How to Remove Mailbox Auto-Mapping in Outlook

Exchange 2010 Service Pack 1 (SP1) and later and Office 365 include a feature that allows Outlook clients to automatically map to any mailbox to which a user has Full Access permissions. If a user is granted Full Access permissions to another user's mailbox or to a shared mailbox, Outlook automatically loads all mailboxes to which the user has full access.

There may be times when you don't want to enable auto-mapping for a mailbox.

TechNet article, Disable Outlook Auto-Mapping with Full Access Mailboxes, explains how to disable auto-mapping behavior for mailboxes as you configure Full Access using PowerShell, but this doesn't help if you configure it from the Exchange Admin Console (EAC). If you or another admin configure Full Access to a mailbox using the EAC, there is no option to disable auto-mapping.

I've seen guidance saying that to remove auto-mapping you must remove Full Access from the mailbox account and re-add it again using the PowerShell method listed in the article above. But I found a better way -- simply run the same PowerShell command against the same mailbox with the -Automapping $false switch.

For example, say Keith Johnson has been granted Full Access to John Smith's mailbox and auto-mapping has been enabled (the default behavior). If you want to remove auto-mapping of John's mailbox in Keith's Outlook, do the following:

• Open the Exchange Management Shell (EMS) or connect to Exchange Online using the Windows Azure Active Directory Module for Windows PowerShell and run the following cmdlet:

Add-MailboxPermission -Identity "John Smith" -User "Keith Johnson" -AccessRight FullAccess -Automapping $false

This command will remove auto-mapping of the mailbox in Outlook, but will not affect any other Full Access permissions. Outlook will automatically remove the full access mailbox from the list of mailboxes on the next Autodiscover refresh cycle.

Read more ...

Chrome Browser Now Warns About Weak SHA-1 Certificates

*** ACTION REQUIRED ***

The Google Chrome web browser is now warning users if Outlook on the web (OWA) or other websites are using SHA-1 SSL certificates.

These certificates are no longer considered secure and should be replaced ASAP. Please read my article, "Is Your Organization Using SHA-1 SSL Certificates?" on Windows IT Pro for more information and steps you should take.

SHA1 certificates are being sunsetted by January 1, 2017. These certs should be replaced or re-keyed with SHA256 certs to improve security and prevent outages.

Read more ...

2015 Exchange Oscars

I'm honored to have be awarded the award for "Best at Knowledge Sharing" earlier this month at the 2015 MVP Global Summit in Redmond, WA.

Netmail and Binary Tree generously sponsored the second Exchange Oscars party at the Tavern Hall in Bellevue, WA. This was a really fun event where the Exchange product group and Exchange MVPs got together for food, drinks and awards.

The Exchange MVPs voted to give awards to the following Exchange product group members:

• Most Helpful Product Group Member - Brian Day
• Best Advice Given - Timothy Heeney
• Best Tool - The Exchange Remote Connectivity Analyzer (ExRCA) - Brad Hughes and Shawn McGrath
• Best EHLO Blog Post - Ross Smith IV

The Exchange product group also voted to give awards to the following Exchange MVPs:

• Best at Knowledge Sharing - Jeff Guillet
• Best Code Contribution - Glenn Scales
• Most Promising MVP - Andrew Higginbotham
• Best Use of Social Media - Michael van Horenbeeck
• Most Influential Blog - Tony Redmond

The hilarious Greg Taylor did a fantastic job as MC of the ceremonies. Lots of fun was had by all!

Read more ...

Don't Delete or Rename the Default MRM Policy

I was troubleshooting an issue with an Exchange 2013 customer where their "Default Archive and Retention Policy" was not being automatically applied to archive-enabled mailboxes. Admins could manually apply the policy, but they wanted it applied automatically when the mailbox is enabled for an in-place archive or Exchange Online Archiving.

It turns out that the only retention policy that will be automatically applied is one named "Default MRM Policy". That name is hard-coded into the product, so if you delete it all you need to do is recreate it with that same name to make it the default policy. There is no property for that policy that makes it the default. It's just the name.

Here's some of the back story. Exchange 2007 introduced Managed Folders, which was an early form of retention management, but it was rather clumsy to work with. Exchange 2010 SP1 and later uses message records management (MRM) policies and policy tags. MRM policies are collections of policy tags that tell Exchange server how manage mail data. Some tags apply by default, such as the "Default 2 year move to archive" tag. Others are personal tags that users can chose to apply to one or more mail items, or entire folders, such as "1 Year Delete". Exchange setup creates the "Default MRM Policy" which includes a default set of policy tags.

The Default MRM Policy does not actually apply to any mailboxes by default, unless the the mailbox is given an archive mailbox. At that time, Exchange looks for an MRM policy named, "Default MRM Policy" and automatically applies it to the mailbox. If the Default MRM Policy does not exist, no retention policy is applied.

