Exchange 2010 Edge and Threat Management Gateway
http://www.cgoosen.com/2010/05/securing-exchange-2010-with-forefront-threat-management-gateway-tmg-2010-part-1-the-introduction/
2 min read
Well, I’ve run into multiple issues with this task, so I might as well write a post on how to successfully update your Exchange 2010 Edge server to Service Pack 3. In my scenario, I’m running a single server with the following services:
- Exchange 2010 SP1 Edge server
- Forefront Threat Management Gateway (TMG) 2010
- Forefront Protection for Exchange on the same server
Unhook Forefront from Exchange
Before we can begin with the Exchange Service Pack upgrade we must first disconnect the Forefront Security service from the Exchange server. If you’ve worked with Exchange long enough you might remember this, but my first experience with this was when the product was called Antigen. But I digress… The anti-virus software has hooks into Exchange (VSAPI) that prevent you from upgrade or performing certain tasks without disconnecting it from Exchange.
- Stop the Exchange and Forefront Services:
- Microsoft Forefront Server Protection Controller (this will also stop the transport service)
- Microsoft Exchange Transport
- Microsoft Forefront TMG Control (if applicable)
- System Attendant (Not applicable on Edge server)
- Information Store (Not applicable on Edge server)
- From the Forefront install directory, run the following command:FSCutility.exe /disable
- Run update…
- Run FSCutility.exe /enable
- Start all services, including the Forefront Controller which will start all the services set to “Manual”.
Order of Upgrade for Exchange 2010 SP3:
- Client Access Servers
- Hub Transport Servers
- Unified Messaging (if installed)
- Mailbox Servers
- Edge Servers (if installed)
http://support.microsoft.com/kb/929076
Install Exchange 2010 Service Pack 3
- Open Windows PowerShell as Administrator
- Navigate to the folder containing the Exchange 2010 SP3 binaries and run setup.exe.
- This will launch the Exchange 2010 SP3 install. Click Install Microsoft Exchange Server upgrade.
- After the files have been copied to the local Temp directory, the installation program will begin.
- Click Next on the Introduction window.
- Click I accept the terms in the license agreement and click Next.
- Assuming you’ve satisfied all of the prerequisites above, the Readiness Checks should all pass and you can start the Upgrade. (Then go make some coffee, because this step can take quite some time.)
- Once the update has completed, verify that there were no errors and click Finish.
After updating the Edge server, I verified that the Service Pack was installed on the Edge server, but it was not reporting as updated on all other Exchange servers in the Org and therefore not in AD. This means when we attempt to update the schema to install Exchange 2013, it fails the readiness check. I attempted to force an EdgeSync (Start-EdgeSynchronization). It completed successfully, but it did not update the server version on the internal Exchange servers.
To resolve the issues I had to recreated the Edge Subscription. To do this I did the following and it was successful.
- Create Edge Subscription file on the Edge server
- Import the Edge Subscription on a Hub server
It appears some other users experienced the same issue.