbox | Add-MailboxPermission -User "%os_username%" -AccessRights FullAccess | ||
+ | </code> | ||
+ | |||
+ | Example: granting permission to local account "system" | ||
+ | <code> | ||
+ | Get-Mailbox | Add-MailboxPermission -User "system" -AccessRights FullAccess | ||
+ | </code> | ||
+ | |||
+ | Other useful commands: | ||
+ | <WRAP indent> | ||
+ | 1. Remove permission from an AD account | ||
+ | <code> | ||
+ | Get-Mailbox | Remove-MailboxPermission -User "%os_username%" -AccessRights FullAccess | ||
+ | </code> | ||
+ | |||
+ | Example: | ||
+ | <code> | ||
+ | Get-Mailbox | Remove-MailboxPermission -User "system" -AccessRights FullAccess | ||
+ | </code> | ||
+ | |||
+ | 2. To view the mailbox permission of a user | ||
+ | <code> | ||
+ | Get-Mailbox | Get-MailboxPermission -User "%os_username%" | ||
+ | </code> | ||
+ | |||
+ | Example: | ||
+ | <code> | ||
+ | Get-Mailbox | Get-MailboxPermission -User "system" | ||
+ | </code> | ||
+ | </WRAP> | ||
+ | Reboot the Exchange Server after executing the command. | ||
+ | </WRAP> | ||
+ | |||
+ | ==== Windows User Account Permission ==== | ||
+ | The Active Directory account used to authenticate the backup must be a member of the following security groups. | ||
+ | |||
+ | <WRAP indent> | ||
+ | === Exchange Server 2007 === | ||
+ | * Microsoft Exchange Security \ Exchange Organization Administrators | ||
+ | * Microsoft Exchange Security \ Exchange Servers | ||
+ | * Users \ Domain Admins \\ {{public:ahsay_wiki_module_exchange_2007_mail_04.png?640}} | ||
+ | |||
+ | === Exchange Server 2010 / 2013 === | ||
+ | * Microsoft Exchange Security \ Organization Management | ||
+ | * Users \ Administrator | ||
+ | * Users \ Domain Admins | ||
+ | * Users \ Enterprise Admins \\ {{public:ahsay_wiki_module_exchange_2007_mail_05.png?640}} | ||
+ | |||
+ | === Steps to check the current settings === | ||
+ | - Click Start > Control Panel > Administrative Tools, and then click Active Directory Users and Computers. | ||
+ | - Browse to the organization unit containing the corresponding operating system account. | ||
+ | - Right click on the user, and select Properties. | ||
+ | - Select the Member Of tab to check on the membership setting. | ||
+ | </WRAP> | ||
+ | |||
+ | ==== Enabling Mailbox on Windows User Account ==== | ||
+ | Make sure the Windows account used to authenticate the backup has a mailbox enabled. Follow the steps below to verify. | ||
+ | <WRAP indent> | ||
+ | === Exchange Server 2007 / 2010 === | ||
+ | - Click Start > Microsoft Exchange Server 2007/2010, and then click Exchange Management Console. | ||
+ | - Click to expand the Recipient Configuration menu tree, and then select Mailbox. | ||
+ | - Right click on the user and select Properties. | ||
+ | - Select the General tab to check the settings. Make sure the Hide from Exchange address lists box is not checked. \\ {{public:ahsay_wiki_module_exchange_2007_mail_06.png?640}} \\ **Note:** A mailbox-enabled user is a Windows Active Directory user that has one or more Exchange Server mailboxes associated with it. | ||
+ | |||
+ | === Exchange Server 2013 === | ||
+ | Refer to the following article from Microsoft for more details on how to check if an account is mailbox enabled. | ||
+ | [[https://docs.microsoft.com/en-us/exchange/create-user-mailboxes-exchange-2013-help]] | ||
+ | </WRAP> | ||
+ | |||
+ | ==== Remote Exchange Management Shell ==== | ||
+ | For setup on MS Exchange Server 2010 / 2013, the Remote Exchange Management Shell must be enabled for the operating system account used for the backup. | ||
+ | |||
+ | Enter the following command in Exchange Management Shell to enable this feature. | ||
