Configure Exchange Server 2010

This article is for those looking for a detailed and clear guide on how to configure Exchange Server 2010.

NOTE

For details on configuring Exchange Server 2016, read my guide: Configure Exchange Server 2016.

WARNING

This guide walks you through configure Exchange Server 2010 without implementing fault tolerance. This way, all the core Exchange Server roles are installed on one server. The Unified Messaging and Edge Transport roles will not be used.

CAUTION

You must already have a domain name and paid for hosting, as well as the hosting DNS servers are already specified in the domain settings.

IMPORTANT

We will consider the case when you already have two servers with the Windows Server 2008 R2 operating system installed on them. In addition, one of the servers must have the Active Directory Domain Services role installed, and the second server must have Exchange Server 2010 with primary roles installed.

For details on installing Exchange Server 2010, read my guide: Install Exchange Server 2010.

To learn how to install Active Directory Domain Services on Windows Server 2008 R2, read: Install Active Directory Domain Services on Windows Server 2008 R2.

Go to the server with Exchange Server 2010 installed and launch the Exchange Management Console.

Let’s create a mailbox database.

In the “Organization Configuration” section, go to the “Mailbox” subsection and select the “Database Management” tab. Then on the right, we click on the “New Mailbox Database” button.

Next, you need to specify a name for the new database and select an Exchange server with the “Mailbox” role.

Specify a name for the database and click on the “Browse” button.

Select the Exchange server with the “Mailbox” role and click on the “OK” button.

After the free fields are filled in, click on the “Next” button.

Now you need to specify in which folder the mailbox database and its logs will be stored.

NOTE

You need to first create folders on the server in which you plan to store the database and its logs. In addition, it is better to store the database on a disk specially allocated for this task.

In the “Database file path” field, specify the folder in which the database will be stored.

In the “Log folder path” field, specify the folder in which the database logs will be stored.

Check the “Mount this database” box and click on the “Next” button.

Everything is ready to create a new mailbox database.

Click on the “New” button.

The creation of the mailbox database is now complete.

Click on the “Finish” button.

In the “Organization Configuration” section, go to the “Mailbox” subsection and select the “Database Management” tab.

Next, select the new database and click on the “Properties” button on the right.

Go to the “Limits” tab. In the “Storage Limits” section, you can configure the maximum allowed mailbox size, as well as the retention time for deleted mailboxes and letters.

Specify the required values and click on the “OK” button.

Now let’s set up the public folder database.

In the “Organization Configuration” section, go to the “Mailbox” subsection and select the “Database Management” tab.

Next, select the public folder database and click on the “Properties” button on the right.

On the General tab, specify the new name for the public folder database.

Go to the “Limits” tab. In the “Storage Limits” section, you can configure the maximum allowed size of shared folders, as well as the storage time for deleted messages.

Specify the required values and click on the “OK” button.

Now let’s move the public folder database and its logs to a separate folder.

NOTE

You need to first create folders on the server in which you plan to store the public folder database and its logs. In addition, it is better to store the database on a disk specially allocated for this task.

In the “Database file path” field, specify the folder in which the database will be stored.

In the “Log folder path” field, specify the folder in which the database logs will be stored.

Click on the “Move” button.

Next, Exchange Server will ask for confirmation to temporarily dismount the public folder database. Thus, the database will be temporarily unavailable to users.

Click on the “Yes to All” button.

The move of the public folder database and its logs is complete.

Click on the “Finish” button.

Now let’s add the trusted domain.

In the “Organization Configuration” section, go to the “Hub Transport” subsection and select the “Accepted Domains” tab. Then, on the right, click on the “New Accepted Domain” button.

Specify the domain and select “Authoritative Domain. E-mail is delivered to a recipient in this Exchange organization”.

Click on the “New” button.

The trusted domain has been added.

Click on the “Finish” button.

After the domain is added, it will appear on the “Accepted Domains” tab.

Now you need to create a policy for generating mailing addresses.

In the “Organization Configuration” section, go to the “Hub Transport” subsection and select the “E-mail Address Policies” tab, then click on the “New E-mail Address Policy” button on the right.

Next, you need to specify a name for the new policy and select to whom it will be applied.