If you want to apply a different MRM policy you need to manually update the retention policy in the EAC (Mailbox User > Mailbox Features < Retention Policy - see above) or from EMS:

Set-Mailbox <username> -RetentionPolicy "Sales Dept MRM Policy"

For hybrid customers and those using Exchange Online Archiving, you manage MRM policies for on-prem mailboxes on-prem. The policy settings for these mailboxes will sync to Exchange Online with the DirSync process and will be applied to the online archive mailbox.

If a user mailbox and archive mailbox are both in the cloud, you will apply the cloud version of the Default MRM Policy in Office 365. Here, you should configure the Office 365 version of the Default MRM Policy to match the same settings as on-prem.

Read more ...

Enabling Kerberos Authentication in a Mixed Exchange 2013 / 2016 Environment

Recently, the Exchange Team published an article, "Exchange 2016 Coexistence with Kerberos Authentication" explaining how to enable Kerberos authentication in a mixed environment. Using Kerberos authentication for Exchange is a best practice and is part of the preferred architecture.

The Kerberos article above gives all the details of how to create the alternate service account (ASA) account and necessary SPNs in Active Directory, as well as how to configure Exchange to use Kerberos.

Once the ASA account is configured on the first Exchange server (2013 or 2016) using the RollAlternateServiceAccountPassword.ps1 script, you run the same script on your other 2013 and 2016 servers to copy the ASA account and password to those servers. We are told to use the 2013 version of the script to deploy across all Exchange servers, even 2016.

However, if you run the Exchange 2013 version of the script from Exchange 2013 targeting an Exchange 2016 server, you will get an error as shown below:

It appears that the Exchange 2013 script invokes a remote PowerShell call to the Exchange 2016 server because we can see a warning that the Get-ClientAccessServer cmdlet is being deprecated. Exchange 2013 would not know this. The script then fails due to a serialization error.

The fix is to copy the 2013 version of the RollAlternateServiceAccountPassword.ps1 script to your Exchange 2016 servers and run it from there. You will see several warnings that the Get-ClientAccessServer cmdlet is being deprecated, but the script will complete successfully.

Another gotcha in the article, Configuring Kerberos authentication for load-balanced Client Access servers is in the step to Enable Kerberos authentication for Outlook clients. This step instructs you to enable Kerberos for the MAPI virtual directory using the following command:

Get-MapiVirtualDirectory -Server CAS-1 | Set-MapiVirtualDirectory -IISAuthenticationMethods Ntlm, Negotiate

If you are a hybrid customer or have configured OAuth for any other reason, the command above will remove OAuth as an authentication method for IIS. A better way of doing this would be to use the following two commands:

$server = Get-MapiVirtualDirectory –Server CAS-1
$server | Set-MapiVirtualDirectory -IISAuthenticationMethods ($server.IISAuthenticationMethods += "Negotiate")

This will add Negotiate (Kerberos) to the existing IIS authentication methods if it does not already exist.

Read more ...

Set-AutodiscoverSCP.ps1 script is now on the TechNet Gallery

UPDATE: This script has been significantly updated and enhanced. Please read New Set-AutodiscoverSCP v2 script is on the TechNet Gallery

How many times have you installed a new Exchange 2010-2016 server only to hear users complain about a security pop-up in Outlook referencing the new server?

This happens because Exchange setup uses the FQDN of the server as the service connection point (SCP) that Outlook clients use for autodiscover requests (for example, https://exch03.contoso.local/autodiscover/autodiscover.xml). This new SCP is configured when the Front-End Client Access role or components are installed during setup. In most load balanced environments the valid SCP should be something like https://autodiscover.contoso.com/autodiscover/autodiscover.xml. Outlook will prompt users with a security warning because the server FQDN is not on the Exchange certificate and it is not trusted.

 

Older versions of Outlook (~Outlook 2010 RTM and earlier) used to use the oldest SCP value in the AD site, but newer versions use the newest SCP for foreground and background Autodiscover requests, causing these errors.

I wrote a script, Set-AutodiscoverSCP.ps1 (available in the TechNet Gallery), that automatically updates the SCP for the server your specify to the value you provide as soon as the new SCP for that server is detected in AD. It will continually poll Active Directory until it finds the new SCP value and sets it to the one you specify. A progress bar indicates that the script is polling AD.

The script is intended to run on another Exchange server in the org running the same version of Exchange as the new server. This is because Exchange 2010 cannot update SCP values for Exchange 2013 or 2016, and vice versa. You can also have the script target a particular domain controller. This is useful when the new server you are installing is in a different AD site.

The syntax for Set-AutodiscoverSCP.ps1 is:

Set-AutodiscoverSCP.ps1 [-Server] <String> [-NewSCP] <String> [[-DomainController] <String>] [<CommonParameters>]

Two examples of usage:

PS C:\>Set-AutodiscoverSCP.ps1 -Server exch01 -NewSCP https://autodiscover.contoso.com/autodiscover/autodiscover.xml

Example #1 continually queries the local Active Directory domain until it finds an SCP for server EXCH01 and then sets that SCP to https://autodiscover.contoso.com/autodiscover/autodiscover.xml.