+ | <code> | ||
+ | >Set-User "%os_username%" -RemotePowerShellEnabled $True | ||
+ | </code> | ||
+ | |||
+ | Reboot the Exchange Server after executing the command. | ||
+ | |||
+ | <WRAP prewrap> | ||
+ | <code> | ||
+ | NOTE | ||
+ | Remote Shell in Microsoft Exchange Server enables you to manage your server running Exchange. | ||
+ | </code> | ||
+ | </WRAP> | ||
+ | |||
+ | ==== Collaboration Data Objects (CDO) 1.2.1 ==== | ||
+ | The latest version of CDO must be installed on the Exchange Server for the mail level backup job to work properly. | ||
+ | |||
+ | Download and install the latest version CDO via the URL below. If you already have CDO installed on the Exchange Server but are not sure if it is the latest version, you are recommended to uninstall the current version and re-install via the URL below. | ||
+ | <WRAP indent> | ||
+ | === Exchange Server 2007 / 2010 === | ||
+ | Exchange Server with MS Outlook 2007 | ||
+ | [[https://www.microsoft.com/en-us/download/details.aspx?id=3671]] | ||
+ | |||
+ | Exchange Server without MS Outlook 2007 | ||
+ | [[https://www.microsoft.com/en-gb/download/details.aspx?id=42040]] | ||
+ | |||
+ | === Exchange Server 2013 === | ||
+ | [[https://www.microsoft.com/en-gb/download/details.aspx?id=42040]] | ||
+ | </WRAP> | ||
+ | |||
+ | ==== LAN Manager Authentication Level ==== | ||
+ | <WRAP indent> | ||
+ | === Exchange Server 2013 === | ||
+ | The LAN Manager Authentication level configured on the Exchange Server must be level 3 or above. Follow the steps below to check the settings. | ||
+ | - Click Start > Control Panel > Administrative Tools, and then click Local Security Policy. \\ {{public:ahsay_wiki_module_exchange_2007_mail_07.png?640}} | ||
+ | - Under Security Settings, expand Local Policies > Security Options, then click Network security: LAN Manager authentication level. | ||
+ | - Make sure that the setting is configured to use NTLMv2, for example: | ||
+ | - Send NTLMv2 response only | ||
+ | - Send NTLMv2 response only. Refuse LM | ||
+ | - Send NTLMv2 response only. Refuse LM & NTLM \\ {{public:ahsay_wiki_module_exchange_2007_mail_08.png?640}} | ||
+ | </WRAP> | ||
+ | |||
+ | ==== Windows PowerShell 2.0 Engine ==== | ||
+ | Make sure the Windows PowerShell 2.0 Engine is installed. | ||
+ | <WRAP indent> | ||
+ | === Exchange Server 2013 === | ||
+ | To install the feature: | ||
+ | - Navigate to Server Manager > Manage, then select Add Roles and Features. | ||
+ | - On the Select installation type screen, select Role-based or feature-based installation. | ||
+ | - Select the target server. | ||
+ | - On the Select features screen, go to the Features option, check the box next to Windows PowerShell 2.0 Engine. \\ {{public:ahsay_wiki_module_exchange_2007_mail_09.png?640}} | ||
+ | </WRAP> | ||
+ | |||
+ | ==== MS Exchange related Windows Services ==== | ||
+ | Ensure that all MS Exchange related services have been started, particularly the MS Exchange Information Store Services. | ||
+ | |||
+ | To verify this setting, launch the Services menu by clicking Start then typing “Services” in the search box. All Exchange related services should be started by default, in case if it is not, turn it on by right clicking the item and then select Start. | ||
+ | |||
+ | {{public:ahsay_wiki_module_exchange_2007_mail_10.png?640}} | ||
+ | |||
+ | ==== MS Exchange Database Status ==== | ||
+ | Ensure the MS Exchange Mailbox and Public Folder databases are mounted. | ||
+ | |||
+ | Example: MS Exchange 2010 \\ {{public:ahsay_wiki_module_exchange_2007_mail_11.png?640}} | ||
+ | |||
