Deploying Microsoft Exchange

This scenario describes how to deploy Microsoft Exchange servers in Yandex.Cloud. The following Microsoft Exchange servers will be installed in ru-central1-a and ru-central1-b availability zones: two mail servers, two Active Directory servers, and two Edge Transport servers. A network load balancer is used to distribute load across servers. A separate VM with internet access in the ru-central1-c availability zone will manage all the servers.

  1. Prepare for deployment:
    1. Before you start
    2. Create a cloud network and subnets
    3. Create a script to manage a local administrator account
  2. Install and configure Active Directory on a VM:
    1. Create a VM for Active Directory
    2. Create a VM for File Share Witness
    3. Install and configure Active Directory
    4. Configure the second domain controller
  3. Install and configure Microsoft Exchange:
    1. Install Microsoft Exchange
    2. Create Microsoft Exchange servers
    3. Create a Database Availability Group
    4. Create disks for VM databases
    5. Configure the Database Availability Group
    6. Configure Client Access
  4. Configure the network load balancer
  5. Configure Accepted Domains and Email Address Policy
  6. Create and configure a VM for Edge Transport servers
    1. Configure Edge Transport servers
    2. Configure the Edge Transport server in the ru-central1-a zone
    3. Configure the Edge Transport server in the ru-central1-b zone
    4. Add Edge Transport servers to Exchange
    5. Set up a subscription on the vm-edge-a server
    6. Set up a subscription on the vm-edge-b server
  7. Delete created cloud resources if you no longer need them

Before you start

Before deploying servers, you need to sign up for Yandex.Cloud and create a billing account:

  1. Go to the management console. Then log in to Yandex.Cloud or sign up if don't already have an account.
  2. On the billing page, make sure you linked a billing account, and it has the ACTIVE or TRIAL_ACTIVE status. If you don't have a billing account, create one.

If you have an active billing account, you can create or select a folder to run your VM in from the Yandex.Cloud page.

Learn more about clouds and folders.

The cost of a Microsoft Exchange installation includes:

Create a cloud network and subnets

Create a cloud network named exchange-network with subnets in all the availability zones where your VMs will be located.

  1. Create a cloud network:

    To create a cloud network:

    1. Open the Virtual Private Cloud section in the folder where you want to create the cloud network.
    2. Click Create network.
    3. Enter the network name: exchange-network.
    4. Click Create network.

    To create a cloud network, run the command:

    $ yc vpc network create --name exchange-network
    
  2. Create three exchange-network subnets:

    To create a subnet:

    1. Open the Virtual Private Cloud section in the folder where you want to create the subnet.
    2. Click on the name of the cloud network.
    3. Click Add subnet.
    4. Fill out the form: set the subnet name to exchange-subnet-a and select the ru-central1-a availability zone from the drop-down list.
    5. Enter the subnet CIDR, which is its IP address and mask: 10.1.0.0/16. For more information about subnet IP ranges, see Cloud networks and subnets.
    6. Click Create subnet.

    Repeat these steps for two more subnets, exchange-subnet-b and exchange-subnet-c, in the ru-central1-b and ru-central1-c availability zones with the 10.2.0.0/16 and 10.3.0.0/16 CIDR, respectively.

    To create subnets, run the following commands:

    yc vpc subnet create \
      --name exchange-subnet-a \
      --zone ru-central1-a \
      --network-name exchange-network \
      --range 10.1.0.0/16
    
    yc vpc subnet create \
      --name exchange-subnet-b \
      --zone ru-central1-b \
      --network-name exchange-network \
      --range 10.2.0.0/16
    
    yc vpc subnet create \
      --name exchange-subnet-c \
      --zone ru-central1-c \
      --network-name exchange-network \
      --range 10.3.0.0/16
    

Create a script to manage a local administrator account

Create a file named setpass with a script that sets a password for the local administrator account when creating VMs via the CLI:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your password>" -AsPlainText -Force)

Your password must meet complexity requirements.

