Performance Exchange Properties

Question

Hi,

we have a problem when calling the Exchange properties. This takes a very long time. Can we speed up in any way? How then does the communication with the Exchange?

Thanks a lot and greets,

Dennis

Comments

Hello Dennis,

Adaxes communicates with Exchange Servers using Exchange management cmdlets and PowerShell remoting. To troubleshoot the issue with slow loading of Exchange properties, you can:

1. Enable tracing of commands sent to your Exchange Server. How to Trace Requests to Exchange Servers.
2. In the generated trace file, you will find the name of the Exchange Server that Adaxes communicates with.
3. Check whether communication between the computer where Adaxes is installed and the Exchange Server it communicates with is not hindered by any conditions. For example, Adaxes can communicate with an Exchange Server located in another AD site.

By the way, what version of Exchange are you using?

---

Hi,

thank´s for the quick reply. We´re using Exchange 2013 CU3.

Greets, Dennis

---

Hello Dennis,

Did you try enabling tracing of commands sent to Exchange Servers? Are the computer where Adaxes is installed and the Exchange Server it connects to located in the same AD site?

How to Trace Requests to Exchange Servers.

---

Hi,

Computers are in the same AD site. The Command "Get-ADPermission" takes about 40 seconds :roll: Mh.... sooo many entries (?)

Greets, Dennis

---

Dennis,

Can you send the trace file to our support e-mail (support[at]adaxes.com)?

---

Hi,

sure... Mail was send...

Greets, Dennis

;-)

---

Dennis,

The issue really seems to be in Get-ADPermission. It is the only cmdlet that takes so much time to execute.

The thing is that the Get-ADPermission cmdlet gets permissions for the mailbox. Each user that has certain permissions for the mailbox is stored in the form of a Security Identifier (SID). The Get-ADPermission cmdlet translates the SIDs into names of the users/groups that have the permissions. This can take some time in certain situations.

To troubleshoot the issue, can you do the following:

1. Logon to the Exchange Server that is mentioned in the trace file.

2. Launch Exchange Management Shell (EMS).

3. Execute the Get-ADPermission cmdlet exactly as it is shown in the trace file, piping the output to a CSV file. For example:

    Get-ADPermission -Identity "CN=User,CN=Users,DC=example,DC=com" -DomainController "server.example.com" | Export-CSV C:\Export.csv

   where C:\Export.csv is the full path to the CSV file that will be created.

4. Send the generated CSV file to us.

---

Hi,

ok... Mail was send...

Greets, Dennis

;-)

Answer 1

Hello Dennis,

The issue seems to be in the permissions assigned to the following SID: S-1-5-32-561. Out of the 704 permission entries for the mailbox, almost 670 define permissions for this SID. There seem to be excessive/duplicated permissions. The SID is a well-known SID of the built-in Windows Authorization Access Group.

To remedy the issue, we recommend you to optimize how permissions are assigned to the group and reduce the number of permission entries for it. Bear in mind, that the permissions are inherited by the mailbox from its parent container, and thus you need to adjust the permissions for the parent OUs/Containers.

By the way, how long did it take to execute the command in the EMS? Was it something close to 40 seconds as well?

Can you also do the following for further troubleshooting:

1. Logon to the Exchange Control Panel (ECP) of the Exchange Server that is mentioned in the trace file.
2. Open properties of the same mailbox in the ECP.
3. Switch to the Mailbox Delegation tab. How long does it take the ECP to load the mailbox delegation parameters?

Comments

Hi,

the SID: S-1-5-32-561 is the SID of the built-in Terminal Server License Servers Group and the SID: S-1-5-32-560 of the Windows Authorization Access Group.

Mhhh... why does have the Terminal Server License Servers Group to be queried? :shock:

In the EMS it takes too so long, we tought it is on iis. But sovile queries for this group? The Test User is only in the DomainUsers Group.

Greets, Dennis

;-)

---

Hello Dennis,

As we've already mentioned, the Get-ADPermission cmdlet gets permissions for the mailbox. Each user/group that has certain permissions for the mailbox is stored in the form of a Security Identifier (SID). The Get-ADPermission cmdlet translates the SIDs into names of the users/groups that have certain permissions over the mailbox. For this purpose, the cmdlet needs to poll Active Directory each time for each entry.

But sovile queries for this group? The Test User is only in the DomainUsers Group.

The group names are resolved not for the groups in which the member is a user, but for the groups that have certain permissions over the user.