+ | Example: MS Exchange 2013 \\ {{public:ahsay_wiki_module_exchange_2007_mail_12.png?640}} | ||
+ | |||
+ | ==== IISAuthenticationMethods Setting ==== | ||
+ | Verify if the IISAuthenticationMethods is set to Basic only. If so, change the setting with the commands below. | ||
+ | <WRAP indent> | ||
+ | === Exchange Server 2013 === | ||
+ | |||
+ | - Click Start > Microsoft Exchange Server > Exchange Management Shell. | ||
+ | - Enter the following command to check on the IISAuthenticationMethods setting: <code>>Get-OutlookAnywhere</code> | ||
+ | - If it is set to {Basic} only, enter the following command to modify the setting:<code>>Set-OutlookAnywhere -Identity:"%Server%\Rpc (Default Web Site)" -IISAuthenticationMethods Basic,NTLM,Negotiate</code> | ||
+ | - Reboot the Exchange server. | ||
+ | </WRAP> | ||
+ | |||
+ | ==== Connection to Exchange Management Shell (EMS) or Exchange Management Console (EMC) ==== | ||
+ | Confirm on the connection to the Exchange Management Shell (EMS) or Exchange Management Console (EMC). | ||
+ | |||
+ | Ensure that the HTTP binding on the Default Web Site in Internet Information Services (IIS) is correctly configured by following the steps below. | ||
+ | |||
+ | - Click Start > Control Panel > Administrative Tools, and then click Internet Information Services (IIS) Manager. | ||
+ | - Navigate to Default Web Site, then right-click and select Edit Bindings. \\ {{public:ahsay_wiki_module_exchange_2007_mail_13.png?640}} | ||
+ | - Create a new binding that has no host name and a value of All Unassigned for the IP address. \\ {{public:ahsay_wiki_module_exchange_2007_mail_14.png?640}} | ||
+ | - Restart IIS. | ||
+ | |||
+ | ==== Net Framework 3.5 Features ==== | ||
+ | If you are using Exchange server 2013 on Windows server 2012, please install .Net Framework 3.5 Features. | ||
+ | |||
+ | This feature can be enabled by accessing Server Manager > Dashboard > Add Roles and Features Wizard > Feature Page. | ||
+ | |||
+ | {{public:ahsay_wiki_module_exchange_2007_mail_15.png?640}} | ||
+ | |||
+ | ---- | ||
+ | |||
+ | ===== Backup Process Overview ===== | ||
+ | The following steps are performed during an MS Exchange mail level backup job: | ||
+ | |||
+ | {{public:ahsay_wiki_module_exchange_2007_mail_16.png?800}} | ||
+ | |||
+ | ===== Documentation ===== | ||
+ | |||
+ | * [[https://www.ahsay.com/download/download_document_v8_obm-user-guide-exchange-mail.jsp|Microsoft Exchange Server 2007/2010/2013 Mail Level Backup and Restore Guide]] | ||
+ | |||
+ | ===== FAQs ===== | ||
+ | |||
+ | * [[public:5010_faq:how_to_create_a_ms_exchange_mail_level_backup_set_with_ahsayobm_ms_exchange_2007_2010|How to create a MS Exchange mail level backup set with AhsayOBM (MS Exchange 2007 / 2010)?]] | ||
+ | * [[public:5011_faq:how_to_create_a_ms_exchange_mail_level_backup_set_with_ahsayobm_ms_exchange_2013|How to create a MS Exchange mail level backup set with AhsayOBM (MS Exchange 2013)?]] | ||
+ | |||
+ | ===== Issues ===== | ||
+ | |||
+ | * [[public:5117_duplicate_db_displayed_under_empty_dag_group|Duplicate databases are displayed under empty DAG group when creating a MS Exchange mail level backup set (MS Exchange mail level backup)]] | ||
+ | * [[public:5068_incorrect_error_displayed_for_ms_exchange_mail_level_backup|Incorrect error message 'Another backup job is still running' is displayed (MS Exchange mail level backup)]] | ||
+ | * [[public:5082_issue:ms_exchange_mail_level_backup_job_cannot_run_to_completion_for_backup_set_with_backup_schedule_disabled|MS Exchange mail level backup job cannot run to completion (for backup set with backup schedule disabled)]] |