PS C:\>Set-AutodiscoverSCP.ps1 -Server exch01.contoso.local -NewSCP https://autodiscover.contoso.com/autodiscover/autodiscover.xml -DomainController dc03.contoso.local

Example #2 is almost the same as the command in the previous example, except it continually queries DC03.CONTOSO.LOCAL for the SCP record and configures it on that domain controller. This is useful when configuring the SCP for a new Exchange server in a different Active Directory site.

I’ve included error handling for the following conditions:

1. The script notifies you what version of Exchange is running the script and warns you to make sure the new server is running the same version. Note that Exchange 2013/2016 servers can update each other. This warning really only applies to Exchange 2010 and Exchange 2013/2016 coexistence. 
2. The script checks that the server you want to configure is pingable. If the server cannot be pinged, the script will terminate.
3. If a domain controller is specified, it validates that the DC specified is actually a domain controller

Set-AutodiscoverSCP.ps1 is a useful addition to your Exchange toolbox. Please let me know if you have any questions or feature requests. I'll update the script on the TechNet Gallery as needed.

Read more ...

Second Edition of Office 365 for Exchange Professionals

I am very pleased to announce that the second edition of Office 365 for Exchange Professionals will be released next week at the IT/Dev Connections conference in Las Vegas, where all four of us will be speaking.

This self-published eBook is the most comprehensive publication available of all things Office 365. Over 150 pages of new content has been added since the first release at Microsoft Ignite in May 2015. The book covers new features and capabilities of Microsoft's cloud offering from an Exchange professional's perspective. You will learn how to take advantage of all the cloud has to offer in this comprehensive but surprisingly easy to read book.

The MVP co-authors are Tony Redmond, Michael Van Horenbeeck, and Paul Cunningham. Once again I provide my services as technical editor for this 770+ page book. Together, we bring over 60 years' experience in the IT and messaging industry. We have spent many hours exploring and understanding, participating in technical preview programs, and developing best practices in order to update this second edition with brand new content.

You can preorder Office 365 for Exchange Professionals from Paul Cunningham's ExchangeServerPro.com website or for your Kindle on Amazon.

If you are attending the IT/Dev Connections conference please join us for our second edition book launch party hosted by Binary Tree.

Read more ...

Fix for MSExchange Unified Messaging Event ID 1423 "A TLS API failure occurred. Error = 0x80090331"

I was working with a customer who is implementing Unified Messaging in an Exchange 2013 CU7 environment with Lync 2013. All Exchange servers are running on Windows Server 2012 R2. Exchange UM was configured properly, including setting the Unified Messaging Call Router and Unified Messaging services to "Dual" and configuring valid SSL certs for both UM services. The dial plans and Auto Attendants were created and they started to test.

Calls made to the UM enabled user would go to voicemail, the greeting would play, and the caller could record a voicemail, but the voicemail would not be delivered to the UM user's mailbox. We turned up UM logging using the following cmdlet:

Get-EventLogLevel "msexchange unified*" | Set-EventLogLevel -Level Expert

Another voicemail test showed the following MSExchange Unified Messaging event ID 1423 - A TLS API failure occurred. Error = 0x80090331.



A quick look in the %ExchangeInstallPath%\UnifiedMessaging\voicemail folder on the mailbox server hosting the UM user's mailbox showed all the voicemail WAV files queued for delivery.

I'm familiar with error code 0x80090301 on this event ID, which is caused by too many root certificates in the Trusted Root Certification Authorities store, but this code and error sting is different. 0x8009331 means, "SEC_E_ALGORITHM_MISMATCH - The client and server cannot communicate, because they do not possess a common algorithm." Definitely sounds like a TLS negotiation problem.

After double-checking the UM configuration and the SSL certificate configuration used by the UM services it was found that TLS 1.0 was disabled for clients on the Exchange 2013 servers. The registry key HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\DisabledByDefault was set to 1. This key doesn't exist by default and was not being configured via GPO, so it must have been configured in their server build. Setting the value to 0 (or deleting the DisabledByDefault key) fixed the problem.

The problem occurred because the UM server acts as both a client and a server to itself. The UM service acts as a client when it reads the voicemail WAV files from the voicemail folder and uses TLS to do so.

Note that there were several improvements to TLS and SSL in Exchange 2013 CU8 and Exchange 2010 SP3 RU9. These versions support TLS 1.1 and 1.2, which should also work. Please read Scott Landry's excellent article, Exchange TLS & SSL Best Practices, for more information.

Read more ...

Exchange 2013 Migration Batch Completes Successfully, But Mailbox is Not Moved

Here's another weird one. I'm testing a mailbox move from Exchange 2013 to Exchange 2016 (beta) for a mailbox with an in-place archive. I can create a new migration batch for the user and it completes in short order, but the mailbox and archive are not moved. The number of Total, Synced, Failed, and Successful mailboxes for the batch is zero. I get a notification email saying the batch completed successfully, but no mailboxes were moved or synced.

"Successful" Migration Batch Notification

When I look at the details of the migration batch in EMS I see that the ValidationWarningCount is 1 and the ValidationWarnings show, "Error:The user already exists, but the migration batch that includes it couldn't be found. Before you try migrating the user within a batch again, please remove the existing user by running the Remove-MigrationUser cmdlet."