Read more about Active Directory security practices on the developer's website.

Create a VM for Active Directory

Create two virtual machines for Active Directory. These VMs don't have internet access.

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name ad-vm-a.

  3. Select availability zone ru-central1-a.

  4. Under Public images, click Select. In the window that opens, select the 2016 Datacenter image.

  5. Under Disks, enter 35 GB for the size of the boot disk.

  6. Under Computing resources:

    • Choose the platform: Intel Cascade Lake.
    • Specify the number of vCPUs and amount of RAM:
      • vCPU: 4.
      • Guaranteed vCPU share: 100%.
      • RAM: 8 GB.
  7. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-a. Under Public address, select No address.

  8. In the Access section, specify the data required to access the VM:

    • In the Password field, enter your password.
  9. Click Create VM.

Repeat this operation for the VM ad-vm-b in the ru-central1-a availability zone and connect it to the subnet exchange-subnet-b

$ yc compute instance create \
    --name ad-vm-a \
    --hostname ad-vm-a \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-a \
    --network-interface subnet-name=exchange-subnet-a,ipv4-address=10.1.0.3 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

$ yc compute instance create \
    --name ad-vm-b \
    --hostname ad-vm-b \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-b \
    --network-interface subnet-name=exchange-subnet-b,ipv4-address=10.2.0.3 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Create a VM for File Share Witness

A file server with internet access is used to configure VMs with Active Directory.

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name: fsw-vm.

  3. Select availability zone ru-central1-с.

  4. Under Public images, click Select. In the window that opens, select the 2016 Datacenter image.

  5. Under Disks, enter 35 GB for the size of the boot disk.

  6. Under Computing resources:

    • Choose the platform: Intel Cascade Lake.
    • Specify the number of vCPUs and amount of RAM:
      • vCPU: 2.
      • Guaranteed vCPU share: 100%.
      • RAM: 4 GB.
  7. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-c. Under Public address, select No address.

  8. In the Access section, specify the data required to access the VM:

    • In the Password field, enter your password.
  9. Click Create VM.

$ yc compute instance create \
    --name fsw-vm \
    --hostname fsw-vm \
    --memory 4 \
    --cores 2 \
    --zone ru-central1-c \
    --network-interface subnet-name=exchange-subnet-c,nat-ip-version=ipv4 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Install and configure Active Directory

VMs with Active Directory don't have internet access, so they should be configured from the fsw-vm VM using RDP.

  1. Connect to fsw-vm using RDP. Enter Administrator as the username and your password.

  2. On fsw-vm, start the RDP client and connect to ad-vm-a. Enter Administrator as the username and your password.

  3. On the ad-vm-a VM, launch PowerShell and set a static address:

    netsh interface ip set address "Ethernet 2" static 10.1.0.3 255.255.255.0 10.1.0.1
    
  4. Create a temporary folder:

    mkdir C:\Windows\temp
    
  5. Assign Active Directory roles:

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
    
    Success Restart Needed Exit Code      Feature Result
    ------- -------------- ---------      --------------
    True    No             Success        {Active Directory Domain Services, Group P...
    
  6. Create an Active Directory forest:

    Install-ADDSForest -DomainName 'yantoso.net' -Force:$true
    

    Windows restarts automatically. Reconnect to ad-vm-a. Enter yantoso\Administrator as the username and your password. Relaunch PowerShell.

  7. Rename the default site to ru-central1-a:

    Get-ADReplicationSite 'Default-First-Site-Name' | Rename-ADObject -NewName 'ru-central1-a'
    
  8. Create two more sites for the other availability zones:

    New-ADReplicationSite 'ru-central1-b'
    New-ADReplicationSite 'ru-central1-c'
    
  9. Create subnets and link them to the sites:

    New-ADReplicationSubnet -Name '10.1.0.0/16' -Site 'ru-central1-a'
    New-ADReplicationSubnet -Name '10.2.0.0/16' -Site 'ru-central1-b'
    New-ADReplicationSubnet -Name '10.3.0.0/16' -Site 'ru-central1-c'
    
