King:

Setup /PrepareAD /OrganizationName:1ask2corp

FW and EX2:

setup /m:install /roles:CAS,MT,HT

Queen:

setup /m:install /roles:mb,MT /mdbname:vanarts

Configuring the Receiving Connector to receive Internet Traffic

Set-ReceiveConnector "EX2\Default EX2" -Bindings "0.0.0.0:25"
Set-ReceiveConnector "FW\Default FW" -Bindings "0.0.0.0:25"

Set-ReceiveConnector "EX2\Client EX2" -Bindings "0.0.0.0:587"
Set-ReceiveConnector "FW\Client FW" -Bindings "0.0.0.0:587"

Set-ReceiveConnector -Identity "EX2\Default EX2" -PermissionGroups ExchangeUsers, ExchangeServers, ExchangeLegacyServers,anonymousUsers
Set-ReceiveConnector -Identity "FW\Default FW" -PermissionGroups ExchangeUsers, ExchangeServers, ExchangeLegacyServers,anonymousUsers

Configuring Send Connector to Internet

New-SendConnector -Name "ToInternet1" -Usage 'Internet' -AddressSpaces 'SMTP:*;1' -DNSRoutingEnabled $false -SmartHosts 'Shawmail.vc.shawcable.net' -SmartHostAuthMechanism 'None' -SourceTransportServers FW,EX2

New-SendConnector -Name "ToInternet2" -Usage 'Internet' -AddressSpaces 'SMTP:*;1' -DNSRoutingEnabled $false -SmartHosts 'mail.vanarts.com' -SmartHostAuthMechanism 'None' -SourceTransportServers FW,EX2

DNS

Dnscmd King.1ask2.com /recordadd 1ask2.com Exserver A 191.121.3.3
Dnscmd King.1ask2.com /recordadd 1ask2.com mail A 191.121.3.3
Dnscmd King.1ask2.com /recordadd 1ask2.com . A 191.121.3.3
Dnscmd King.1ask2.com /recordadd 1ask2.com autodiscover A 191.121.3.3

NLB configuration

Mail.1ask2.com is for Internet use and External DNS will set it to a public IP address.
EXServer.1ask2.com is for internal use.

EMS

Import-Module servermanager
Add-WindowsFeature nlb

NLB

Certificate with multiple domains

Certificate

It's better use the EMC to enable,export, and import certificate.

Enable-ExchangeCertificate -Server 'EX2' -Services 'IIS, SMTP' -Thumbprint '7EEBE61B5CCC4D31326267981483F064D3911626'

$file=Export-ExchangeCertificate -Server 'EX2' -Thumbprint '7EEBE61B5CCC4D31326267981483F064D391162
$password -BinaryEncoded
set-content -Path "c:\multipleDomainCert.pfx" -Value $file.FileData -Encoding Byte

Enable-ExchangeCertificate -Server 'FW' -Services 'IIS, SMTP' -Thumbprint '7EEBE61B5CCC4D31326267981483F064D3911626'

Client Access Array

New-ClientAccessArray -Name EXServer -Fqdn Exserver.1ask2.com -Site Default-First-Site-Name

Set-MailboxDatabase -Identity vanarts -RpcClientAccessServer Exserver.1ask2.com

Outlook Anywhere

Enable-OutlookAnywhere –server EX2 –ExternalHostName 'mail.1ask2.com' –DefaultAuthenticationMethod 'ntlm' -SSLOffloading:$false
Enable-OutlookAnywhere –server FW  –ExternalHostName 'mail.1ask2.com' –DefaultAuthenticationMethod 'ntlm' -SSLOffloading:$false

cd $Exscripts
Get-MailboxServer Queen | .\new-TestCasConnectivityUser.ps1

Test-OutlookConnectivity -RpcProxyTestType:Internal -RpcTestType:Server

Make sure that Windows Firewall is turned off.