Migration Batch Validation Warnings

Whoever wrote that error message deserves a raise. MUCH better than the "Error code 2" I'm used to getting.

A "MigrationUser" object is created for each user who is in the process of being migrated or the migration has not been completed, so it remains in a syncing state. I ran the Get-MigrationUser cmdlet which revealed that the mailbox was indeed "stuck" in a migration since 7/20/2013(!!) with no other issues.

This mailbox has been "migrating" for over two years!

So, I removed the migration user using the Remove-MigrationUser cmdlet. I needed to use the -Force parameter since the move request no longer exists.

Remove-MigrationUser clears the way to re-run the migration

This fixed the problem and I was able to move the mailbox and archive successfully. This condition would prevent a mailbox from moving to any other database or Office 365. It's strange that Exchange doesn't detect this when the batch request is created.

Read more ...

Either way, it's OWA

<rant>

Way to kill off a well-known brand. According to this article on the Office Blog, Microsoft marketing has decided to rename the well known Outlook Web App (OWA) to Outlook on the web (Ootw). Note the small "w" in web - don't want to be accused of making the web a Microsoft brand. Ootw just rolls off the tongue, doesn’t it? Apparently Microsoft marketing gets paid by the consonant.

According to Scott Davis at Microsoft:

"The goal here is to simplify the branding and providing consistency across platforms. The brand is really just ‘Outlook’ – ‘on the web’ is simply a descriptor to help users understand which Outlook we are referring to. For example, we also have Outlook on iOS, Android and soon, Windows 10 Mobile. If you look in the App Store/Google Play, these apps are simply branded “Outlook”. In our marketing or help content, we may say Outlook on iOS, Outlook on Android, Outlook on the web, etc. But in each case, the brand is just Outlook. Most importantly, users in all cases will just see the Outlook brand when they are using the products."

With Outlook now being called just “Outlook” on Windows, iOS, Android, Windows modern app for Windows 10 (coming soon), look forward to many fun-filled support calls that go like this: “Are you running Outlook, Outlook, or Outlook?” “No, I’m running OUTLOOK.”

Utter #FAIL

</rant>

Read more ...

Fix for Server Manager Error: "Online - Cannot get performance counter data"

One of the interesting things about having a home lab is you get to break things in ways that no one thought possible. I'll give a nickle to the next person who has this happen to them.

I have three Exchange servers running Windows Server 2012 R2. Performance counters have been started on all three servers (see https://technet.microsoft.com/en-us/library/hh831394.aspx). One server had two IP addresses configured for one NIC so I could do some testing. When I removed the second IP address from the single NIC and restarted the server Server Manager complained that it could not refresh that server.

When I clicked Manageability in Server Manager it showed "Online - Cannot get performance counter data." Re-adding the secondary IP and restarting the server doesn't help.

Lots of troubleshooting later (involving Perfmon, Bing-fu, and swearing) I discovered the following fix:

1. Open an elevated CMD prompt to C:\Windows
2. Run lodctr /R to rebuild the perf registry strings and info from scratch based on the current registry settings and backup INI files. If this works, you're done. In my case, it resulted with the error, "Error: Unable to rebuild performance counter setting from system backup store, error code is 2." Very helpful. :-|
3. Change to the C:\Windows\SysWOW64 folder and run lodctr /R again. This time I got "Info: Successfully rebuilt performance counter setting from system backup store"
4. Run winmgmt /resyncperf to register the system performance libraries with WMI and then refresh Server Manager to see that the problem is resolved.

One of the reasons I run this blog is to maintain a memory of esoteric things like this. I doubt I'll ever see it again.

Read more ...

EXPTA Gen6 Home Lab Server Builds and Parts Lists

Build your own blistering fast Windows Hyper-V lab server starting at $900!

UPDATE: My new Gen7 server builds are out, where you can build a 64GB server with the latest 6th Generation Intel processor for $920!!! The latest EXPTA server builds are always available at http://www.expta.com/server.

I'm very pleased to provide you my latest EXPTA Gen6 home lab server builds. Advances in hardware and virtualization technology have made it possible for IT Pros to build sophisticated systems that host more VMs than ever before. My Home Lab Server Survey results show that while there's still tremendous interest in 32GB entry-level servers at around $1,000, there's also a lot of interest in 64GB servers at the $1,700 price point.

Based on these survey results and for the fist time ever, I'm providing three different server builds:

• Intel Core i5 quad-core, 32GB RAM, SSD, small form-factor for $900. I can finally break the $1,000 barrier without sacrificing quality! This makes it super-easy for IT Pros to build a blistering fast Windows Hyper-V server that can run many VMs.
• Intel Core i7 hex-core, 64GB RAM, SSD, ATX form-factor for $1,725. This build is geared toward those who want double the VM density and outstanding performance.
• Intel Xeon E5 hex-core, 64GB RAM, SSD, ATX form-factor for $1,835. This build uses true server hardware for the ultimate in reliability and scalability.

