Microsoft Exchange Server Public Folder DAV-based Administration Tool

Import

The Import option lets you import several types of files.

• PFAdmin-style imports using theSETACLcommand, such as that generated by OutlookFolders or PFInfo (or PFDAVAdmin). Users can be specified by display name or by legacyExchangeDN. These files can also be imported by using PFAdmin 1.3.

  Note

  When you import SETACL commands, remember that the PFAdmin format uses either the display name or legacyExchangeDN to specify the user. During the import, PFDAVAdmin must resolve the name or domain name to an SID. If you have more than one mail-enabled object that has the same display name, PFDAVAdmin cannot apply permissions for that user. This situation will be reported as an ambiguous name in the import log.

• PFAdmin-style imports using the SETREPLICA command, such as replica exports generated by PFDAVAdmin. These files can also be imported by using PFAdmin 1.3.

• PFDAVAdmin permissions exports in NT Account name (Domain\User) format

• PFDAVAdmin permissions exports in XML format

The following excerpt from the PFAdmin syntax help explains the SETACL command format. Note that PFDAVAdmin ignores the trailing YES or NO. In exports, PFDAVAdmin adds the trailing NO for compatibility with PFAdmin.

Input file format:
    SETACL <tab> Folder <tab> User <tab> Rights[ <tab> User <tab> Rights]...
                                                          [ <tab> YES|NO]

    Folder  = public folder name
    User    = user account to set rights for
    Rights  = rights to set for the user
              Rights by Role:
                 Owner (O), PublishingEditor (PE), Editor (E),
                 PublishingAuthor (PA), NoneditingAuthor (NA),
                 Author (A), Reviewer (R), Contributor (C), None (0)
              Specific Rights:
                 Read (r), Write (w), WriteOwn (wo), Create (c),
                 CreateSubfolder (cs), Delete (d), DeleteOwn (do),
                 _Owner (o), Contact (t), Visible (v)
              Other Rights Specifications:
                 All (L) - same as Owner|Contact
                 Remove (X) - deletes existing entry for the user
    YES|NO  = apply changes to subfolders?

When you import SETREPLICA commands, PFDAVAdmin must resolve the server name to the legacyExchangeDN of the public store for that server object in Active Directory. The PFAdmin format lets you specify SITE\SERVER or just SERVER in the import. PFDAVAdmin ignores the SITE if specified in the import. It matches the server name with an Exchange server in any administration group regardless of what is specified for SITE.

The following excerpt from the PFAdmin syntax help explains the SETREPLICAS command format. Again, PFDAVAdmin ignores the trailing YES or NO.

Input file format:
    SETREPLICAS <tab> Folder <tab> Option <tab> Server(s)
        [ <tab> Option <tab> Server(s)]...[ <tab> YES|NO]

    Folder    = public folder name
    Option    = ADD server(s) to replica list
                DELETE server(s) from replica list
                REPLACE replica list with server(s)
    Server(s) = [Site\]Server[,[Site\]Server]...
    Site      = replica site  (default = same site)
    Server    = replica server
    YES|NO    = apply changes to subfolders?  (default = YES)

Export Permissions

The Export Permissions option displays the PFDAVAdmin Export Options check box that enables you to select scope and format.

How to select the scope and format when exporting permissions

1. In the Scope area, select either All public folders or Selected folder and subfolders.

2. In the Format area, select one of the following:

   • legacyExchangeDN format is the only type of export that can be imported with a tool other than PFDAVAdmin. Use this format to generate exports that match the format of OutlookFolders or PFInfo. This format lets you import the file with PFAdmin 1.3 from the Microsoft BackOffice® Resource Kit. There is one difference from OutlookFolders or PFInfo: PFDAVAdmin specifies users by legacyExchangeDN in the export instead of by display name. This difference avoids issues with ambiguous display names when importing.

     Note

     Only public folder permissions exports can be imported with PfAdmin 1.3. You can export mailbox permissions in legacyExchangeDN format, but mailbox permissions can be imported only with PFDAVAdmin.

   • Account name format is the same as was mentioned earlier, except that users are specified as Domain\User instead of by legacyExchangeDN. Depending on what you want to do, account name format may be more useful. However, these exports can be imported only with PFDAVAdmin.

   • XML format is a file dump of the XML representation of the DACL from each folder exactly as returned by the Exchange store. Exports and imports in this format are very fast because no translation or resolution of names is required. However, imports in this format set the DACL exactly as shown in the export; all existing permissions are replaced by the snapshot of the XML in the export. The other formats append to the existing permissions instead of overwriting the entire DACL.

     Note

     The XML format is ideal for taking a snapshot of folder permissions in a particular state and being able to quickly put them back into that state. If you intend to generate an export, modify it, and then import it, XML is not a good choice. The XML is difficult to read and modify for those not familiar with it.

3. Click OK.

Export Replica Lists

The Export Replica Lists option exports the replica lists for the selected folders to a file that uses the PFAdmin SETREPLICA command format. This export always uses the REPLACE command, so that importing the file resets the replicas on the public folders to the state they were in at the time of export. You can manually modify the file (or create your own file) and use the ADD or DELETE commands, which PFDAVAdmin recognizes.

Export Properties

The Export Properties option lets you export both store properties and directory properties for a folder to a tab-delimited file. These exports are for reporting purposes only — they cannot be imported with any tool. When you select Export Properties, the PropertyExportForm dialog box is displayed as shown in the following figure.