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -InternalUrl https://exserver.1ask2.com/owa -ExternalURL https://mail.1ask2.com/owa
Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -InternalUrl https://exserver.1ask2.com/ecp -ExternalURL https://mail.1ask2.com/ecp
Get-WebServicesVirtualDirectory | Set-WebServicesVirtualDirectory -InternalUrl https://exserver.1ask2.com/EWS/Exchange.asmx -ExternalURL:https://mail.1ask2.com/EWS/EXchange.asmx
Get-oabvirtualDirectory | Set-OabVirtualDirectory -InternalUrl "https://exserver.1ask2.com/oab" -ExternalURL https://mail.1ask2.com/oab
Get-ClientAccessServer | Set-ClientAccessServer -AutoDiscoverServiceInternalUri https://exserver.1ask2.com/autodiscover/autodiscover.xml

test-outlookconnectivity -protocol:tcp

test-outlookconnectivity -protocol:tcp -verbose

VERBOSE: [13:23:47.800 GMT] Test-OutlookConnectivity : When contacting
https://exserver.1ask2.com/autodiscover/autodiscover.xml received the error The underlying connection was closed: Could
not establish trust relationship for the SSL/TLS secure channel.
VERBOSE: [13:23:47.801 GMT] Test-OutlookConnectivity : When contacting
https://exserver.1ask2.com/autodiscover/autodiscover.xml received the error The remote certificate is invalid according
to the validation procedure.

The Alternative Subject name of the Exchange Certificate does not include Exserver.1ask2.com.

Certificate Subject Name: CN=*.1ask2.com
Certificate Alternative Name:
Exserver.1ask2.com
Mail.1ask2.com
Autodiscover.1ask2.com
1ask2.com
FW.1ask2.com
Ex2.1ask2.com

Make Private Key exportable.

Offline Address Book

Set-MailboxDatabase -Identity Vanarts -OfflineAddressBook '\Default Offline Address Book'

Get-OfflineAddressBook | Set-OfflineAddressBook -VirtualDirectories 'EX2\OAB (Default Web Site)','Fw\OAB (Default Web Site)'

Update-OfflineAddressBook -Identity "\Default Offline Address Book"

Update-FileDistributionService -Identity "FW" -Type OAB
Update-FileDistributionService -Identity "EX2" -Type OAB

Test-OutlookWebServices -id "Administrator@1ask2.com"

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1019
Type : Information
Message : A valid Autodiscover service connection point was found. The Autodiscover URL on this object is https://ex
server.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1006
Type : Information
Message : Contacted the Autodiscover service at https://exserver.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1016
Type : Information
Message : [EXCH] The AS is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1015
Type : Warning
Message : [EXCH] The OAB is not configured for this user in the AutoDiscover response received from https://exserver.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1014
Type : Information
Message : [EXCH] The UM is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1016
Type : Information
Message : [EXPR] The AS is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1015
Type : Warning
Message : [EXPR] The OAB is not configured for this user in the AutoDiscover response received from https://exserver.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1014
Type : Information
Message : [EXPR] The UM is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1022
Type : Success
Message : Autodiscover was tested successfully.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1021
Type : Information
Message : The following web services generated errors: Oab in EXCHOab in EXPR. Use the previous output to diagnose and correct the errors.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1106
Type : Information
Message : Contacted the Autodiscover service at https://EX2.1ask2.com:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1116
Type : Information
Message : [EXCH] The AS is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1115
Type : Warning
Message : [EXCH] The OAB is not configured for this user in the AutoDiscover response received from https://EX2.1ask2.com:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1114
Type : Information
Message : [EXCH] The UM is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1116
Type : Information
Message : [EXPR] The AS is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1115
Type : Warning
Message : [EXPR] The OAB is not configured for this user in the AutoDiscover response received from https://EX2.1ask2.com:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1114
Type : Information
Message : [EXPR] The UM is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1122
Type : Success
Message : Autodiscover was tested successfully.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1121
Type : Information
Message : The following web services generated errors: Oab in EXCHOab in EXPR. Use the previous output to diagnose and correct the errors.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1024
Type : Success
Message : [EXCH] Successfully contacted the AS service at https://exserver.1ask2.com/EWS/Exchange.asmx. The elapsed
time was 67 milliseconds.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1026
Type : Success
Message : [EXCH] Successfully contacted the UM service at https://exserver.1ask2.com/EWS/Exchange.asmx. The elapsed
time was 17 milliseconds.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1024
Type : Success
Message : [EXPR] Successfully contacted the AS service at https://mail.1ask2.com/EWS/EXchange.asmx. The elapsed time
was 60 milliseconds.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1026
Type : Success
Message : [EXPR] Successfully contacted the UM service at https://mail.1ask2.com/EWS/EXchange.asmx. The elapsed time
was 27 milliseconds.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1124
Type : Success
Message : [Server] Successfully contacted the AS service at https://ex2.1ask2.com/ews/exchange.asmx. The elapsed tim
e was 48 milliseconds.

