When will hybrid archive mailboxes be supported?

[pesos]

Hi all,

We have a number of Exchange 2016/Exchange Online Hybrid organizations we manage where the primary mailboxes are on-prem backed up by Veeam B&R and the archive mailboxes are in the cloud.

Veeam o365 backup isn't able to back up these archive mailboxes because it appears to be designed to look for primary mailboxes only and then add in any existing archive mailboxes as an afterthought if the primary mailbox happens to have one attached to it.

Can this design flaw be remedied so that Veeam can properly see and target cloud archive mailboxes that have an on-prem primary?

Thanks!

[Mike Resseler]

Hi John,

This feature request has been tracked already. Soon we will talk about some new things in 0365 coming (hint: Next week we seem to have a big event ). I can't however guarantee that this feature request will already make the next version but we are working hard to get all of the requests in the solution

[jshapiro]

I would like to 2nd that feature request for hybrid support. We have about 400 mailboxes. I've moved only the archive mailboxes to O365 so far. The primary mailboxes remain on prem. This works out well for us, because we can use Microsoft's datacenters to hold the larger, seldom-accessed archives while we continue to run Exchange on prem. Although we eventually plan to move the primary mailboxes over too, vertical applications (either homegrown or 3rd party) currently prevent us for fully migrating. While the hybrid mailbox config has been beneficial to us, it is nearly impossible to get archive data out at this time. So I would love it if a tool such as yours could help us out.

[Kostya]

Hi all,

Hybrid is fully supported in v1.5 BETA:
https://go.veeam.com/beta-backup-office-365

[jshapiro]

Thanks for the quick response on this. I downloaded the beta and installed it, but I'm having trouble making the connection to the on-prem Exchange. It fails one or more tests depending upon what name I input for the server and whether I enforce SSL. Here's one error:

Connecting to remote server failed with the following error message: The WinRM client cannot process the request.

The authentication mechanism requested by the client is not supported by the server or unencrypted traffic is disabled in the service configuration. Verify the unencrypted traffic setting in the service configuration or specify one of the authentication mechanisms supported by the server. To use Kerberos, specify the computer name as the remote destination.......

[it is a rather wordy alert box that I cannot try to fully reproduce]

Any suggestions on what I can do?

[frankive]

will it be possible to upgrade the beta to GA?

[jmmarton]

No.

[Mike Resseler]

@Frankive Beta will indeed not be upgradeable to GA. (I think that is what Joe answered ). We are looking however for a way so you can keep the already downloaded data (but certainly not a promise...)

[Mike Resseler]

@jshapiro

Are you using the EWS connection to your on-prem organization? If you are, please start by using SSL, and then select the 3 checkboxes (skip...). If you have again an error, it probably means that the configuration of your exchange does not support that a 3rd party tool connects to EWS.
If not, please let us know so we can investigate logs further

Thanks
Mike

[jshapiro]

When I enable SSL and check the 3 boxes, I get the following alerts if I use the public DNS name for my Exchange Server:

For Connect to EWS: Success
For Connect to PowerShell: Connecting to remote server [servername] failed with the following error message: The WinRM client cannot process the request. The authentication mechanism requested by the client is not supported by the server or unencrypted traffic is disabled in the services configuration......

[Mike Resseler]

Jonathan,

Did you ran I ran enable-PsRemoting powershell command on the exchange server that you are connecting to?
What authentication mechanisms do you have enabled on that server?

[jshapiro]

I just re-ran enable-PSRemoting, and it had been enabled already, and things didn't improve.

When you say what authentication mechanisms, could you clarify what you want me to check? Is it a connector?

[Mike Resseler]

I believe you have to enable Basic authentication on the virtual folder in IIS
Also, in what format are you logging on? user@domainname.extension?

[jshapiro]

I was inputting credential: domain\username

For IIS, could your clarify which folder to enable basic authentication? Is it the server, Default Site, EWS, etc.?

