###BeginCaseStudy###
Testlet 1
Topic 5, Proseware, Inc
Overview
General Overview
Proseware, Inc., is an international manufacturing company that has 3,000 users. Proseware has a sales
department, a marketing department, a research department, and a human resources department.
Proseware recently purchased a small competitor named Contoso, Ltd.
Physical Locations
Proseware has two offices. The offices are located in New York and London. The offices connect to each other
by using a WAN link. Each office connects directly to the Internet.
Contoso has one office in Chicago.
Existing Environment
Active Directory Environment
The network of Proseware contains an Active Directory forest named proseware.com. The forest contains a
single domain and two sites named London and New York. Each site contains two domain controllers that run
Windows Server 2008 R2. The domain controllers in the New York site are named DC1 and DC2. The domain
controllers in the London site are named DC3 and DC4.
All FSMO roles are hosted on DC3 and DC4.
The network of Contoso contains an Active Directory forest named contoso.com. The forest contains five
domain controllers and one site.
Exchange Server Organization
Proseware has an Exchange Server 2013 organization that contains two database availability groups (DAGs)
named DAG-NYC and DAG-LON. The DAGs are configured as shown in the following table.
The certificate used for Exchange Server 2013 has a subject name of mail.proseware.com and a Subject
Alternative Name (SAN) of autodiscover.proseware.com.
Each mailbox database has three copies. All users connect to an active copy of the database on a server in
their respective office. Native data protection is implemented.
NTLM communication is used exclusively for Outlook Anywhere both internally and externally.Problem Statements
Proseware identifies the following issues:
Users report that sometimes, they fail to access the free/busy information of the other users. You also
discover that some users fail to retrieve Autodiscover settings.
Users in the London office report that during a 24-hour WAN outage, they could see only new users in the
global address list (GAL) from Outlook Web App.
The manager of the human resources department in the New York office cannot see new London office
users in the GAL until several hours after the help desk confirms that the users were created.
A hung MSExchangeOWAAppPool in Internet Information Services (IIS) on EX1 causes all of the database
copies to fail over. Despite having the same CopyQueueLength and ReplayQueueLength as the copies on
EX2, the copies on EX3, which have a higher activation preference, are activated, forcing user connections
over the WAN.
A custom application named Appl recently malfunctioned and sent hundreds of false positive email
notifications that had a subject of System Alert: Sales Database Reaching Capacity to all of the users in the
organization. While attempting to remove the email messages, an administrator ran the Search-Mailbox –
DeleteContent command and erroneously deleted valid email messages from the mailboxes of some
executives.
Requirements
Business Goal
Proseware identifies the following business goals:
Reduce the costs associated with using bandwidth on the WAN links.
Improve social media integration by using a Microsoft Outlook app that will be deployed to all of the users in
the sales department.
Planned Changes
Proseware plans to make the following changes:
Implement a lagged copy for the mailbox database of the executives.
Implement an RBAC-linked role group for the administrators at Contoso to manage the mailboxes of the
Proseware users.
Technical Requirements
Proseware identifies the following technical requirements:
End users must be notified after one hour if the email messages that they send are not delivered.
If mailbox database storage fails, the IT department must be able to recover old email messages that were
sent up to five days earlier to the mailboxes of the executives.
All new users hired at Contoso must have a user account in contoso.com and an Exchange Server mailbox
in proseware.com. All new user accounts in contoso.com must have a user principal name (UPN) that ends
with proseware.com.
Administrators at Contoso must be able to create and manage recipient objects in the Exchange Server
organization of Proseware by using their existing contoso.com administrator account. All Contoso recipient
objects must reside in an organizational unit (OU) named proseware.com
Security Requirements
The Chief Security Officer (CSO) introduces the following security requirements:
All Outlook users who connect from the Internet must use Basic authentication only.
All Outlook users who connect from the internal network must use NTLM authentication only.
SLA Requirements
Due to productivity losses during some recent maintenance windows, the Chief Information Officer (CIO)
introduces a new service level agreement (SLA) requiring that all servers entering or exiting a maintenance
window must be taken in and out of service properly.
The SLA contains the following requirements:
All mounted databases on the server undergoing maintenance must be activated on another server.
All message queues on the server undergoing maintenance must be empty before maintenance can begin.
The server undergoing maintenance must be prevented from becoming a Primary Active Manager (PAM).Databases copies on the server undergoing maintenance must not be activated while maintenance is
occurring.
###EndCaseStudy###
You are implementing a solution to meet the security requirements for Outlook authentication.
You purchase a new certificate that has a subject name of mail.proseware.com and SANs of
autodiscover.proseware.com and oa.proseware.com.
You create a host (A) record for oa.proseware.com in the public DNS zone.
Remote users report that they fail to connect to their mailbox by using Outlook.
You need to ensure that the remote users can connect to their mailbox from Outlook. The solution must meet
the security requirements.
Which two commands should you run? (Each correct answer presents part of the solution. Choose two.)
A.
Set-OutlookProvider EXPR -CertPrincipalName msstd:mail.proseware.com
B.
Set-OutlookAnywhere -ExternalHostName oa.proseware.com -ExternalClientAuthenticationMethod Basic –
ExternalClientsRequireSsI $true -InternalHostName mail.proseware.com –
InternalClientAuthenticationMethod NTLM -InternalClientsRequireSsI Strue
C.
Set-OutlookProvider EXPR -CertPrincipalName msstd:oa.proseware.com
D.
Set-OutlookAnywhere -ExternalHostName mail.proseware.com- ExternalClientAuthenticationMethod Basic
-ExternalClientsRequireSsI $true -InternalHostName oa.proseware.com –
InternalClientAuthenticationMethod NTLM -InternalClientsRequireSsI $true
Explanation:
Set-OutlookProvider EXPR
The common benefit of enabling Outlook Provider, is to assure Outlook client connecting to a specific server,
which has a specific name in subject name field on the certificate.
Set-OutlookProvider EXPR -CertPrincipalName msstd:mail.contoso.com
Running above command will force Outlook client “Only connect to proxy servers that have this principal name
in their certificate” to be enabled and value set to msstd:mail.contoso.com.
If client connects to a proxy server, which does not have mail.contoso.com in subject name field in the
certificate, the connection will fail.
Set-OutlookAnywhere
Use the Set-OutlookAnywhere cmdlet to modify the properties on a computer running Microsoft Exchange
Server 2013 enabled for Microsoft Outlook Anywhere.
The ExternalHostname parameter specifies the external host name to use in the Microsoft Outlook profiles for
users enabled for Outlook Anywhere.
The InternalHostname parameter specifies the internal hostname for the Outlook Anywhere virtual directory.A
Subject name of the certificate is mail.proseware.com not oa.prosware.com
NOT C
Subject name of the certificate is mail.proseware.com not oa.prosware.com
B
ExternalHostName oa.proseware.com is correct as oa.proseware.com is a host (A) record in the public DNS
zone.
NOT D
ExternalHostName mail.proseware.com is NOT correct as oa.proseware.com is a host (A) record in the public
DNS zone.
http://technet.microsoft.com/en-us/library/bb123683(v=exchg.150).aspx
http://technet.microsoft.com/en-us/library/bb123545(v=exchg.150).aspx