RunspaceId : 9d31187c-c438-47a7-96be-8425fd895199
Id : 1126
Type : Success
Message : [Server] Successfully contacted the UM service at https://ex2.1ask2.com/ews/exchange.asmx. The elapsed tim
e was 26 milliseconds.

However, there is no error when running test-outlookWebServices on FW CAS server. Why?

From Outlook at EX2, there is no OAB entry when running "test e-mail autoconfiguration".

Solution:

Restart EX2 computer.

Staff can see all addresses.

Students cannot see the addresses of staff.

new-mailboxdatabase -Server 'QUEEN' -Name 'Student'

mount-database -Identity 'Student'

Customizing OAB

New-AddressList -Name 'Staff List' -RecipientFilter {((RecipientType -eq 'UserMailbox') -and (Department -eq 'Staff')) -or ((RecipientType -eq 'MailUniversalDistributionGroup') -and (CustomAttribute1 -eq 'staff'))} -Container '\'
New-AddressList -Name 'student List' -RecipientFilter {((RecipientType -eq 'UserMailbox') -and (Department -eq 'student')) -or ((RecipientType -eq 'MailUniversalDistributionGroup') -and (CustomAttribute1 -eq 'student'))} -Container '\'

new-OfflineAddressBook -Name 'Staff OAB' -Server 'queen' -AddressLists '\Staff List' -VirtualDirectories 'EX2\OAB (Default Web Site)','FW\OAB (Default Web Site)'
new-OfflineAddressBook -Name 'Student OAB' -Server 'Queen' -AddressLists '\Student List' -VirtualDirectories 'EX2\OAB (Default Web Site)' ,'FW\OAB (Default Web Site)'

Get-OfflineAddressBook | fl name,guid

Customizing Global Address List

New-GlobalAddressList -Name "Global Staff" -RecipientFilter {((RecipientType -eq 'UserMailbox') -and (Department -eq 'Staff')) -or ((RecipientType -eq 'MailUniversalDistributionGroup') -and (CustomAttribute1 -eq 'staff'))}
New-GlobalAddressList -Name "Global Student" -RecipientFilter {((RecipientType -eq 'UserMailbox') -and (Department -eq 'student')) -or ((RecipientType -eq 'MailUniversalDistributionGroup') -and (CustomAttribute1 -eq 'student'))}

Set-MailboxDatabase -Identity 'Student' -OfflineAddressBook 'Student OAB'
Get-MailboxDatabase | fl Name,OfflineAddressBook

Name : vanarts
OfflineAddressBook : \Default Offline Address Book

Name : Student
OfflineAddressBook : \Student OAB

Hierarchical Address Book

dsadd ou "OU=HAB,DC=1ask2,DC=com"

dsadd ou "OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Student,OU=HAB,DC=1ask2,DC=com"

dsadd ou "OU=Administration,OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=2D3D,OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Gaming,OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=VFX,OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Acting,OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=DP,OU=Staff,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Programming,OU=Staff,OU=HAB,DC=1ask2,DC=com"

dsadd ou "OU=2D3D,OU=Student,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Gaming,OU=Student,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=VFX,OU=Student,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Acting,OU=Student,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=DP,OU=Student,OU=HAB,DC=1ask2,DC=com"
dsadd ou "OU=Programming,OU=Student,OU=HAB,DC=1ask2,DC=com"


New-DistributionGroup -Name "VanartsGroup" -DisplayName "VanartsGroup" -Alias "VanartsGroup" -OrganizationalUnit "1ask2.com/HAB" -SamAccountName "VanartsGroup" -Type "Distribution"
Set-OrganizationConfig -HierarchicalAddressBookRoot "VanartsGroup"