Specify a name for the policy for generating mail addresses and click on the “Browse” button.

NOTE

In this guide, the policy for generating mail addresses will be applied to the entire domain.

Select a domain and click on the “OK” button.

After the free fields are filled in, select “All recipient types” and click on the “Next” button.

Then leave the settings unchanged and click on the “Next” button.

Now you need to determine how mailing addresses will be formed in your organization.

NOTE

In this tutorial, mailing addresses will be based on “Alias”.

Click on the “Add” button.

Select “Use alias”, then in the “Select the accepted domain for the e-mail address” section, click on the “Browse” button.

Select the main domain and click on the “OK” button.

The main domain is selected, press the “OK” button.

Now let’s add a second domain so that users can receive mail using the second domain name.

Click on the “Add” button.

Select “Use alias”, then in the “Select the accepted domain for the e-mail address” section, click on the “Browse” button.

Select the second domain and click on the “OK” button.

The second domain is selected, click on the “OK” button.

After you have determined how mail addresses will be generated in your organization, click on the “Next” button.

Next, you need to select when the policy will run.

Select “Immediately” and click on the “Next” button.

Everything is ready to create a policy for the formation of postal addresses.

Click on the “New” button.

The creation of a policy for generating postal addresses has been completed.

Click on the “Finish” button.

After the policy is added, it will appear on the “E-mail Address Policies” tab.

Now you need to create a Send connector to be able to send mail outside of your organization.

In the “Organization Configuration” section, go to the “Hub Transport” subsection and select the “Send Connectors” tab. Then on the right, we click on the “New Send Connector” button.

Specify a name for the new Send connector and in the “Select the intended use for this Send connector” section, select “Internet”.

Click on the “Next” button.

Next, you need to specify for which domains the new connector will work.

Click on the “Add” button.

Enter * in the “Address space” field. This way, the new Send Connector will handle all domains except yours.

Click on the “OK” button.

After you have specified for which domains the new connector will work, click on the “Next” button.

NOTE

In this example, mail will be sent according to MX records.

Select “Use domain name system (DNS)” MX “records to route mail automatically”.

Click on the “Next” button.

Next, you need to specify on which Exchange server the Send connector will be created.

Click on the “Next” button.

Everything is ready to create a send connector.

Click the “New” button.

The send connector is now complete.

Click on the “Finish” button.

Next, select the new send connector and click on the “Properties” button on the right.

On the “General” tab, in the “Specify the FQDN this connector will provide in response to HELO or EHLO” field, specify the name by which your mail server is accessible from the Internet.

In the “Maximum message size” field, you can configure the maximum size of mail attachments to be sent.

Click on the “OK” button.

Now let’s see the transport settings.

In the “Organization Configuration” section, go to the “Hub Transport” subsection and select the “Global Settings” tab.

Next, select “Transport Settings” and click on the “Properties” button on the right.

On the “General” tab, in the “Transport Limits” section, you can configure the maximum size of mail attachments for sending and receiving.

Specify the required values and click on the “OK” button.

Now you need to provide your Exchange Server 2010 license key.

In the “Server Configuration” section, select the Exchange server and click on the “Enter Product Key” button on the right.

Specify the Exchange Server 2010 license key and press the “Enter” button.

Exchange Server 2010 license key accepted.

Click on the “Finish” button.

Next, you need to open a web browser and go to the hosting control panel to which your domain name is linked. This tutorial uses “cPanel” as the hosting control panel.

Enter the login and password you received when purchasing hosting.

Next, you need to register A-records in the hosting control panel.

Go to the hosting control panel, to which your domain name is linked.

In the “Domains” section, select the “Advanced DNS Zones Editor” item.

Next, in the domain field, you must specify the domain for which the A-records will be configured.

In the “Add Record” section, specify the name, TTL, type, and IP address. Pay attention to the field “IP-address” you need to specify the IP by which your mail server is accessible from the Internet.

After the fields are filled in, click on the “Add record” button.

Add another A record.

In the “Add Record” section, specify the name, TTL, type, and IP address. Pay attention to the field “IP-address” you need to specify the IP by which your mail server is accessible from the Internet.

After the fields are filled in, click on the “Add record” button.

Add another A record.