  10. Rename the site link and configure replication:

    Get-ADReplicationSiteLink 'DEFAULTIPSITELINK' | `
        Set-ADReplicationSiteLink -SitesIncluded @{Add='ru-central1-b'} -ReplicationFrequencyInMinutes 15 -PassThru | `
        Set-ADObject -Replace @{options = $($_.options -bor 1)} -PassThru | `
        Rename-ADObject -NewName 'ru-central1'
    
  11. Set the DNS redirect server:

    Set-DnsServerForwarder '10.1.0.2'
    
  12. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,127.0.0.1"
    

Configure the second domain controller

  1. Connect to fsw-vm using RDP. Enter Administrator as the username and your password.

  2. On fsw-vm, start the RDP client and connect to ad-vm-b. Enter Administrator as the username and your password.

  3. Create a temporary folder:

    mkdir C:\Windows\temp
    
  4. Assign Active Directory roles:

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
    
    Success Restart Needed Exit Code      Feature Result
    ------- -------------- ---------      --------------
    True    No             Success        {Active Directory Domain Services, Group P...
    
  5. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,127.0.0.1"
    
  6. Configure a static IP address:

    netsh interface ip set address "Ethernet 2" static 10.2.0.3 255.255.255.0 10.2.0.1
    
  7. Add the controller to the domain:

    Install-ADDSDomainController `
        -Credential (Get-Credential "yantoso\Administrator") `
        -DomainName 'yantoso.net' `
        -Force:$true
    

    Windows restarts automatically. Reconnect to ad-vm-b. Enter yantoso\Administrator as the username and your password. Relaunch PowerShell.

  8. Set the DNS redirect server:

    Set-DnsServerForwarder '10.2.0.2'
    

Install Microsoft Exchange

  1. Connect to fsw-vm using RDP and launch PowerShell.

  2. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,10.2.0.3"
    
  3. Add the server to the domain:

    $Credentials = Get-Credential # yantoso\Administrator
    Add-Computer -DomainName yantoso.net -DomainCredential $Credentials -Force -Restart
    

    Windows restarts automatically. Reconnect to fsw-vm. Enter yantoso\Administrator as the username and your password. Relaunch PowerShell.

  4. Create a folder named distrib:

    mkdir c:\distrib
    
  5. Download the Exchange Server distribution and necessary dependencies:

    1. .NET Framework 4.7.1.
    2. Visual C++ Redistributable Package for Visual Studio 2012. Rename the downloaded file to vcredist_x64_2012.exe.
    3. Visual C++ Redistributable Package for Visual Studio 2013. Rename the downloaded file to vcredist_x64_2013.exe.
    4. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit.

    Put the distributions in the directory C:\distrib.

  6. Grant shared access from the domain to the directory containing the distributions:

    New-SmbShare -ReadAccess 'yantoso\domain users' -Path 'c:\distrib' -Name 'distrib'
    

Create Microsoft Exchange servers

Create the first Exchange server

  1. Create a VM named vm-exchange-a:

    1. On the folder page in the management console, click Create resource and select Virtual machine.

    2. In the Name field, enter the VM name vm-exchange-a.

    3. Select availability zone ru-central1-a.

    4. Under Public images, click Select. In the window that opens, select the 2016 Datacenter image.

    5. Under Disks, enter 100 GB for the size of the boot disk.

    6. Add another 250 GB SSD named db.

    7. Under Computing resources:

      • Choose the platform: Intel Cascade Lake.
      • Specify the number of vCPUs and amount of RAM:
        • vCPU: 8.
        • Guaranteed vCPU share: 100%.
        • RAM: 32 GB.
    8. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-a. Under Public address, select No address.