New-DistributionGroup -Name "StaffGroup" -DisplayName "StaffGroup" -Alias "StaffGroup" -OrganizationalUnit "1ask2.com/HAB/Staff" -SamAccountName "StaffGroup" -Type "Distribution"
New-DistributionGroup -Name "StudentGroup" -DisplayName "StudentGroup" -Alias "StudentGroup" -OrganizationalUnit "1ask2.com/HAB/Student" -SamAccountName "StudentGroup" -Type "Distribution"

Set-Group -Identity "VanartsGroup" -IsHierarchicalGroup $true
Set-Group -Identity "StaffGroup" -IsHierarchicalGroup $true
Set-Group -Identity "StudentGroup" -IsHierarchicalGroup $true

Add-DistributionGroupMember -Identity "VanartsGroup" -Member "StaffGroup"
Add-DistributionGroupMember -Identity "VanartsGroup" -Member "StudentGroup"

Set-Group -Identity "StaffGroup" -SeniorityIndex 300
Set-Group -Identity "StudentGroup" -SeniorityIndex 200

New-DistributionGroup -Name "Administration_Staff" -DisplayName "Administration Staff" -Alias "Administration_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/Administration" -SamAccountName "Administration_Staff" -Type "Distribution"
New-DistributionGroup -Name "2D3D_Staff" -DisplayName "2D3D Staff" -Alias "2D3D_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/2D3D" -SamAccountName "2D3D_Staff" -Type "Distribution"
New-DistributionGroup -Name "Gaming_Staff" -DisplayName "Gaming Staff" -Alias "Gaming_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/Gaming" -SamAccountName "Gaming_Staff" -Type "Distribution"
New-DistributionGroup -Name "VFX_Staff" -DisplayName "VFX Staff" -Alias "VFX_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/VFX" -SamAccountName "VFX_Staff" -Type "Distribution"
New-DistributionGroup -Name "DP_Staff" -DisplayName "DP Staff" -Alias "DP_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/DP" -SamAccountName "DP_Staff" -Type "Distribution"
New-DistributionGroup -Name "programming_Staff" -DisplayName "programming Staff" -Alias "programming_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/programming" -SamAccountName "programming_Staff" -Type "Distribution"
New-DistributionGroup -Name "Acting_Staff" -DisplayName "Acting Staff" -Alias "Acting_Staff" -OrganizationalUnit "1ask2.com/HAB/Staff/Acting" -SamAccountName "Acting_Staff" -Type "Distribution"

Add-DistributionGroupMember -Identity "StaffGroup" -Member "Administration_Staff"
Add-DistributionGroupMember -Identity "StaffGroup" -Member "2D3D_Staff"
Add-DistributionGroupMember -Identity "StaffGroup" -Member "Gaming_Staff"
Add-DistributionGroupMember -Identity "StaffGroup" -Member "VFX_Staff"
Add-DistributionGroupMember -Identity "StaffGroup" -Member "DP_Staff"
Add-DistributionGroupMember -Identity "StaffGroup" -Member "Programming_Staff"
Add-DistributionGroupMember -Identity "StaffGroup" -Member "Acting_Staff"

Set-Group -Identity "Administration_Staff"-IsHierarchicalGroup $true -SeniorityIndex 200
Set-Group -Identity "2D3D_Staff" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "Gaming_Staff" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "VFX_Staff" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "DP_Staff" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "Programming_Staff" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "Acting_Staff" -IsHierarchicalGroup $true -SeniorityIndex 90

Set-DistributionGroup 'Administration_Staff' -CustomAttribute1 'Staff'
Set-DistributionGroup '2D3D_Staff' -CustomAttribute1 'Staff'
Set-DistributionGroup 'Gaming_Staff' -CustomAttribute1 'Staff'
Set-DistributionGroup 'VFX_Staff' -CustomAttribute1 'Staff'
Set-DistributionGroup 'DP_Staff' -CustomAttribute1 'Staff'
Set-DistributionGroup 'Programming_Staff' -CustomAttribute1 'Staff'
Set-DistributionGroup 'Acting_Staff' -CustomAttribute1 'Staff'