PropertyExportForm dialog box

This list contains the same store properties as Property Editor, but there are some properties at the top that are prefixed by DS:. These properties are retrieved from the Active Directory object that corresponds to the public folder. You can add any properties that you want to the list by typing them in the space provided at the bottom and clicking Add property to list. Store properties must be specified by a property tag, such as 0x671D0102. DS properties must be entered as DS:propertyName.

To generate the export, specify an output file at the top, select any properties that you want, and then click OK. You can open the resulting tab-delimited file in Microsoft Office Excel®.

Content Report

The Content Report option is similar to Export Properties because it writes information to a tab-delimited file. However, a Content Report iterates through all the items in each folder to gather information that cannot be read from the properties of the folder itself. You can create a report for all the public folders or any single public folder and its subfolders with information such as the following:

• Folder Path   The path of the folder.

• PR_DISPLAY_NAME   The display name of the folder.

• PR_CONTENT_COUNT   The item count as shown on the folder properties.

• PR_MESSAGE_SIZE_EXTENDED   The size of the folder as shown on folder properties. Works for values both under and above 5 GBs.

• Total Number Of Items   The number of objects that PFDAVAdmin found in the folder.

• Oldest Creation Date   The oldest creation date of any item in the folder.

• Oldest Modification Date   The oldest modification date of any item in the folder.

• Newest Creation Date   The most recent creation date of any item in the folder.

• Newest Modification Date   The most recent modification date of any item in the folder.

• Largest Item Size   The largest item size in the folder.

• Total Calculated Size Of Items   The total of all individual item sizes added together.

For example, by looking at the Newest Creation Date and Newest Modification Date, you can probably determine how frequently the folder is used. If the report shows dates of many years ago, the folder may not actually be being used any longer. You may want to consider adding age limits to folders to delete contents that have not been used for years, being sure to give users a deadline to deal with the contents. Or, you may want to delete the contents or archive them to different storage if you are confident that they are no longer required.

You may also want to examine the PR_MESSAGE_SIZE and Total Calculated Size Of Items to see which folders are taking up space on your hard disks. By using Export Permissions (on the Tools menu, click Export Permissions), you can see who has the owner permissions for those folders. Then, you can contact the owner to confirm that it is OK to delete those folders.

Remember that, like every other function in PFDAVAdmin, Content Report runs only against the server that you are pointing it to. That is, folders that do not have replicas on the target server will have a blank line in the report. If you have multiple replicas of a folder that are out of sync with each other, you may see different information for a folder depending on which server you point it at. Therefore, if you suspect that your replicas are out of sync, check this by running Content Report against those servers and comparing the results. To synchronize your replicas, consider using Synchronize Hierarchy in ESM available with Exchange Server 2003 Service Pack 2 (SP2). Or, add a replica using PFDAVAdmin.

Also note that PFDAVAdmin does not report Last Access Time, because that data is unavailable through DAV. In fact, the act of using PFDAVAdmin to analyze the folder content will cause the Last Access Time (visible in ESM under the public store for each server) on that folder to update on that target store. If you plan to correlate the Last Access Time with the data from the Content Report, you must gather the Last Access Time first. Also, remember that Last Access Time is specific to each store. If you plan to use that data, you need to get it from each public store. Another possibility that the Last Access Time can be updated “unintentionally” is file level virus scanning (which was a bigger problem on Exchange 2000 servers that have the exposed drive M). When folders are scanned in that way, the Last Access time is updated at every virus scan so the Last Access Time is probably not a good indication of whether real users accessed the contents at that time.

Set Calendar Permissions

The Set Calendar Permissions option enables you to perform a bulk edit specifically to change permissions of the Calendar folder so that a single operation can modify the settings of thousands of users on a server. This is useful for changing the default permissions setting of the Calendar folder of all or many users, so that team members can view other member's calendars. Using Microsoft Office Outlook® enables changing only one user at a time, so the Set Calendar Permissions option is a good solution for this kind of task.

In addition to changing the permissions of the Calendar folder, by using this option, a bulk-change also occurs on the permissions of the FreeBusy Data folder (hidden folder) of all the users on a server. If the FreeBusy Data folder permissions were not changed, the users will not be able to access another user's calendar.

For more information about how to access another user's calendar, see Microsoft Knowledge Base article 237924, "PRB: AC: Outlook 2000 Doesn't Properly Read ACL Settings" at https://go.microsoft.com/fwlink/?linkid=3052&kbid=237924.

Custom Bulk Operation

The Custom Bulk Operation option enables you to perform a bulk edit based on user-defined filters and conditions. Although PFDAVAdmin has several bulk edit functions, this option allows for selectively performing an option on folders that match certain conditions. For example, apply foo/administrator as Owner only on the public folders created after 5/5/2006.

The user can create an LDAP-like filter so that an operation is performed on the folders that match the defined filter. Users can also create subfilters on the operation level to specify which operation will be applied to folders that match the subfilters. An example of the filter and its results is as follows:

The Set Calendar Permissions option uses the Custom Bulk Operation option by creating a set of specific filters.

Options

The Options option displays the logging options. These settings are saved to the registry at HKEY_LOCAL_MACHINE\Software\Microsoft\pfDavAdmin. It also saves the name of the Exchange server and global catalog server that you last connected to.