    9. In the Access section, specify the data required to access the VM:

      • In the Password field, enter your password.
    10. Click Create VM.

    yc compute instance create \
      --name vm-exchange-a \
      --hostname vm-exchange-a \
      --memory 32 \
      --cores 8 \
      --zone ru-central1-a \
      --network-interface subnet-name=exchange-subnet-a \
      --create-boot-disk size=100,image-folder-id=standard-images,image-family=windows-2016-gvlk \
      --create-disk type=network-nvme,size=250,auto-delete=false \
      --metadata-from-file user-data=setpass
    
  2. Connect to fsw-vm using RDP.

  3. On fsw-vm, start the RDP client and use it to connect to vm-exchange-a. Enter Administrator as the username and your password. Launch PowerShell.

  4. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3"
    
  5. Add vm-exchange-a to the domain:

    $Credentials = Get-Credential # yantoso\Administrator
    Add-Computer -DomainName yantoso.net -DomainCredential $Credentials -Force -Restart
    

    After restarting, log in to the VM as yantoso\Administrator with your password. Relaunch PowerShell.

  6. Install the downloaded dependencies in the following order:

    1. & \\fsw-vm\distrib\vcredist_x64_2012.exe /install /passive /norestart
    2. & \\fsw-vm\distrib\vcredist_x64_2013.exe /install /passive /norestart
    3. & \\fsw-vm\distrib\UcmaRuntimeSetup.exe /install /passive /norestart
    4. & \\fsw-vm\distrib\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart
  7. Restart the VM: Restart-Computer -Force.

    After restarting, log in to the VM as yantoso\Administrator with your password. Relaunch PowerShell.

  8. Install Exchange Mailbox Server on vm-exchange-a. Mount the distribution image from the shared directory with distributions:

    Mount-DiskImage \\fsw-vm\distrib\ExchangeServer2016-x64-cu13.iso
    
  9. Launch the Exchange Mailbox Server installer:

    & D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:Mailbox /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg
    Restart-Computer -Force
    

    When the installation is complete, the VM restarts automatically.

Create the second Exchange server

  1. Create a VM named vm-exchange-b:

    1. On the folder page in the management console, click Create resource and select Virtual machine.

    2. In the Name field, enter the VM name vm-exchange-b.

    3. Select availability zone ru-central1-b.

    4. Under Public images, click Select. In the window that opens, select the 2016 Datacenter image.

    5. Under Disks, enter 100 GB for the size of the boot disk.

    6. Add another 250 GB SSD named db.

    7. Under Computing resources:

      • Choose the platform: Intel Cascade Lake.
      • Specify the number of vCPUs and amount of RAM:
        • vCPU: 8.
        • Guaranteed vCPU share: 100%.
        • RAM: 32 GB.
    8. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-b. Under Public address, select No address.

    9. In the Access section, specify the data required to access the VM:

      • In the Password field, enter your password.
    10. Click Create VM.

    yc compute instance create \
      --name vm-exchange-b \
      --hostname vm-exchange-b \
      --memory 32 \
      --cores 8 \
      --zone ru-central1-b \
      --network-interface subnet-name=exchange-subnet-b \
      --create-boot-disk size=100,image-folder-id=standard-images,image-family=windows-2016-gvlk \
      --create-disk type=network-nvme,size=250,auto-delete=false \
      --metadata-from-file user-data=setpass
    
  2. Connect to fsw-vm using RDP.

  3. On the fsw-vm VM, start the RDP client and use it to connect to vm-exchange-b. Enter Administrator as the username and your password. Launch PowerShell.

  4. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3"
    
  5. Add vm-exchange-a to the domain:

    $Credentials = Get-Credential # yantoso\Administrator
    Add-Computer -DomainName yantoso.net -DomainCredential $Credentials -Force -Restart
    

    After restarting, log in to the VM as yantoso\Administrator with your password. Relaunch PowerShell.

  6. Install the downloaded dependencies in the following order:

    1. & \\fsw-vm\distrib\vcredist_x64_2012.exe /install /passive /norestart
    2. & \\fsw-vm\distrib\vcredist_x64_2013.exe /install /passive /norestart
    3. & \\fsw-vm\distrib\UcmaRuntimeSetup.exe /install /passive /norestart
    4. & \\fsw-vm\distrib\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart
  7. Restart the VM: Restart-Computer -Force.