[jshapiro]

I assumed you meant basic authentication for the Powershell folder. I enabled that, and I had more success. Now a whole bunch more verifications occurred, and I see that I must configure impersonation for the on prem account and it also is warning that Throttling policy is not configured.

[Mike Resseler]

Yes. The PowerShell virtual folder.

Are you getting different notifications now?

[jshapiro]

I got impersonation fixed up. Once I did that and reran the config, all tests passed including throttling policy.

[Mike Resseler]

Awesome!

Could you write-up for others what exactly you enabled / changed to get it working? You certainly will helping others also

Thanks
Mike

[jshapiro]

I will, but I have another problem now that I've completed the hybrid configuration. When I try to back up all mailboxes, I get the following job error:

A parameter cannot be found that matches parameter name 'PublicFolder.'

If I try to browse for selected mailboxes to include in a job:

I get an alert with the same message.

When I just had Office 365 setup as my organization, I could run a full back up job or browse successfully for cloud mailboxes.

[Mike Resseler]

OK. Now it is time to get our engineers involved

Could you copy all the logs into a zip file. The log files can be found here:

Code: Select all

C:\ProgramData\Veeam\Backup365\Logs

Upload them on your favorite cloud storage (Dropbox, OneDrive...) and PM me a link

Thanks
Mike

[jshapiro]

I PM'd you access to our company FTP server where I posted the logs. Meantime, here's a write-up on what I did to complete the hybrid connection.

1. From IIS Admin on my Exchange server, I selected the PowerShell Virtual Folder and I enabled Basic Authentication.
2. On my on-prem Exchange Server, I enabled application impersonation for the account being used. I did this via PowerShell:

New-ManagementRoleAssignment -Name:ApplicationImpersonation -Role:ApplicationImpersonation -User: '[AccountName]'

Previously, I had enabled impersonation in Office 365 for the Office 365 Admin Account using the Office 365 Portal (although Powershell could be used too):

After logging in to the portal, Select the Exchange Admin Center.
Select Permissions.
Double-click Discovery Management
Add ApplicationImpersonation to the role.
Then added the Office 365 Mgmt Account.

[Mike Resseler]

Hi Jonathan,

Sorry, I missed this message yesterday evening. I have sent the data to the engineers now. When they are ready downloading the logs I will let you know so you can remove the access. I will also keep you posted about their investigation

Thanks
Mike

[Kostya]

I will, but I have another problem now that I've completed the hybrid configuration. When I try to back up all mailboxes, I get the following job error:
A parameter cannot be found that matches parameter name 'PublicFolder.'
If I try to browse for selected mailboxes to include in a job:
I get an alert with the same message.

Hi Jonathan,

It seems like you are using Exchange 2010 in your Hybrid environment? Is that correct?
If so, there is a known issue related to Public Folders and Exchange 2010.

[jshapiro]

Sorry it took a few days to get back to you. Yes, I'm using Exchange 2010.

[jshapiro]

So can we work around this Exchange 2010 issue, or am I doomed at this point?

[Mike Resseler]

Jonathan,

At this point Exchange 2010 is not supported. I can't say if it will be by GA time at this moment. There is quite a difference between 2010 and starting from 2013/ 2016

[Mike Resseler]

Jonathan,

If you can test further now without public folders on Exchange 2010, then we will be able to give you a cumulative update a bit further down the road to fix the problem (it will need some time). Our engineers have created some fixes and now Exchange 2010 public folders also works.

Let me know
Mike

[jshapiro]

I am actually not that concerned about public folders right now. The problem is that I cannot enumerate any mailboxes without the public folder error.

[Mike Resseler]

OK, let me try to find out what we can do

[SBarrett847]

I assumed you meant basic authentication for the Powershell folder. I enabled that, and I had more success. Now a whole bunch more verifications occurred, and I see that I must configure impersonation for the on prem account and it also is warning that Throttling policy is not configured.

I don't believe it! I spent a week trying to get this to work until I saw this!! Can't thank you enough!

Just for info the error I received when adding a Clients On-site Exchange was "The WinRM service cannot process the request because the request needs to be sent to a different machine"