New-DistributionGroup -Name "2D3D_Student" -DisplayName "2D3D Student" -Alias "2D3D_Student" -OrganizationalUnit "1ask2.com/HAB/Student/2D3D" -SamAccountName "2D3D_Student" -Type "Distribution"
New-DistributionGroup -Name "Gaming_Student" -DisplayName "Gaming Student" -Alias "Gaming_Student" -OrganizationalUnit "1ask2.com/HAB/Student/Gaming" -SamAccountName "Gaming_Student" -Type "Distribution"
New-DistributionGroup -Name "VFX_Student" -DisplayName "VFX Student" -Alias "VFX_Student" -OrganizationalUnit "1ask2.com/HAB/Student/VFX" -SamAccountName "VFX_Student" -Type "Distribution"
New-DistributionGroup -Name "DP_Student" -DisplayName "DP Student" -Alias "DP_Student" -OrganizationalUnit "1ask2.com/HAB/Student/DP" -SamAccountName "DP_Student" -Type "Distribution"
New-DistributionGroup -Name "programming_Student" -DisplayName "programming Student" -Alias "programming_Student" -OrganizationalUnit "1ask2.com/HAB/Student/programming" -SamAccountName "programming_Student" -Type "Distribution"
New-DistributionGroup -Name "Acting_Student" -DisplayName "Acting Student" -Alias "Acting_Student" -OrganizationalUnit "1ask2.com/HAB/Student/Acting" -SamAccountName "Acting_Student" -Type "Distribution"

Add-DistributionGroupMember -Identity "StudentGroup" -Member "2D3D_Student"
Add-DistributionGroupMember -Identity "StudentGroup" -Member "Gaming_Student"
Add-DistributionGroupMember -Identity "StudentGroup" -Member "VFX_Student"
Add-DistributionGroupMember -Identity "StudentGroup" -Member "DP_Student"
Add-DistributionGroupMember -Identity "StudentGroup" -Member "Programming_Student"
Add-DistributionGroupMember -Identity "StudentGroup" -Member "Acting_Student"

Set-Group -Identity "2D3D_Student" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "Gaming_Student" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "VFX_Student" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "DP_Student" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "Programming_Student" -IsHierarchicalGroup $true -SeniorityIndex 90
Set-Group -Identity "Acting_Student" -IsHierarchicalGroup $true -SeniorityIndex 90

Set-DistributionGroup '2D3D_student' -CustomAttribute1 'student'
Set-DistributionGroup 'Gaming_student' -CustomAttribute1 'student'
Set-DistributionGroup 'VFX_student' -CustomAttribute1 'student'
Set-DistributionGroup 'DP_student' -CustomAttribute1 'student'
Set-DistributionGroup 'Programming_student' -CustomAttribute1 'student'
Set-DistributionGroup 'Acting_student' -CustomAttribute1 'student'

ADSIEDIT.msc  ms-Exch-HAB-Root-Department-Link  
isMemberOfPartialAttributeSet --True

Restart King,Queen,FW,and EX2 computers.

Creating users

$password=Read-Host "Enter Password" -asSecureString

$fName="Kaiming"
$lName="Liao"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/Administration" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

$fName="Tom"
$lName="Hicken"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/Administration" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

$fName="Scott"
$lName="Hastings"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/DP" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

$fName="Alan"
$lName="Phillips"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/Administration" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

$fName="Rudy"
$lName="Kwok"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/Administration" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

Add-DistributionGroupMember -Identity "Administration_Staff" -Member "Kaiming"
Add-DistributionGroupMember -Identity "Administration_Staff" -Member "Tom"
Add-DistributionGroupMember -Identity "Administration_Staff" -Member "Alan"
Add-DistributionGroupMember -Identity "Administration_Staff" -Member "Rudy"

Set-User -Identity "Alan" -SeniorityIndex 200
Set-User -Identity "Rudy" -SeniorityIndex 100
Set-User -Identity "Kaiming" -SeniorityIndex 90
Set-User -Identity "Tom" -SeniorityIndex 90

$password=Read-Host "Enter Password" -asSecureString

$fName="Wayne"
$lName="Gilbert"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/2D3D" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

$fName="Charles"
$lName="Phillips"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/2D3D" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

$fName="Lawrence"
$lName="Wong"
$Department="Staff"

New-Mailbox -Name "$fName $lName" -Alias "$fName" -OrganizationalUnit "1ask2.com/HAB/Staff/2D3D" -UserPrincipalName "$fName@1ask2.com" -SamAccountName "$fName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "vanarts"