    After restarting, log in to the VM as yantoso\Administrator with your password. Relaunch PowerShell.

  8. Install Exchange Mailbox Server on vm-exchange-b. Mount the distribution image from the shared directory with distributions:

    Mount-DiskImage \\fsw-vm\distrib\ExchangeServer2016-x64-cu13.iso
    
  9. Launch the Exchange Mailbox Server installer:

    & D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:Mailbox /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg
    Restart-Computer -Force
    

    When the installation is complete, the VM restarts automatically.

Create a Database Availability Group

A Database Availability Group ensures fault tolerance for mail servers via DB replication and automatic DB failover in the event of a crash.

  1. Connect to fsw-vm using RDP.

  2. Grant the yantoso\Exchange Trusted Subsystem group administrator privileges to the fsw-vm VM:

    Add-LocalGroupMember -Group 'Administrators' -Member 'yantoso\Exchange Trusted Subsystem'
    

Create disks for VM databases

  1. On fsw-vm, start the RDP client and use it to connect to vm-exchange-a. Enter yantoso\Administrator as the username and your password.

  2. Create an additional disk and format it:

    Get-Disk | `
        Where-Object PartitionStyle -eq raw | `
        Initialize-Disk -PartitionStyle GPT -PassThru | `
        New-Partition -DriveLetter 'Z' -UseMaximumSize | `
        Format-Volume -FileSystem NTFS -NewFileSystemLabel "mdb" -Confirm:$false -AllocationUnitSize 65536
    
  3. Install the Failover-Clustering role:

    Install-WindowsFeature -Name 'Failover-Clustering' -IncludeManagementTools
    

Repeat these commands for the vm-exchange-b VM.

Configure the Database Availability Group

  1. On fsw-vm, start the RDP client and use it to connect to vm-exchange-a. Enter yantoso\Administrator as the username and your password.

  2. Run the Exchange Management Shell.

  3. Create a Database Availability Group:

    New-DatabaseAvailabilityGroup `
        -Name ycdag `
        -WitnessServer fsw-vm `
        -DatabaseAvailabilityGroupIpAddresses 255.255.255.255
    
  4. Add the vm-exchange-a and vm-exchange-b servers to the Database Availability Group (DAG):

    Add-DatabaseAvailabilityGroupServer -Identity yadag -MailboxServer vm-exchange-a
    Add-DatabaseAvailabilityGroupServer -Identity yadag -MailboxServer vm-exchange-b
    
  5. Check the status of the servers. Both should be in the Operational Servers column:

    Get-DatabaseAvailabilityGroup -Status
    
    Name             Member Servers                                      Operational Servers
    ----             --------------                                      -------------------
    ycdag            {VM-EXCHANGE-A, VM-EXCHANGE-B}                    {VM-EXCHANGE-A, VM-EXCHANGE-B}
    
  6. Create a mail server database:

    New-MailboxDatabase -Name yamdb -EdbFilePath 'Z:\MDB\yamdb\yamdb.edb' -LogFolderPath 'Z:\MDB\yamdb\log' -Server vm-exchange-a
    
  7. Mount the database:

    Mount-Database yamdb
    
  8. Create a copy of the database on the second server:

    Add-MailboxDatabaseCopy -Identity yamdb -MailboxServer vm-exchange-b -SeedingPostponed
    Update-MailboxDatabasecopy yamdb\vm-exchange-b –CatalogOnly
    
  9. Check the DB status:

    Get-MailboxDatabaseCopyStatus -Server vm-exchange-a
    Get-MailboxDatabaseCopyStatus -Server vm-exchange-b
    

Configure Client Access

To work with various client applications, you need to create virtual directories.