In the “Add Record” section, specify the name, TTL, type, and IP address. Pay attention to the field “IP-address” you need to specify the IP by which your mail server is accessible from the Internet.

After the fields are filled in, click on the “Add record” button.

Next, you need to register MX records in the hosting control panel.

We return to the hosting control panel.

In the “Mail” section, select the “MX Record” item.

Next, in the domain field, you must specify the domain for which the MX records will be configured. Then in the item “Email Routing” you need to select “Remote Mail Exchanger” and click on the “Change” button.

Now delete all the old MX records in the MX Records section.

Select the entry and click on the “Delete” button.

Next, you need to make a request to your ISP to create a PTR record for your external IP address, where your mail server is accessible from the Internet. This is necessary in order for your IP address to resolve to a name.

NOTE

In this example, IP 188.244.46.91 is being converted to the name mail.vmkh.org.

Now you need to create an SPF (Sender Policy Framework) and write its value to the TXT record.

Thanks to SPF, you can check if the sender’s domain has been tampered with. SPF allows you to specify a list of servers capable of sending mail messages on behalf of your domain.

You can create an SPF using the “SPF Wizard”.

Return to the “Advanced DNS Zone Editor” section.

In the “Domains” section, select the “Advanced DNS Zones Editor” item.

Next, in the domain field, you must specify the domain for which the A-records will be configured.

Add TXT record.

In the “Add Record” section, specify the name, TTL, type, and TXT data.

NOTE

In the “TXT Data” field you need to specify the value of the SPF record that you received using the “Sender ID Framework SPF Record Wizard”.

SPF example: v=spf1 mx ptr:mail.vmkh.org mx:mx01.vmkh.org ip4:188.244.46.91 -all

Now you need to register an A-record on the internal DNS server.

Go to the domain controller, then click “Start” and select “Administrative Tools”, then “DNS”.

In the “Forward Lookup Zones” section, select the main domain and right-click on it, then select “New Host (A or AAAA)”.

Next, in the “Name (uses parent domain name if blank)” field, specify the name of the A-record, then in the “IP address” section, specify the IP address of the server on which Exchange Server 2010 is installed.

A record has been successfully added.

After the A record is added, it will appear in the list with the rest of the DNS records.

For further configuration, you need a certification authority.

NOTE

In this tutorial, the Active Directory Certificate Services role will be installed on a domain controller.

Launch “Server Manager” on the domain controller.

In the “Roles” section, click on the “Add Roles” button.

Click on the “Next” button.

Select the Active Directory Certificate Services role and click on the “Next” button.

Next, the Role Installation Wizard invites you to learn more about the Active Directory Certificate Services role.

Click on the “Next” button.

We select “Certification Authority Web Enrollment”.

In the next step, the Install Roles Wizard will warn you that several components need to be installed to install the Certification Authority Web Enrollment.

Click on the “Add Required Role Services” button. More about this source text

Next, select “Online Responder” and click on the “Next” button.

The server is a member of the domain, so select “Enterprise” and click on the “Next” button.

There are no other servers with the Active Directory Certificate Services role in the domain, so select “Root CA” and click on the “Next” button.

Next, you need to create a new private key.

Select “Create a new private key” and click on the “Next” button.

Next, you can select the encryption settings.

Leave the settings unchanged and click on the “Next” button.

Specify a name for the new certification authority and click on the “Next” button.

Now we select the validity period of the certificate and click on the “Next” button.

Next, you can specify where the certificate database and its logs will be stored.

Leave the settings unchanged and click on the “Next” button.

The Role Installation Wizard now prompts you to install the IIS components.

Click on the “Next” button.

Leave the settings unchanged and click on the “Next” button.

In order to start the installation of the selected role, click on the “Install” button.

The installation of the selected role and the components required for it has begun.

Installation of the Active Directory Certificate Services role is complete.

Click on the “Close” button.

Now you need to enable the SAN (Subject Alternative Name) function on the CA server. This function will be useful for you when publishing the “Autodiscover” service.

On the CA server, on the “Taskbar” select “Windows PowerShell” and after clicking the right mouse button select “Run as administrator”.

We execute the command:

1
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

Now let’s restart the certification authority.

We execute the command:

1
net stop certsvc

We execute the command:

1
net start certsvc

The certification authority has restarted successfully.

