Finally the help of IT is here

Blog of computer solutions.

Event viewer detecting errors from Powershell

Posted by Xaus Xavier Nadal 13th on May 2012


Today we put some powershell.

This article explains how to remotely collect event viewer windows event of a team or group of computers from a Powershell command line and also in Onliner, hehe as I like ..

Remember Article where we showed how to solve a bug with the Active Directory replication sysvol ?, because this script we can remotely detect such errors without having to wait for a user to tell us your script does not work because not detected, or a domain policy is not being applied that does not exist in a site, etc ..

What we do with this script is to check the last 2 days of logs in the event viewer the "File Replication Service" as source "NtFrs" and type "Error" and we force we only show errors type "13568" and we only show the newest to adjust to the preferences error detecting active directory replication (you will be able to put whatever you want such as detect if Exchange databases have been turned off because of that the transaction log is filled) With the following values:

Type: Error

Event ID: 9518

Source: MSExchangeIS

But for now what we will find we are the problems with the FRS and we are looking for the following:

Type: Error

Event ID: 13568

Source: NtFrs

We will do this:

get-eventlog -newest 1 -despues de (get-date) .AddDays (-2) -computername <ComputerName> -Logname "File Replication Service" -Source "NtFrs" -entrytype "Error" | Where{. $ _ Eq EventId '13568'} | select machinename, source | ft -autosize

The result if sensing that there has been an error in the last 2 days in the File Replication Service section with NtFrs source, Error type and code 13568 event would be:

MachineName Source

---- -

MegaDC1 NtFrs

From there we can solve the problem because the following article for example:

But if what you want is to detect this same on all domain controllers in the domain will have to change -computername <ComputerName> to:

-computername (get-qadcomputer -searchroot "<Domain> Domain Controllers" -dudip | Select-Object -ExpandProperty Yam)

Care that this last change will on all domain controllers you have, and take a lot, (You will have to have tools installed Quest Active Roles Management) Think that we do not use remotely and process strands (This will show you and other members of the blog which is more than I Powershell expert) to see if you dare .. Albert !!!!!, you want to read in MegaCracks ...

You can also run the command on each server daily and you send an email with the results to an e-mail or send it to a file that will be collected by an IIS and displayed in a web like a monitor centralized event it were, or what you offer your imagination ... the world of powershell is impressive, but it is when you unite with automation, displays, websites, etc ..

If you have any questions about this we will be happy to give you support from the comments of the bog.

Until next time.

tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,
Posted by Error, Exchange, PowerShell, powershell | No Comments »

An MSExchangeIS event with error code 9518 0xfffffddc

Posted by Xaus Xavier Nadal 13th on May 2012

Good Morning.

The other day a client monitoring to detect the following error in your email system Exchange 2003, An MSExchangeIS event with error code 9518 0xfffffddc.

We found that all databases of a Storage Group had gone suddenly. (Normal in this type of errors, now I will explain why.) And attempting to start the database the following error appeared

Type: Error

Event ID: 9518

Source: MSExchangeIS

Error 0xfffffddc starting Storage Group / DC = com / DC = <domain> / CN = Configuration / CN = Services / CN = Microsoft Exchange / CN = <container> / CN = Administrative Groups / CN = First Administrative Group / CN = Servers / CN = <server> / CN = InformationStore / 2 CN = Storage Group on the Microsoft Exchange Information Store.

Storage Group - Initialization of Jet failed.

This occurs when the maximum number represented by the name of the transaction log for the particular storage group (ExxFFFF0.log) 1,048,560 2003 Exchange log in and (0x7FFFFFFF) log files 2,147,483,647 2007 Exchange is exceeded.

But when this happens ?: The transaction log files (transaction log) is a record of every transaction made by the database engine. All transactions are written to the log, then slowly written to the database.

Every time someone receives, sends, moves a mail or when a user moves exhange administrator of a database to another this log is growing and will stored on disk as files with a specific nomenclature Exx<Count>.log and each of these files in Exchange 2003 5,120 occupy KB (5 MB).

Therefore as long ago you disponéis installed and Exchange 2003 sure you have done almost 1 million moves, or already has passed or you will have little to you that error appears.

To detect this you can proactively monitor the LOGS folder of your Exchange to detect if the files you are generating 2003 Exchange (transaction log) are near ExxFFFF0.log as you can see in the following image:

Megacrack read »

tags: , , , , , , , , , , , , , , , , , ,
Posted by Exchange | 2 Comments »

Solve problems Outlook and Exchange Performance

Posted by Xaus Xavier Nadal 10th on May 2012

Good Morning.