Each of the three server builds use components from the vendors' hardware compatibility lists to ensure the utmost in reliability. They will all run Windows Server 2012 R2 and should be "future-proof" to run the upcoming Windows Server 2016 release.

Each build uses the same storage format -- a 256GB SSD for the OS, a 500GB or 1TB SSD for regularly running high performance VMs, and a 1TB traditional hard drive for storing ISOs, software applications, and base images. Each server utilizes SATA III 6Gb/s drives and USB 3.0 ports for the fastest I/O performance.

Most survey respondents indicated that they did not need step-by-step installation guides. If you do need help, look back at my previous Gen4 and Gen5 server build articles for assistance.

As usual, I link to Amazon for components and prices. Amazon does a very good job of maintaining stock, has an excellent return policy, and most of these items are eligible for free two-day shipping via Amazon Prime. If you don't have Prime, you can sign up for a free trial here and cancel after you order the equipment if you want. Please note that it's normal for Amazon prices to fluctuate (usually down) over time.

Build #1 -- Intel Core i5 Quad-Core, 32GB RAM, SSD, Small Form-Factor, 191W for Around $900

Component	Description
	Intel Core i5-4690S Processor 3.9GHz Quad Core LGA 1150 - BX80646I54690S This is a 4th generation Intel Haswell-Refresh processor and includes Intel HD Graphics 4600, so no discrete video card is required. Runs at 3.9 GHz, but requires only 65W! Includes Intel aluminum heat sync and silent fan. 3 year limited warranty.
	Patriot Viper 3 Series Venom Red DDR3 16GB 1600MHz (PC3 12800) Memory Kit PV316G160C9KRD You'll need two of these. 1.5V 240-pin dual channel 1600MHz DDR3 SDRAM with built-in heat spreaders. Low 9-9-9-24 Cas latency. Great RAM at a great price. Each package contains 2x 8GB DIMMs (16GB). Lifetime warranty.
	Gigabyte Intel Z97 LGA 1150 Micro ATX Motherboard GA-Z97M-DS3H I chose this LGA 1150 Micro ATX motherboard because it supports up to 32GB RAM and has 6x SATA III 6Gb/s and 2x SATA 3Gb/s connectors. It uses the Intel Z97 Express chipset, has 1 x PCI Express x16 slot running at x16; 2 x PCI Express x1 slots, HDMI/DVI/VGA outputs, USB 3.0 and 2.0 ports, and a Realtek 8111F-VL LAN chip (not Intel, yay! See below). It also has a great UEFI BIOS. 3 year limited warranty.
	Samsung 850 EVO 250GB 2.5-Inch SATA III Internal SSD (MZ-75E250B/AM) 256GB SATA III 6Gb/s SSD used for the Windows Server operating system. Legendary Samsung quality. Delivers up to 100,000 IOPS 4KB random read / 90,000 IOPS 4KB random write speed. 3 year warranty.
	Samsung 850 EVO 500GB 2.5-Inch SATA III Internal SSD (MZ-75E500B/AM) 500GB SATA III 6Gb/s SSD used for active VMs (the VMs I normally have running, like a Domain Controller, Exchange servers, Lync servers, etc.). Enabling Windows Server disk deduplication provides even more storage capacity! Delivers up to 98K IOPS 4KB random read / 90K IOPS 4KB random write speed. Mwahaha!! 3 year limited warranty.
	WD Blue 1 TB Desktop Hard Drive: 3.5 Inch, 7200 RPM, SATA 6 Gb/s, 64 MB Cache - WD10EZEX Best selling 1TB Western Digital Caviar Blue SATA III 6Gb/s drive. Used for storing ISOs, seldom used VMs, base images, etc. I usually configure this drive to sleep after 10 minutes to save even more power. 2 year warranty.
	Samsung SH-224DB/RSBS 24X SATA DVD±RW Internal Drive Great quality 24x ±RW DVD burner. It's cheap, too. Even though it's SATA2, I connect this to one of the SATA3 ports on the motherboard for no particular reason. 1 year limited warranty.
	Sentey SS1-2423 Slim Micro ATX Computer Case Sleek Micro ATX case with full color LCD display and removable drive bay cage for easy access. 1x external 5.25" drive bay and 2x internal 3.5" drive bays. Includes front USB 3.0 and 2.0 and audio ports. Great build quality and cable management. 3 year limited warranty.
	FSP Group Mini ITX / Micro ATX / SFX 300W 80 Plus Certification Power Supply (FSP300-60GH) 300 Watt Micro ATX PSU with super quiet 80mm cooling fan system. 80 Plus Certified to reduce power consumption.
	StarTech 6in 4 Pin Molex to SATA Power Cable Adapter (SATAPOWADAP) The FSP 300W power supply has three SATA power connectors for drives, which is one short of what we need. Use this adapter to convert one of the two Molex power connectors to SATA.
	SABRENT 3.5-Inch to SSD / 2.5-Inch HDD Bay Drives Converter (BK-HDDH) Steel mounting bracket for 2.5" SSD drives. One mounting kit holds up to two SSD drives, stacked on top of each other.
	C&E CNE11445 SATA Data Cable (2pk.) We need 4x SATA cables for this build. The Gigabyte motherboard comes with two SATA cables, so we need two more. Flat (not L shaped) connectors work best for this build. FYI there's no technical difference between SATA2 and SATA3 cables.