Now let’s make a request to create a new Exchange certificate.

We return to the server with Exchange Server 2010 installed.

In the Exchange Management Console, in the “Server Configuration” section, select the Exchange server and click on the “New Exchange Certificate” button on the right.

Specify a name for the new certificate and click on the “Next” button.

Then leave the settings unchanged and click on the “Next” button.

Now you need to specify the domain names that need to be included in the certificate for all types of access.

In the “Client Access server (Outlook Web App)” section, select “Outlook Web App is on the Intranet” and in the “Domain name you use to access Outlook Web App internally” field, specify the full name of the Exchange server. In the “Outlook Web App is on the Internet” field, specify the name by which your mail server is accessible from the Internet.

In the “Client Access server (Exchange ActiveSync)” section, select “Exchange Active Sync is enabled” and in the “Domain name, you use to access Exchange ActiveSync” field, specify the name by which your mail server is accessible from the Internet.

In the “Client Access server (Web Services, Outlook Anywhere, and Autodiscover)” section, select “Exchange Web Services is enabled” and “Outlook Anywhere is enabled”, then in the “External host name for your organization” field, specify the name by which your mail the server is accessible from the Internet.

Select “Autodiscover used on the Internet”, then select “Long URL” and in the “Autodiscover URL to use” field specify the name by which your mail server is accessible from the Internet for the “Autodiscover” service.

NOTE

In this manual, the name “autodiscover.vmkh.org” is used for the “Autodiscover” service.

Click on the “Next” button.

Now we select the main name by which your mail server is accessible from the Internet and click on the “Set as common name” button.

Click on the “Next” button.

Next, you need to specify the name of the organization, its geographic location, and specify the folder where the request for the Exchange certificate will be saved.

This guide deals with an organization located in Russia, in the city of Moscow.

Specify the necessary information and click on the “Browse” button.

Let’s save the request to the desktop.

Specify a name for the request and click on the “Save” button.

After the name of the organization, its geographic location, and folders where the certificate request will be saved, click on the “Next” button.

Everything is ready to create an Exchange certificate request.

Click on the “New” button.

The creation of a new Exchange certificate request is complete.

Click on the “Finish” button.

After the certificate request is generated, it appears on the Exchange Certificates tab.

Now you need to validate your Exchange certificate with a certification authority.

Follow the link http://vmkh-s-0000001.vmkh.org/certsrv, where vmkh-s-0000001.vmkh.org is the full name of my certification authority server. Accordingly, you need to provide the fully qualified name of your CA server.

We go under an account with administrator rights and click on the “OK” button.

Now let’s add the address of the certification server to the “Local intranet”.

In the “Tools” menu, select “Internet Options”.

Next, go to the “Security” tab.

Select “Local intranet” and click on the “Sites” button.

In the “Add this website to the zone” field, specify the address of the certification server and click on the “Add” button.

Click on the “Close” button.

The certification server address has been successfully added to the Local Intranet.

Click on the “OK” button.

Now select “Request a certificate”.

Next, select “Advanced certificate request”.

Now select “Submit a certificate request by using a base-64-encoded CMC or PKCS # 10 file, or submit a renewal request by using a base-64-encoded PKCS # 7 file”.

Next, open “Explorer” and go to the desktop where the Exchange certificate request was saved.

Click on the certificate request file twice with the left mouse button.

Select “Select a program from a list of installed programs” and click on the “OK” button.

Next, select “Notepad”, uncheck “Always use the selected program to open this kind of file” and click on the “OK” button.

Copy the contents of the request file.

Next, insert the contents of the request file into the “Saved Request” field, then in the “Certificate Template” section, select “Web Server” and click on the “Submit” button.

Select “DER encoded” and click “Download certificate”.

Click on the “Save” button.

Assign a name and save the Exchange certificate to the Downloads folder.

Click on the “Save” button.

Exchange certificate saved successfully.

Click on the “Close” button.

Now you need to download the certificate of the certification authority.

Follow the link http://vmkh-s-0000001.vmkh.org/certsrv, where vmkh-s-0000001.vmkh.org is the full name of my certification authority server. Accordingly, you need to provide the fully qualified name of your CA server.