Set-User "$fName $lName" -Department $Department

Add-DistributionGroupMember -Identity "2D3D_Staff" -Member "Wayne"
Add-DistributionGroupMember -Identity "2D3D_Staff" -Member "Charles"
Add-DistributionGroupMember -Identity "2D3D_Staff" -Member "Lawrence"

Set-User -Identity "Wayne" -SeniorityIndex 200
Set-User -Identity "Charles" -SeniorityIndex 90
Set-User -Identity "Lawrence" -SeniorityIndex 90

$password=Read-Host "Enter Password" -asSecureString

$fName="Andy"
$lName="Stierli"
$Department="Student"

New-Mailbox -Name "$fName $lName" -Alias "$fName.$lName" -OrganizationalUnit "1ask2.com/HAB/Student/2D3D" -UserPrincipalName "$fName.$lName@1ask2.com" -SamAccountName "$fName.$lName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "Student"

Set-User "$fName $lName" -Department $Department
Add-DistributionGroupMember -Identity "2D3D_Student" -Member "$fName $lName"

$fName="Daniel"
$lName="Laszlo"
$Department="Student"

New-Mailbox -Name "$fName $lName" -Alias "$fName.$lName" -OrganizationalUnit "1ask2.com/HAB/Student/2D3D" -UserPrincipalName "$fName.$lName@1ask2.com" -SamAccountName "$fName.$lName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "Student"

Set-User "$fName $lName" -Department $Department
Add-DistributionGroupMember -Identity "2D3D_Student" -Member "$fName $lName"

$fName="Ross"
$lName="Phillips"
$Department="Student"

New-Mailbox -Name "$fName $lName" -Alias "$fName.$lName" -OrganizationalUnit "1ask2.com/HAB/Student/2D3D" -UserPrincipalName "$fName.$lName@1ask2.com" -SamAccountName "$fName.$lName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "Student"

Set-User "$fName $lName" -Department $Department
Add-DistributionGroupMember -Identity "2D3D_Student" -Member "$fName $lName"

$fName="Helen"
$lName="Guergis"
$Department="Student"

New-Mailbox -Name "$fName $lName" -Alias "$fName.$lName" -OrganizationalUnit "1ask2.com/HAB/Student/2D3D" -UserPrincipalName "$fName.$lName@1ask2.com" -SamAccountName "$fName.$lName" -FirstName $fName -initials "" -LastName $lName -Password $password -Database "Student"

Set-User "$fName $lName" -Department $Department
Add-DistributionGroupMember -Identity "2D3D_Student" -Member "$fName $lName"

Preview the address list

update-AddressList -Identity '\Staff List'
update-AddressList -Identity '\Student List'

$a=Get-AddressList 'Staff List'
get-recipient -RecipientPreviewFilter $a.RecipientFilter

$b=Get-AddressList 'Student List'
Get-Recipient -RecipientPreviewFilter $b.RecipientFilter

Update-GlobalAddressList "Global Staff"
Update-GlobalAddressList "Global Student"

$global=get-globalAddresslist "Global Staff"
Get-Recipient -RecipientPreviewFilter $global.RecipientFilter

$global=get-globalAddresslist "Global Student"
Get-Recipient -RecipientPreviewFilter $global.RecipientFilter

$global=get-globalAddresslist "Default Global Address List"
Get-Recipient -RecipientPreviewFilter $global.RecipientFilter

Update the offline address books without waiting the scheduled interval elapse

Update-OfflineAddressBook 'Staff OAB'
Update-OfflineAddressBook 'Student OAB'
Update-OfflineAddressBook 'Default Offline Address Book'

or,

Get-OfflineAddressBook | Update-OfflineAddressBook

Distributing the updated OAB to the client access servers

Update-FileDistributionService -Identity "FW" -Type OAB
Update-FileDistributionService -Identity "Ex2" -Type OAB

Get-OfflineAddressBook | fl Name,GUID

Test OAB accessible

Test-OutlookWebServices -id "kaiming@1ask2.com"