Build #1 is pretty straight forward. Make sure you have everything you need and enough space to work. Most builds take about an hour and always seem to go smoother with a cold refreshing adult beverage nearby. Assemble the drive cage first, then install the PSU, motherboard, CPU and RAM to button it up. I always update the BIOS from the Internet before installing the OS. The Gigabyte BIOS allows you to do this directly from the BIOS. Nice! Once you install the OS, install and/or upgrade the drivers (especially the NIC) from the manufacturers' websites. Then install the Hyper-V role and you're off to the races!

You can host quite a few VMs on this system. As an example, my Gen5 32GB version of this server runs Windows Server 2012 R2 with the Exchange 2013 Edge Transport role and Hyper-V. This server has been running 24x7 for over a year with the following VMs:

• 1x Domain Controller (2GB dynamic RAM)
• 2x Exchange 2013 servers (4-6GB each)
• 1x Lync 2013 server (4GB)
• 1x Exchange 2010 server (4GB)
• 1x Application server (2GB)

I run these VMs off the 500GB SSD with Windows Server 2012 R2 disk deduplication enabled for Virtual Desktop Infrastructure (VDI). This allows me to put 669GB of data on this 500GB drive and I still have 145GB free space! See Windows Server 2012 Deduplication is Amazing! for information about configuring this.

Build #2 -- Intel Core i7 Hex-Core, 64GB RAM (8x8), SSD, ATX Form-Factor,  321W for Around $1,720

Component	Description
	Intel Core i7-5820K Processor 3.3GHz 0GT/s 15MB LGA 2011-v3 CPU w/o Fan, Retail (BX80648I75820K) 6-Core 22nm Haswell-E 140W CPU with 15MB L3 Cache and 6 x 256KB L2 Cache. Absolutely screams performance. It does run a bit hot, but we have a great CPU cooler and three quiet fans in the case. 3 year limited warranty.
	Cooler Master Hyper T4 CPU Cooler with 4 Direct Contact Heatpipes RR-T4-18PK-R1 Four Direct Contact heat pipes for seamless contact between the cooler and CPU. 120mm wide range PWM fan. RPM can be fine-tuned for maximum airflow or whisper quiet operation. Snap-on fan brackets to quickly and easily install, remove, clean, or replace the fan or heat sink. Includes a syringe of thermal compound.
	Crucial 8GB Single DDR4 2133 MT/s (PC4-17000) CL15 DR x8 Unbuffered DIMM 288-Pin Desktop Memory CT8G4DFD8213 These are single UDIMMS, so you'll need 8 of them for 64GB. 1.2V 288-pin dual channel 2133 MT/s DDR4 SDRAM. Cas Latency 15. Great RAM at a fantastic price. Each package contains 1x 8GB UDIMM. 100% tested and comes with a lifetime warranty.
	ASRock ATX DDR4 Motherboard X99 EXTREME4 I chose this LGA 2011-v3 ATX motherboard because it has the Intel X99 chipset and supports up to 128GB RAM. It has 10x SATA III 6Gb/s connectors and 6x USB 3.0 Ports (4 rear, 2 via header); 8x USB 2.0 Ports (4 rear, 4 via headers). It has 3x PCI-Express 3.0 x16 Slots (one runs at x8), 1x PCI-Express 2.0 x16 Slot (runs at x4), and 1x PCI-Express 2.0 x1 Slot. It also has a great UEFI BIOS. Includes 4x SATA cables. 3 year limited warranty.
	GIGABYTE GeForce 210 Silent 1GB DDR3 DVI-I / D-Sub / HDMI Low Profile Graphics Card, GV-N210SL-1GI Unlike Core i5 CPUs, Intel Core i7 and Xeon CPUs do not feature integrated graphics. This fan-less 1GB GeForce 210 video card features DVI-I, D-Sub, and HDMI outputs. Perfect for servers.
	Samsung 850 EVO 250GB 2.5-Inch SATA III Internal SSD (MZ-75E250B/AM) 256GB SATA III 6Gb/s SSD used for the Windows Server operating system. Legendary Samsung quality. Delivers up to 100,000 IOPS 4KB random read / 90,000 IOPS 4KB random write speed. 3 year warranty.
	Samsung 850 EVO 1 TB 2.5-Inch SATA III Internal SSD (MZ-75E1T0B/AM) 1TB SATA III 6Gb/s SSD used for active VMs (the VMs I normally have running, like a Domain Controller, Exchange servers, Skype servers, etc.). Enabling Windows Server disk deduplication provides even more storage capacity! Delivers up to 98K IOPS 4KB random read / 90K IOPS 4KB random write speed. Mwahaha!! 3 year limited warranty.
	WD Blue 1 TB Desktop Hard Drive: 3.5 Inch, 7200 RPM, SATA 6 Gb/s, 64 MB Cache - WD10EZEX Best selling 1TB Western Digital Caviar Blue SATA III 6Gb/s drive. Used for storing ISOs, seldom used VMs, base images, etc. I usually configure this drive to sleep after 10 minutes to save even more power. 2 year warranty.
	Samsung SATA 1.5 Gb-s Optical Drive, Black SH-224DB/BEBE Great quality 24x ±RW DVD burner. It's cheap, too. SATA 3 is backward compatible with SATA and SATA 2.
	Rosewill Black SECC Steel USB 3.0 Mid Tower Computer Case REDBONE U3 ATX mid tower case with 1 x Front 120mm Red LED Fan, 1 x Rear 120mm Fan, and 1 x Side 120mm Fan to keep everything nice and cool. 2 x USB 3.0 Ports, 1 x e-SATA, Audio In/Out (HD) ports, and Power / Reset buttons on top. PSU shock-proof pad. Great Rosewill quality and roomy enough to take that enormous Cooler Master CPU cooler.
	Corsair CX Series 430 Watt ATX/EPS Modular 80 PLUS Bronze ATX12V/EPS12V 384 Power Supply CX430M Modular cabling system lets you use only the cables you need. Universal AC input from 90-264V. Up to 85% energy efficiency means less heat generation and lower energy bills. Super quiet. A three year warranty and lifetime access to Corsair's legendary technical support and customer service.
	SABRENT 3.5-Inch to SSD / 2.5-Inch HDD Bay Drives Converter (BK-HDDH) Steel mounting bracket for 2.5" SSD drives. One mounting kit holds up to two SSD drives, stacked on top of each other.