Select “Download a CA certificate, certificate chain, or CRL”.

In the “Encoding method” section, select “DER” and click “Download CA certificate”.

Click on the “Save” button.

We assign a name and save the certificate of the certification authority in the “Downloads” folder.

Click on the “Save” button.

The certificate was successfully saved.

Click on the “Close” button.

To successfully validate your Exchange certificate request, you must import the CA certificate into the Trusted Root Certification Authorities on the Exchange server.

On the Exchange server, click on the “Start” button and specify “mmc” in the search bar and press the “Enter” button.

Now let’s add the Certificates snap-in.

Next, in the “File” menu, select “Add/Remove Snap-in”.

In the “Available snap-ins” section, select “Certificates” and click on the “Add” button.

Next, select “Computer account” and click on the “Next” button.

Select “Local computer” and click on the “Finish” button.

The snap-in has been added successfully.

Click on the “OK” button.

In the “Certificates (Local Computer)” section, select the “Trusted Root Certification Authorities” subsection, then right-click on the “Certificates” subsection and select “All Tasks”, then “Import”.

Click on the “Next” button.

Next, you need to specify the path to the certificate of the certification authority.

Click on the “Browse” button.

Select the certificate of the certification authority and click on the “Open” button.

After the path to the certificate of the certification authority is indicated, click on the “Next” button.

Then leave the settings unchanged and click on the “Next” button.

Everything is ready to import the certificate into the “Trusted Root Certification Authorities”.

Click on the “Finish” button.

The CA certificate has been successfully imported.

Click on the “OK” button.

We return to the Exchange Management Console.

In the “Server Configuration” section, select the Exchange server, then select the new Exchange certificate and click on the “Complete Pending Request” button on the right.

Next, you need to specify the path to the Exchange certificate.

Select the Exchange certificate and click on the “Open” button.

After the path to the Exchange certificate is specified, click on the “Complete” button.

Exchange certificate verified.

Click on the “Finish” button.

Now you need to assign a new Exchange certificate to IIS.

In the “Server Configuration” section, select the Exchange server, then select the new Exchange certificate and click on the “Assign Services to Certificate” button on the right.

Select the server for which the settings will be made and click on the “Next” button.

Put a checkmark on “Internet Information Server (IIS)” and click on the “Next” button.

You are now ready to assign the Exchange certificate to IIS.

Click on the “Assign” button.

Next, you need to confirm overwriting the existing certificate.

Click on the “Yes to All” button.

The Exchange certificate is assigned to the IIS service.

Click on the “Finish” button.

After the Exchange certificate is assigned to the IIS service, the list of services in the “Server Configuration” section of the certificate is updated.

Now let’s take a look at the Outlook Web App settings.

In the “Server Configuration” section, go to the “Client Access” subsection, select the Exchange server. Then on the right, we click on the “Properties” button.

Next, select “owa (Default Web Site)” and click on the “Properties” button on the right.

Now let’s configure user authorization by login without having to specify a domain.

On the “Authentication” tab in the “Use forms-based authentication” section, select “User name only”.

Next, you need to select the main domain, click on the “Browse” button.

Select the main domain and click on the “OK” button.

After the domain is specified, go to the “Public Computer File Access” tab.

Now we will restrict access to view documents if the user is logged in to Outlook Web App from a public computer.

On the “Public Computer File Access” tab, uncheck “Enable direct file access” and “Enable WebReady Document Viewing”.

Click on the “OK” button.

Next, a warning will appear about the need to restart IIS.

Click on the “OK” button.

Now let’s add the address where your mail server is accessible from the Internet into the configuration of the Exchange server with the “Client Access” role.

In the “Server Configuration” section, go to the “Client Access” subsection. Then, on the right, click on the “Configure External Client Access Domain” button.

Next, you need to specify the name by which your mail server is accessible from the Internet, then specify the Exchange server with the “Client Access” role.

In the “Enter the domain name you will use with your external Client Access servers” field, specify the name by which your mail server is accessible from the Internet, and in the “Select the Client Access servers to use with external URL” section, click on the “Add” button.

Specify the Exchange server with the “Client Access” role and click on the “OK” button.