When the following errors occcur, I simply leave the servers overnight.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1019
Type : Information
Message : A valid Autodiscover service connection point was found. The Autodiscover URL on this object is https://ex
server.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://exserver.1ask2.com/autodiscover/autodiscover.xml received the error Unable to conn
ect to the remote server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://exserver.1ask2.com/autodiscover/autodiscover.xml received the error A connection a
ttempt failed because the connected party did not properly respond after a period of time, or established
connection failed because connected host has failed to respond 191.121.3.3:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1023
Type : Error
Message : The Autodiscover service couldn't be contacted.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1113
Type : Error
Message : When contacting https://FW.1ask2.com:443/autodiscover/autodiscover.xml received the error Unable to connec
t to the remote server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1113
Type : Error
Message : When contacting https://FW.1ask2.com:443/autodiscover/autodiscover.xml received the error A connection att
empt failed because the connected party did not properly respond after a period of time, or established co
nnection failed because connected host has failed to respond 191.121.6.4:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1123
Type : Error
Message : The Autodiscover service couldn't be contacted.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://exserver.1ask2.com/EWS/Exchange.asmx received the error Unable to connect to the r
emote server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://exserver.1ask2.com/EWS/Exchange.asmx received the error A connection attempt faile
d because the connected party did not properly respond after a period of time, or established connection f
ailed because connected host has failed to respond 191.121.3.3:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1025
Type : Error
Message : [EXCH] Error contacting the AS service at https://exserver.1ask2.com/EWS/Exchange.asmx. Elapsed time was 3
05 milliseconds.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://exserver.1ask2.com/EWS/Exchange.asmx received the error Unable to connect to the r
emote server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://exserver.1ask2.com/EWS/Exchange.asmx received the error A connection attempt faile
d because the connected party did not properly respond after a period of time, or established connection f
ailed because connected host has failed to respond 191.121.3.3:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1027
Type : Error
Message : [EXCH] Error contacting the UM service at https://exserver.1ask2.com/EWS/Exchange.asmx. Elapsed time was 2
9 milliseconds.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://mail.1ask2.com/EWS/EXchange.asmx received the error Unable to connect to the remot
e server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://mail.1ask2.com/EWS/EXchange.asmx received the error A connection attempt failed be
cause the connected party did not properly respond after a period of time, or established connection faile
d because connected host has failed to respond 191.121.3.3:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1025
Type : Error
Message : [EXPR] Error contacting the AS service at https://mail.1ask2.com/EWS/EXchange.asmx. Elapsed time was 13 mi
lliseconds.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://mail.1ask2.com/EWS/EXchange.asmx received the error Unable to connect to the remot
e server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1013
Type : Error
Message : When contacting https://mail.1ask2.com/EWS/EXchange.asmx received the error A connection attempt failed be
cause the connected party did not properly respond after a period of time, or established connection faile
d because connected host has failed to respond 191.121.3.3:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1027
Type : Error
Message : [EXPR] Error contacting the UM service at https://mail.1ask2.com/EWS/EXchange.asmx. Elapsed time was 29 mi
lliseconds.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1113
Type : Error
Message : When contacting https://fw.1ask2.com/ews/exchange.asmx received the error Unable to connect to the remote
server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1113
Type : Error
Message : When contacting https://fw.1ask2.com/ews/exchange.asmx received the error A connection attempt failed beca
use the connected party did not properly respond after a period of time, or established connection failed
because connected host has failed to respond 191.121.6.4:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1125
Type : Error
Message : [Server] Error contacting the AS service at https://fw.1ask2.com/ews/exchange.asmx. Elapsed time was 29 mi
lliseconds.

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1113
Type : Error
Message : When contacting https://fw.1ask2.com/ews/exchange.asmx received the error Unable to connect to the remote
server

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1113
Type : Error
Message : When contacting https://fw.1ask2.com/ews/exchange.asmx received the error A connection attempt failed beca
use the connected party did not properly respond after a period of time, or established connection failed
because connected host has failed to respond 191.121.6.4:443

RunspaceId : 7779935f-1e05-4ebb-a6ba-f25ecf5dc6de
Id : 1127
Type : Error
Message : [Server] Error contacting the UM service at https://fw.1ask2.com/ews/exchange.asmx. Elapsed time was 13 mi
lliseconds.