This Core i7 build was requested almost as much as Build #1. It offers screaming performance and doubles the RAM for double the VM capacity. As you can see, I've traded out the 500GB SSD for a 1TB SSD to use for active VMs. This was cost prohibitive just 6 months ago. FTW!

You'll also notice that this motherboard is capable of supporting 128GB of RAM, but at the current time there are no 16GB DIMMS available to support this configuration. If you really want to build a 128GB server you'll need to go with Build #3, which uses 4x16GB ECC registered DIMMs and can scale out to 8x16GB.

Important Note: Both the Intel Core i7 and Xeon E5 server builds use the ASRock X99 Extreme4 motherboard, which uses an integrated Intel 218V gigabit NIC. I love this motherboard, but unfortunately Intel cripples their NIC drivers so they cannot be used with Windows Server operating systems. I detailed how to overcome this in my Gen5 server build (look toward the end of the article), There's another very good article here that also covers it. You'll need to go through these steps to install and/or upgrade the Intel NIC drivers for Builds #2 or #3.

Build #3 -- Intel Xeon E5 Hex-Core, 64GB RAM (4x16) Expandable to 128GB, SSD, ATX Form-Factor, 272W for Around $1,835

Component	Description
	Intel Xeon E5-2609 V3 Hexa-core [6 Core] 1.90 Ghz Processor 6-Core 22nm Haswell 85W CPU with 15MB L3 Cache and 6 x 256KB L2 Cache. Terrific performance and reliability. 3 year limited warranty.
	ARCTIC Freezer i11 CPU Cooler for Intel, 150W Cooling Capacity, 3 Direct Touch Heatpipes, Vibration-Dampened Fan, 23dBA Noise Three direct touch heat pipes for fast & efficient heat dissipation. 92mm PWM fan with fluid dynamic bearing. Includes syringe of MX-4 thermal compound.
	Crucial 64GB Kit (16GBx4) DDR4 2133 (PC4-2133) DR x4 ECC Registered 288-Pin Server Memory CT4K16G4RFD4213 / CT4C16G4RFD4213 1.2V 288-pin quad channel ECC 2133 MT/s DDR4 SDRAM. Cas Latency 15. Great RAM at a fantastic price. Each package contains 4x 16GB RDIMMs. 100% tested and comes with a lifetime warranty.
	ASRock ATX DDR4 Motherboard X99 EXTREME4 I chose this LGA 2011-v3 ATX motherboard because it has the Intel X99 chipset and supports up to 128GB RAM. It has 10x SATA III 6Gb/s connectors and 6x USB 3.0 Ports (4 rear, 2 via header); 8x USB 2.0 Ports (4 rear, 4 via headers). It has 3x PCI-Express 3.0 x16 Slots (one runs at x8), 1x PCI-Express 2.0 x16 Slot (runs at x4), and 1x PCI-Express 2.0 x1 Slot. It also has a great UEFI BIOS. Includes 4x SATA cables. 3 year limited warranty.
	GIGABYTE GeForce 210 Silent 1GB DDR3 DVI-I / D-Sub / HDMI Low Profile Graphics Card, GV-N210SL-1GI Unlike Core i5 CPUs, Intel Core i7 and Xeon CPUs do not feature integrated graphics. This fan-less 1GB GeForce 210 video card features DVI-I, D-Sub, and HDMI outputs. Perfect for servers.
	Samsung 850 EVO 250GB 2.5-Inch SATA III Internal SSD (MZ-75E250B/AM) 256GB SATA III 6Gb/s SSD used for the Windows Server operating system. Legendary Samsung quality. Delivers up to 100,000 IOPS 4KB random read / 90,000 IOPS 4KB random write speed. 3 year warranty.
	Samsung 850 EVO 1 TB 2.5-Inch SATA III Internal SSD (MZ-75E1T0B/AM) 1TB SATA III 6Gb/s SSD used for active VMs (the VMs I normally have running, like a Domain Controller, Exchange servers, Skype servers, etc.). Enabling Windows Server disk deduplication provides even more storage capacity! Delivers up to 98K IOPS 4KB random read / 90K IOPS 4KB random write speed. Mwahaha!! 3 year limited warranty.