Everything is ready to register the name by which your mail server is accessible from the Internet in the configuration of the Exchange server with the “Client Access” role.

Click on the “Configure” button.

The name by which your mail server is accessible from the Internet has been successfully added to the configuration of the Exchange server with the “Client Access” role.

Click on the “Finish” button.

Now let’s configure the Outlook Anywhere service. This service is used to connect to the Exchange server via the Internet using “Outlook”.

In the “Server Configuration” section, go to the “Client Access” subsection, select the Exchange server. Then on the right, we click on the “Enable Outlook Anywhere” button.

Next, in the “External host name” field, specify the name by which your mail server is accessible from the Internet. Then select “NTLM authentication” and click on the “Enable” button.

Outlook Anywhere is up and running in 15 minutes.

Click on the “Finish” button.

Now let’s restart IIS.

On the Exchange server, on the “Taskbar” select “Windows PowerShell” and after clicking the right mouse button click “Run as administrator”.

We execute the command:

1
iisreset /noforce

IIS restarted successfully.

Now let’s configure the ability to receive mail.

In the “Server Configuration” section, go to the “Hub Transport” subsection, select the Exchange server, then select the “Receive Connectors” tab.

Next, select “Default vmkh-s-0000002”, where vmkh-s-0000002 is the name of my Exchange server. Then on the right, we click on the “Properties” button.

On the “General” tab, in the “Maximum message size” field, you can configure the maximum size of mail attachments for receiving.

Go to the “Permission Groups” tab and check the “Anonymous users” box.

Click on the “OK” button.

Now let’s create a new user with a mailbox.

In the Exchange Management Console, in the “Recipient Configuration” section, click on the “New Mail User” button.

Select “New user” and click on the “Next” button.

Next, in the “Specify the organization unit rather using a default one” section, you need to select the container in which you plan to create the new user.

Click on the “Browse” button.

Select the container in which you want to place the new user.

Click on the “OK” button.

Now we indicate the first name, last name, login, and strong password for the new user.

The next step is to select the database in which the mailbox for the new user will be created.

Check the box “Specify the mailbox database rather than using a database automatically selected” and click on the “Browse” button.

Select the database in which you want to create a new mailbox and click on the “OK” button.

After the database is selected, click on the “Next” button.

Then leave the settings unchanged and click on the “Next” button.

Everything is ready to create a new user with a mailbox.

Click on the “New” button.

A user with a mailbox has been successfully created.

Click on the “Finish” button.

After the user with the mailbox is created, it will appear in the “Mailbox” section.

Now you need to import the Exchange certificate into Trusted Root Certification Authorities on all computers in the domain.

Go to the domain controller, create a folder and copy the Exchange certificate into it.

NOTE

In this tutorial, the certificate was copied to the “ExchangeCertificate” folder on the “C” drive.

Next, click “Start” and select “Administrative Tools”, then “Group Policy Management”.

We create a new group policy to import the certificate into the “Trusted Root Certification Authorities” on all computers in the domain.

Right-click on the domain name and select “Create a GPO in this domain, and Link it here”.

Specify a name for the new group policy and click on the “OK” button.

Next, click on the new policy with the right mouse button and select “Edit”.

In the Group Policy Editor, go to the “Computer Configuration” section, then to the “Windows Settings” subsection, then find the “Security Settings” section and select “Public Key Policies”, now right-click on “Trusted Root Certification Authorities” and select ” Import ”.

Click on the “Next” button.

Next, you need to specify the path to the Exchange certificate.

Click the “Browse” button.

Go to the folder with the Exchange certificate and click on the “Open” button.

After the path to the certificate is specified, click on the “Next” button.

Then leave the settings unchanged and click on the “Next” button.

Everything is ready to import the certificate into the “Trusted Root Certification Authorities” for all computers in the domain.

Click on the “Finish” button.

The Exchange certificate has been successfully imported into Group Policy settings.

Click on the “OK” button.

After the certificate is imported into Group Policy settings, it will appear in the “Trusted Root Certification Authorities” section.

Now the Exchange certificate will be imported to all computers that fall under this policy.

Now you need to restart your mail server.

We return to the server with Exchange Server 2010 installed.

Click “Start” and select “Restart”.

Exchange Server 2010 configuration is complete.