After a night passed, re-run test-OutlookWebServices:Successful

Test-OutlookWebServices 'kaiming@1ask2.com'

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1019
Type : Information
Message : A valid Autodiscover service connection point was found. The Autodiscover URL on this object is https://ex
server.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1006
Type : Information
Message : Contacted the Autodiscover service at https://exserver.1ask2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1016
Type : Information
Message : [EXCH] The AS is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1015
Type : Information
Message : [EXCH] The OAB is configured for this user in the Autodiscover response received from https://exserver.1as
k2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1014
Type : Information
Message : [EXCH] The UM is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1016
Type : Information
Message : [EXPR] The AS is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1015
Type : Information
Message : [EXPR] The OAB is configured for this user in the Autodiscover response received from https://exserver.1as
k2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1014
Type : Information
Message : [EXPR] The UM is configured for this user in the Autodiscover response received from https://exserver.1ask
2.com/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1022
Type : Success
Message : Autodiscover was tested successfully.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1106
Type : Information
Message : Contacted the Autodiscover service at https://EX2.1ask2.com:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1116
Type : Information
Message : [EXCH] The AS is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1115
Type : Information
Message : [EXCH] The OAB is configured for this user in the Autodiscover response received from https://EX2.1ask2.co
m:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1114
Type : Information
Message : [EXCH] The UM is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1116
Type : Information
Message : [EXPR] The AS is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1115
Type : Information
Message : [EXPR] The OAB is configured for this user in the Autodiscover response received from https://EX2.1ask2.co
m:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1114
Type : Information
Message : [EXPR] The UM is configured for this user in the Autodiscover response received from https://EX2.1ask2.com
:443/autodiscover/autodiscover.xml.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1122
Type : Success
Message : Autodiscover was tested successfully.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1024
Type : Success
Message : [EXCH] Successfully contacted the AS service at https://exserver.1ask2.com/EWS/Exchange.asmx. The elapsed
time was 914 milliseconds.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1026
Type : Success
Message : [EXCH] Successfully contacted the UM service at https://exserver.1ask2.com/EWS/Exchange.asmx. The elapsed
time was 239 milliseconds.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1024
Type : Success
Message : [EXPR] Successfully contacted the AS service at https://mail.1ask2.com/EWS/EXchange.asmx. The elapsed time
was 64 milliseconds.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1026
Type : Success
Message : [EXPR] Successfully contacted the UM service at https://mail.1ask2.com/EWS/EXchange.asmx. The elapsed time
was 26 milliseconds.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1124
Type : Success
Message : [Server] Successfully contacted the AS service at https://ex2.1ask2.com/ews/exchange.asmx. The elapsed tim
e was 50 milliseconds.

RunspaceId : 5d858eb1-ed6c-4b45-ba16-ea0527c59923
Id : 1126
Type : Success
Message : [Server] Successfully contacted the UM service at https://ex2.1ask2.com/ews/exchange.asmx. The elapsed tim
e was 27 milliseconds.

If the certificate doesn't include the EXServer.1ask2.com domain name, you will find the OAB error.

So far, everybody can see the default global address list.

OWA

Staff will access the Default Global Address List.

Students will access Global Student address list.

How?

AD schema;

regsvr32 C:\WINDOWS\system32\schmmgmt.dll

ADSIEdit.msc

Set the msExchQueryBaseDN attribute mailbox:Andy Stierli (student) with

CN=Global Student,CN=All Global Address Lists,CN=Address Lists Container,CN=1ask2Corp,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=1ask2,DC=com

Modify all other students' msExchQueryBaseDN attribute.

Because the msExchQueryBaseDN attribute can be copied when duplicating a user, it is better create a student user account first by copying Andy Stierli in Active Directory Users and Computers. And then running enable-mailbox cmdlet.

By default, staff can see all users.

msExchQueryBaseDN:

CN=Default Global Address List,CN=All Global Address Lists,CN=Address Lists Container,CN=1ask2Corp,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=1ask2,DC=com

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -AllAddressListsEnabled:$False

Student:

Staff:

How about outlook?

Staff:

Student:

Staff can see the Hierarchical Address Book. Student cannot see it.

Cannot access OWA?

Test-OwaConnectivity -URL:https://mail.1ask2.com/owa -MailboxCredential:(get-credential 1ask2\kaiming)

An unknow failure occurred during logon.

Several Services, such as Microsoft Exchange Form-based Authentication Service, don't start. Start them.