For some years that Outlook users with Exchange 2003 are experiencing slow systems, time out, errors, etc .. Each day the amount of mail we receive is higher, the size of e is higher and capabilities of servers they remain the same (subject crisis).

But the mistake that the mail server is responsible, is a wrong way to take on the problem.

Outlook 2003 / 2007 / 2010 like many other mail systems have their limitations and best practices that should follow strictly and only without modifying the Outlook system users and especially without investing in new hardware or even without thinking about upgrading your system mail to a recent version we could achieve very good results in performance mail system is concerned. (The user will thank you.)

One of the major problems and very easy to solve is the number of emails in each folder in Outlook.

This number post should never exceed 3000 post (Sounds like a lot at first, but look at your inbox or sent items folder (How many have ???).

With this simple change we can see a substantial improvement in the performance of our Outlook and therefore in the user feedback regarding the mail system. And if you look also amazing on the Exchange server load.

The contents of each folder is stored in a table in the Information Store Database, as it increases the number of items in each folder mechanism Extensible Storage also called ESE using data structures B + trees to store records also increases and as the number of records increases, the number of I / O disk to store new information also increases and decreases the performance of the entire system.

Megacrack read »

tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,
Posted by Exchange | No Comments »

List ActiveSync-enabled users in Active Directory.

Posted by Xaus Xavier Nadal 18th on January 2012


To make a list of users who have ActiveSync enabled in Active Directory will use the great tool of the company Quest (Active Roles Management) plus essential and Powershell (Read the following article to see how to install these tools) :

What we want to achieve with this article is to list the users who have enabled the feature in Exchange (User initiated synchronization o Update Notifications).

To achieve this we use the field msExchOmaAdminWirelessEnable containing different values, 2, 3, 7 as it is enabled.

We know that other than 7 means you have something enabled. (For example with User initiated synchronization us appears the result 3 and with User initiated synchronization y Update Notifications result appears to us 2, so the query will show a list of users when the field msExchOmaAdminWirelessEnable is other than 7.

The command we'll use is as follows:

Get-QADUserDontUseDefaultIncludedProperties -SizeLimit 0 -IncludedProperties msExchOmaAdminWirelessEnable | where-object{($ _ MsExchOmaAdminWirelessEnable 7 -ne.) -and ($ _ MsExchOmaAdminWirelessEnable -ne $ null.)} | format-table displayname, samAccountName, msExchOmaAdminWirelessEnable

Shortcut (With fewer characters in the line of the query): This is just to save typing much (The result is exactly the same).

Get-QADUser -dudip -sl 0 -ip msExchOmaAdminWirelessEnable | ?{($ _ MsExchOmaAdminWirelessEnable 7 -ne.) -and ($ _ MsExchOmaAdminWirelessEnable -ne $ null.)} | ft displayname, samAccountName, msExchOmaAdminWirelessEnable

Just to see more of powershell, to check the short names of all properties in powershell type in "alias"And you will see a long list of short names of the switches as the following examples.

CommandType Name Definition
———– —- ———-
ForEach-Object Alias%
Alias? Where-Object
Ac Add-Content Alias
Alias ​​Add-PSSnapIn ASNP
Alias ​​cat Get-Content
Alias ​​Set-Location cd
Chdir Alias ​​Set-Location
Clear-Content Alias ​​clc
Alias ​​Clear-Host clear

I hope it been usefull.

See you soon.

tags: , , , , , , , ,
Posted by Active Directory, Exchange, PowerShell | No Comments »

Load Simulator (Measure maximum load on Exchange)

Posted by Xaus Xavier Nadal 12th on November 2011


A link I found by accident the other day and I found it very good is the 2003 Microsoft Exchange Server Load Simulator (LoadSim) application.

I leave the link for Exchange LoadSim 2003:

With this application we can simulate the performance of MAPI clients connected to our Exchange before they come, so we can properly size the server before the thousands of users who want to access our server come.

Exchange 2007 the link is as follows:

To measure performance and yields Exchange 2010 you can use the following:

Generator load for Exchange Exchange 2010:

Microsoft Exchange Server Jetstress 2010 that will measure the performance and stability of the disk subsystem load simluando Input / Output (IO) on discs

Greetings and see you soon.

tags: , , , , , , , ,
Posted by Exchange, Exchange 2007, Exchange 2010, mail Servers | No Comments »

G|translate Your license is inactive or expired, please subscribe again!