  1. Set the mail domain:

    $MailDomain = "mail.yantoso.net"
    
  2. ECP:

    Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -ExternalUrl "https://$MailDomain/ecp"
    
  3. EWS:

    Get-WebServicesVirtualDirectory | Set-WebServicesVirtualDirectory -ExternalUrl "https://$MailDomain/ews/exchange.asmx"
    
  4. Active Sync:

    Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -ExternalUrl "https://$MailDomain/Microsoft-Server-ActiveSync"
    
  5. OAB:

    Get-OabVirtualDirectory | Set-OabVirtualDirectory -ExternalUrl "https://$MailDomain/OAB"
    
  6. OWA:

    Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -ExternalUrl "https://$MailDomain/owa"
    
  7. PowerShell:

    Get-PowerShellVirtualDirectory | Set-PowerShellVirtualDirectory -ExternalUrl "https://$MailDomain/powershell"
    
  8. MAPI:

    Get-MapiVirtualDirectory | Set-MapiVirtualDirectory -ExternalUrl "https://$MailDomain/mapi"
    

Configure the network load balancer

It distributes the load across Exchange servers in different availability zones.

To create a network load balancer:

  1. Open the Load Balancer section in the folder where you want to create a load balancer.
  2. Click Create load balancer.
  3. Enter a name for the network load balancer: exchange-lb.
  4. Under Listeners, select an automatic public address and click Add listener.
  5. Enter a name for the listener: yassl
  6. Set the listener port to 443 and click Add.
  7. Turn on Target groups.
  8. Enter a name for the target group: exchange-tg.
  9. Select the vm-exchange-a and vm-exchange-b VMs.
  10. Under Health check, enter a name for the health check: exchange-hc.
  11. Select the TCP check.
  12. Set the port to 443.
  13. Keep the other parameters as default.
  14. Click Create load balancer.
  1. Create a network load balancer:

    $ yc lb nlb create --name exchange-lb
    
  2. Create a target group:

    $ yc lb tg create --name exchange-tg
    
  3. Get information about the mail servers:

    $ yc compute instance get vm-exchange-a
    $ yc compute instance get vm-exchange-b
    

    Copy the VM subnet IP addresses and IDs.

  4. Add the servers to the target group:

    $ yc lb tg update --name exchange-tg \
        --target address=10.2.0.4,subnet-id=e2lkh054nic9h3nckbrs \
        --target address=10.1.0.24,subnet-id=e9bkdrnv156ctcp14p5q
    
  5. Add the listener to the network load balancer:

    $ yc lb nlb add-listener --name exchange-lb --listener name=yassl,port=443,target-port=443,external-ip-version=ipv4
    
  6. Get information about the target groups:

    $ yc lb tg list
    

    Copy the target group ID.

  7. Connect the target group to the network load balancer using the target group ID:

    $ yc lb nlb attach-target-group \
        --name exchange-lb \
        --target-group target-group-id=b7ruh2aqg7pr6ahus4an,healthcheck-name=exchange-hc,healthcheck-tcp-port=443
    

Configure Accepted Domains and Email Address Policy

A domain is created by default. If you need to change the domain, use the command:

New-AcceptedDomain -Name yantoso.net -DomainName yantoso.net

Edit the Email Address Policy:

Get-EmailAddressPolicy | Set-EmailAddressPolicy -EnabledPrimarySMTPAddressTemplate '@yantoso.net'

An alias with the @yantoso.net domain is automatically added to all the new mailboxes.

Create a VM for Edge Transport servers

Edge Transport servers handle the main user load: accept emails from the internet, filter out spam, and forward messages to the internal Exchange mail servers.

Create a VM for the vm-edge-a server

Create a VM named vm-edge-a:

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name: vm-edge-a.

  3. Select availability zone ru-central1-a.

  4. Under Public images, click Select. In the window that opens, select the 2016 Datacenter image.

  5. Under Disks, enter 50 GB for the size of the boot disk:

  6. Under Computing resources:

    • Choose the platform: Intel Cascade Lake.
    • Specify the number of vCPUs and amount of RAM:
      • vCPU: 4.
      • Guaranteed vCPU share: 100%.
      • RAM: 8 GB.
  7. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-a. Under Public address, select Automatically or choose an address from the list of reserved ones.

