VMWARE NSX-T Load Balancer for Exchange

A very long time I used ha-proxy for lb to publish Exchange OWA/Active-Sync in to the WWW. After the installation with NSX-T. I have the opportunity to replace my old ha-proxy configuration with the integrated LB from NSX-T. I would like to replace the ha-proxy for internal MAPI namespace. Normally that will be used often KEMP LB or ha-proxy. With NSX-T you can also replace this product. To Replace MAPI Namespace lb is very simple that will be used only TCP for lb.

I will not write how to deploy the LB that can you read here.

I will show you some configuration where not included in the knowledge base.

To protect your Administrator interface from external access. In my old ha-proxy configuration I had a ACL to protect ecp from external.

For the OWA rule you must add a forwarding rule with this options.

For your SSL configuration you need your domain certificate and intermediate certificates also.
You need Client SSL and Server SSL. You can use twice the same certificate,.

Before you can assign the certificates you have to import the certificates for your domain and the intermediate certificates under System = >Certificates

After importing the certificates you can assign this to your Virtual Servers HTTP 7 rule.
Trusted CA Certificates means your intermediate certificate.

vmware object type requires hosted I/O

VM wil not power-on and throws the following error:

Object type requires hosted I/O

SSH into the ESX-host that’s hosting the VM.
Browse to the VM-folder containing the disk files.

Run the following command in ESXI CLI:

vmkfstools -x check “disk.vmdk”
Disk needs repaired

vmkfstools -x repair “disk.vmdk”
Disk was successfully repaired.

Start VM from vCenter

found here


Confluence alternative

What a incredible e-mail from Atlassian, cloud first. Not everyone wants to use the cloud. I worked with Confluence and Jira over ten years now. Time for alternative Wikis. I am a little bit sad about the cloud first strategy. Confluence and Jira are pretty cool tools.
Time for alternative Wiki´s


This Wiki very close to Confluence. But one feature is missing


Multi Sites

BlueSpice based on MediaWiki but it have a lot more features and a good Editor.


Multi Sites only available in the enterprise version.

Also look at tiki.org but is more than a wiki

For Jira alternative

I found

http://www.tuleap.org or https://www.openproject.org

ASA Local Authentication Using Active Directory

I had a heck of a time figuring out how to set this up. Cisco’s documentation related to LDAP authentication is all over the place and there isn’t one article that describes just this. If you want to use Microsoft Active Directory to authenticate users locally logging in to the ASA and give them privileged exec access based on a Group, here are the steps.

These steps assume you are using ASDM, but I have attached the CLI equivalents as well.


  • Create a group in Active Directory that will be used to define access to the ASA. I.e. ASA Admins.
  • Create a service account (password not expiring unless you want to change it in AD and your ASA every month) that will be used by the ASA to bind with AD.

Do it

1. Log in to the ASA with ASDM (CLI steps below)

2. Go to Device…

View original post 1,113 more words

Mount cif share as user

On Ubuntu you need the cifs-utils

apt-get install cifs-utils

Add the share to the /etc/fstab

// /mount/share cifs username=john,domain=contoso,noauto,rw,users 0 0

set the correct rights for the local user to the mount share.

sudo mkdir /mount/share
sudo chown -R john:john contoso
sudo chmod -R 774 contoso

Mount the share with mount.cifs

mount.cifs  // /mount/share 

Don´t use mount -t cifs

read more here


Exchange 2010/2013 – ActiveSync devices are not able to send e-mails sporadically. E-mails with attachment and long conversation history.



ActiveSync devices are not able to send e-mails sporadically. E-mails with attachment and long conversation history.

IPhone Error “Message cannot be sent” , “The message was rejected from the server”


Browsed to configuration editor of IIS ->Microsoft-Server-ActiveSync Virtual Directory -> select ConfigurationEditor -> system.webServer -> serverRuntime -> uploadReadAheadSize.

Change value to 15728640

Recycle MSExchange ActiveSync AppPool.

Additional Info:


  • The maxRequestEntityAllowedand uploadReadAheadSize attributes respectively configure limits for the maximum number of bytes allowed in the entity body of a request and the number of bytes a Web server will read into a buffer and pass to an ISAPI extension.


View original post

Manually remove old CA references in Active Directory

Microsoft Security Solutions



When a CA server is uninstalled or crashes beyond recovery some objects are left in Active Directory. It’s good practice to remove these obsolete objects.


When you install a version of Certificate Authority that is Active Directory-integrated (i.e. Enterprise Root or Enterprise Subordinate) the following 6 objects are created/modified in the Active Directory database:

Name: <CA Common Name>
Type: certificateAuthority
LDAP Path: CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=DC=example,DC=com
Used for: Contains CA certificates that clients can fetch when validating a certificates chain. Certificates can point to this location via the Authority Information Access (AIA) certificate extension.

Name: <CA Common Name>
Type: crlDistributionPoint
LDAP Path: CN=<CAServerName>,CN=CDP,CN=Public Key Service,CN=Services,CN=Configuration,DC=DC=example,DC=com
Used for: Contains CRLs (base and delta) that CAs has published in the AD. Certificates can point to this location via the CRL Distribution Point (CDP) certificate extension.

Name: <Root CA Common…

View original post 706 more words

Always On VPN and Windows Server 2019 NPS Bug

Richard M. Hicks Consulting, Inc.

When deploying a Windows Server 2019 Network Policy Server (NPS) to support a Windows 10 Always On VPN implementation, administrators may encounter the following error when attempting to establish a VPN connection on a remote Windows 10 client.

Can’t connect to [connection name].

The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.

Always On VPN and Windows Server 2019 Network Policy Server Bug
In addition, an event ID 20227 from the RasClient will be recorded in the application event log with the following error message.

The user [username] dialed a connection named [connection name] which has failed. The error code returned on failure is 812.

Always On VPN and Windows Server 2019 Network Policy Server Bug

Common Causes

Always On VPN error code 812 indicates an authentication policy mismatch…

View original post 276 more words