	WD Blue 1 TB Desktop Hard Drive: 3.5 Inch, 7200 RPM, SATA 6 Gb/s, 64 MB Cache - WD10EZEX Best selling 1TB Western Digital Caviar Blue SATA III 6Gb/s drive. Used for storing ISOs, seldom used VMs, base images, etc. I usually configure this drive to sleep after 10 minutes to save even more power. 2 year warranty.
	Samsung SATA 1.5 Gb-s Optical Drive, Black SH-224DB/BEBE Great quality 24x ±RW DVD burner. It's cheap, too. SATA 3 is backward compatible with SATA and SATA 2.
	Rosewill Black SECC Steel USB 3.0 Mid Tower Computer Case REDBONE U3 ATX mid tower case with 1 x Front 120mm Red LED Fan, 1 x Rear 120mm Fan, and 1 x Side 120mm Fan to keep everything nice and cool. 2 x USB 3.0 Ports, 1 x e-SATA, Audio In/Out (HD) ports, and Power / Reset buttons on top. PSU shock-proof pad. Great Rosewill quality and roomy enough to take that enormous ARCTIC Freezer CPU cooler.
	Corsair CX Series 430 Watt ATX/EPS Modular 80 PLUS Bronze ATX12V/EPS12V 384 Power Supply CX430M Modular cabling system lets you use only the cables you need. Universal AC input from 90-264V. Up to 85% energy efficiency means less heat generation and lower energy bills. Super quiet. A three year warranty and lifetime access to Corsair's legendary technical support and customer service.
	SABRENT 3.5-Inch to SSD / 2.5-Inch HDD Bay Drives Converter (BK-HDDH) Steel mounting bracket for 2.5" SSD drives. One mounting kit holds up to two SSD drives, stacked on top of each other.

Build #3 delivers the ultimate in scalability and reliability. Since this server uses registered ECC RAM it can scale out to 128GB -- just buy two of the Crucial 4x16GB memory kits. Like Build #2, this server utilizes a 1TB drive for active VMs. With disk deduplication enabled I sincerely believe you can place all your active VMs there with no problem.

There are a number of options you can add to each of these builds. Here are some recommendations:

Server Build Options

Component	Description
	TP-LINK TG-3468 10/100/1000Mbps Gigabit PCI Express Network Adapter This PCI-e NIC will work in any of the three builds. The best practice for Hyper-V servers is to use a dedicated NIC for server management. This inexpensive option lets you do just that. You may also decide to use this NIC instead of monkeying around with the Intel 218V drivers on builds #2 and #3.
	Samsung 850 Pro 256GB 2.5-Inch SATA III Internal SSD (MZ-7KE256BW) Upgrade your 256GB SATA III 6Gb/s SSD to the 850 Pro version with 3D VNAND technology. Delivers up to 100,000 IOPS 4KB random read / 90,000 IOPS 4KB random write speed. 10 year warranty.
	Samsung 850 Pro 1 TB 2.5-Inch SATA III Internal SSD (MZ-7KE1T0BW) Upgrade your 1TB SATA III 6Gb/s SSD used for active VMs to the 850 Pro. Delivers up to 90K IOPS 4KB random read / 100K IOPS 4KB random write speed. 10 year limited warranty.
	Sabrent 74-In-1 3.5-Inch Internal Flash Media Card Reader/writer with USB Port (CR-USNT) Adds another USB 2.0 port to the front of the server. Supports 74 different types of memory cards. The 6 card reader slots include all formats of the following flash media types: M2, XD, SD/SDHC/SDXC/MMC, Micro SD/SDHC/SDXC (T-flash) CF/MD, MS
	Rosewill RDCR-11003 74-In-1 USB 3.0 3.5-Inch Internal Card Reader with USB Port (RDCR-11003) This is the same type of card reader, but includes a USB 3.0 port instead of USB 2.0 and is better quality.
	Cable Matters SuperSpeed USB 3.0 Type A Male to Female Extension Cable in Black 10 Feet I strongly recommend getting one of these. Plug the male end into the back of the server and feed the female end up to your workspace for a super-convenient USB 3.0 port where you need it.

I hope these builds give you the confidence to build your own home lab server. I'm interested to hear your experiences in the comments section below. Happy building!

Read more ...