  8. In the Access section, specify the data required to access the VM:

    • In the Password field, enter your password.
  9. Click Create VM.

$ yc compute instance create \
    --name vm-edge-a \
    --hostname vm-edge-a \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-a \
    --network-interface subnet-name=exchange-subnet-a,nat-ip-version=ipv4 \
    --create-boot-disk size=50,image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Create a VM for the vm-edge-b server

Create a VM named vm-edge-b:

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name: vm-edge-b.

  3. Select availability zone ru-central1-b.

  4. Under Public images, click Select. In the window that opens, select the 2016 Datacenter image.

  5. Under Disks, enter 50 GB for the size of the boot disk:

  6. Under Computing resources:

    • Choose the platform: Intel Cascade Lake.
    • Specify the number of vCPUs and amount of RAM:
      • vCPU: 4.
      • Guaranteed vCPU share: 100%.
      • RAM: 8 GB.
  7. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-b. Under Public address, select Automatically or choose an address from the list of reserved ones.

  8. In the Access section, specify the data required to access the VM:

    • In the Password field, enter your password.
  9. Click Create VM.

$ yc compute instance create \
    --name vm-edge-b \
    --hostname vm-edge-b \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-b \
    --network-interface subnet-name=yasn-b,nat-ip-version=ipv4 \
    --create-boot-disk size=50,image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Configure Edge Transport servers

Configure the Edge Transport server in the ru-central1-a zone

  1. Connect to fsw-vm using RDP.

  2. Connect to vm-edge-a using RDP. Enter Administrator as the username and your password. Launch PowerShell.

  3. Create a temporary folder:

    mkdir C:\Windows\temp
    
  4. Install AD LDS roles on the server:

    Install-WindowsFeature ADLDS
    
  5. Configure the DNS client:

    Get-NetAdapter | `
        Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,10.2.0.3" 
    
  6. Configure remote access to the directory with distributions on fsw-vm:

    $Credential = Get-Credential # Username: yantoso\Administrator
    
    New-PSDrive -Name 'fsw-vm' -PSProvider:FileSystem -Root '\\fsw-vm.ru-central1.internal\distrib' -Credential $Credential
    

    Enter yantoso\Administrator as the username and your password.

  7. Install the dependencies:

    & fsw-vm:\vcredist_x64_2012.exe /install /passive /norestart
    & fsw-vm:\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart
    
  8. Copy the Microsoft Exchange distribution to the vm-edge-a server:

    copy-item fsw-vm:\ExchangeServer2016-x64-cu13.iso c:\windows\temp\ExchangeServer2016-x64-cu13.iso
    
  9. Specify the primary DNS suffix:

    $Suffix = 'ru-central1.internal'
    
    Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name Domain -Value $Suffix 
    
    Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name 'NV Domain' -Value $Suffix
    
  10. Restart the VM:

    Restart-Computer -Force
    

    Reconnect to vm-edge-a using RDP and launch PowerShell.

  11. Mount the Exchange Server distribution:

    Mount-DiskImage c:\windows\temp\ExchangeServer2016-x64-cu13.iso
    
  12. Install Edge Transport Server on the vm-edge-a server:

    & D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:EdgeTransport /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg
    

Configure the Edge Transport server in the ru-central1-b zone

  1. Connect to fsw-vm using RDP.

  2. Connect to vm-edge-b using RDP. Enter Administrator as the username and your password. Launch PowerShell.

  3. Create a temporary folder:

    mkdir C:\Windows\temp
    
  4. Install AD LDS roles on the server:

    Install-WindowsFeature ADLDS
    
  5. Configure the DNS client:

    Get-NetAdapter | `
        Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,10.1.0.3"
    
  6. Configure remote access to the directory with distributions on fsw-vm:

    $Credential = Get-Credential # Username: yantoso\Administrator
    
    New-PSDrive -Name 'fsw-vm' -PSProvider:FileSystem -Root '\\fsw-vm.ru-central1.internal\distrib' -Credential $Credential
    

    Enter yantoso\Administrator as the username and your password.

  7. Install the dependencies:

    & fsw-vm:\vcredist_x64_2012.exe /install /passive /norestart
    & fsw-vm:\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart
    
  8. Copy the Microsoft Exchange distribution to vm-edge-b:

    copy-item fsw-vm:\ExchangeServer2016-x64-cu13.iso c:\windows\temp\ExchangeServer2016-x64-cu13.iso
    
  9. Specify the primary DNS suffix:

    $Suffix = 'ru-central1.internal'
    
    Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name Domain -Value $Suffix 
    
    Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name 'NV Domain' -Value $Suffix
    
  10. Restart the VM:

    Restart-Computer -Force
    

    Reconnect to vm-edge-b using RDP and launch PowerShell.

  11. Mount the Exchange Server distribution:

    Mount-DiskImage c:\windows\temp\ExchangeServer2016-x64-cu13.iso
    
  12. Install Edge Transport Server on vm-edge-b:

    & D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:EdgeTransport /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg
    

Add Edge Transport servers to Exchange

Each Edge Transport server must subscribe to a website in its own availability zone.

Set up a subscription on vm-edge-a

  1. Create a folder named subscribe:

    mkdir c:\subscribe
    
  2. Run the Exchange Management Shell. Create a subscription file on vm-edge-a:

    New-EdgeSubscription -FileName "C:\subscribe\$(hostname).xml"
    
  3. Copy C:\subscribe\vm-edge-a.xml to the C:\root\vm-edge-a.xml directory of the vm-exchange-a server.

  4. Log in to vm-exchange-a and run the Exchange Management Shell.

  5. Subscribe the vm-edge-a Edge Transport server to the ru-central1-a website:

    New-EdgeSubscription -FileData ([byte[]]$(Get-Content -Path "C:\root\vm-edge-a.xml" -Encoding Byte -ReadCount 0)) -Site "ru-central1-a"
    
  6. Make sure that the subscription is created using the command:

    Get-EdgeSubscription
    
    Name            Site                 Domain
    ----            ----                 ------
    vm-edge-a       yantoso.net/Confi... ru-central1.internal
    
  7. Check the sync status:

    Test-EdgeSynchronization
    

    The SyncStatus value must be Normal.

Set up a subscription on the vm-edge-b server

  1. Create a folder named subscribe:

    mkdir c:\subscribe
    
  2. Run the Exchange Management Shell. Create a subscription file on the vm-edge-b server:

    New-EdgeSubscription -FileName "C:\subscribe\$(hostname).xml"
    
  3. Copy C:\subscribe\vm-edge-b.xml to the C:\root\vm-edge-b.xml directory of the vm-exchange-b server.

  4. Log in to the vm-exchange-b server and run the Exchange Management Shell.

  5. Subscribe the vm-edge-b Edge Transport server to the ru-central1-b website:

    New-EdgeSubscription -FileData ([byte[]]$(Get-Content -Path "C:\root\vm-edge-b.xml" -Encoding Byte -ReadCount 0)) -Site "ru-central1-b"
    
  6. Make sure that the subscription is created using the command:

    Get-EdgeSubscription
    
    Name            Site                 Domain
    ----            ----                 ------
    vm-edge-a       yantoso.net/Confi... ru-central1.internal
    vm-edge-b       yantoso.net/Confi... ru-central1.internal
    
  7. Check the sync status:

    Test-EdgeSynchronization
    

    The SyncStatus value must be Normal.

Delete the created resources

To stop paying for deployed servers, delete all the VMs and load balancer you created:

  • fsw-vm
  • ad-vm-a
  • ad-vm-b
  • vm-exchange-a
  • vm-exchange-b
  • vm-edge-a
  • vm-edge-b
  • load balancer exchange-lb