Using PowerShell to Notify of NTBackup failures

I recently had a need to send email notifications on a Windows 2003 server when a backup through NTBackup failed. Preferring PowerShell to VBscript, I installed PowerShell on the server, and set out to script the notification.

I decided to send a notification based on whether or not the NTBackup application has logged an error in the application event log in the past 24 hours. I chose this way because in Windows 2008 and later, there is a built-in scheduled task that can be customized to send an email based on an event ID, and I am already using this on some other servers. So it made sense to keep the same method of notification in Windows 2003.

I could have also chosen to parse through the ntbackup log and look for errors, or check for the existence of a new backup file created within the last 24 hours.

I didn't find a PowerShell version of NTBackup notification anywhere else online, and many of the VBscript versions require using blat. One advantage of the PowerShell method is that you don't have to install anything third party on the server. All you need is PowerShell.

Please note this script works only with PowerShell 2.0, and only in versions of Windows 2003 and 2003 R2. In this version of the script, I am storing the SMTP account and password in plaintext (of course I didn't put a real account in the script below!), so if this is a problem in your network, I would suggest using get-credential to pass the credential in a secure manner instead.

'Set the computer name
$computer = gc env:computername
'Set Email parameters
$EmailFrom = "[email protected]"
$EmailTo = "[email protected]"
$Subject = "Backup Failed on " + $computer
$SmtpServer = "mail.chrislehr.com"
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Credentials = New-Object System.Net.NetworkCredential("backup_service","P@ssw0rd")

'Find all NTBackup events in the event log within the last 24 hours with type error. If the count is greater than 0, send an email.
$events = get-eventlog -computer $computer -LogName application -after (get-date).addhours(-24) -EntryType error| where-object {$_.source -eq "ntbackup"}
$body = "A Backup job has failed on " + $computer + "in the past 24 hours. Please investigate"
If (($Events).count -gt 0) {$smtp.Send($emailFrom, $EmailTo, $Subject, $body)}

Virtual Directory Errors

I recently installed SP1 on an Exchange server for a client, everything appeared to go fine however after rebooting we ran into various issues with OWA, Autodiscover, ActiveSync, PowerShell and EWS. Also we were unable to launch EMC or Powershell. We were receiving the following error about the various virtual directories. We ran through all the troubleshooting that the Exchange team recommends ( http://blogs.technet.com/b/exchange/archive/2010/02/04/3409289.aspx ) however nothing resolved it. The error we were getting was:

Log Name:      Application
Source:        ASP.NET 2.0.50727.0
Date:          2/10/2012 2:05:46 PM
Event ID:      1310
Task Category: Web Event
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      computer.corp
Description:
Event code: 3008
Event message: A configuration error has occurred.
Event time: 2/10/2012 2:05:46 PM
Event time (UTC): 2/10/2012 9:05:46 PM
Event ID: 1dbea0f1695f48648c8988fb70acec0a
Event sequence: 1
Event occurrence: 1
Event detail code: 0


Application information:
    Application domain: /LM/W3SVC/1/ROOT/Autodiscover-10-129733815458960203
    Trust level: Full
    Application Virtual Path: /Autodiscover
    Application Path: D:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\Autodiscover\
    Machine name: ServerName

Process information:
    Process ID: 4600
    Process name: w3wp.exe
    Account name: NT AUTHORITY\SYSTEM

Exception information:
    Exception type: HttpException
    Exception message: Could not load file or assembly 'Microsoft.Exchange.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxx' or one of        its dependencies. The system cannot find the file specified. (D:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\Autodiscover\web.config line 855)

Request information:
    Request URL: https://computer.corp:443/Autodiscover/Autodiscover.xml
    Request path: /Autodiscover/Autodiscover.xml
    User host address: XXX.XXX.XXX.XXX
    User:
    Is authenticated: False
    Authentication Type:
    Thread account name: NT AUTHORITY\SYSTEM


Thread information:
    Thread ID: 1
    Thread account name: NT AUTHORITY\SYSTEM
    Is impersonating: False
    Stack trace:    at System.Web.Compilation.BuildManager.ReportTopLevelCompilationException()
   at System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled()
   at System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters)

After calling PSS we determined that it actually was something got botched with the SP1 install and the web.config files were not correctly pointed to the install location. So for us what was in the web config was:

 <codeBase version="14.0.0.0" href="file:///%ExchangeInstallDir%bin\Microsoft.Exchange.Sqm.dll" />

however for our install it should be:

<codeBase version="14.0.0.0" href="C:\Program Files\Microsoft\Exchange\V14\bin\Microsoft.Exchange.Sqm.dll" />

Difference in Policy Versions

I recently was working on a cross forest migration from Exchange 2010 SP1 to an environment that had Exchange 2010 RTM. Microsoft claims that it is supported however we ran into an issue with ActiveSync devices. I could not find any relevant posts or articles with this because it is always best practice to make sure that your Exchange servers are on the same version. We received the following error after migrating and attempting to configure ActiveSync:

Log Name:      Application
Source:        MSExchange ActiveSync
Date:          2/9/2012 1:39:43 PM
Event ID:      1008
Task Category: Requests
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      company.corp
Description:
An exception occurred and was handled by Exchange ActiveSync. This may have been caused by an outdated or corrupted Exchange ActiveSync device partnership. This can occur if a user tries to modify the same item from multiple computers. If this is the case, Exchange ActiveSync will re-create the partnership with the device. Items will be updated at the next synchronization.
URL=/Microsoft-Server-ActiveSync/Proxy?User=Username&DeviceId=Applxxxxxxxxx4T&DeviceType=iPhone&Cmd=Settings
--- Exception start ---
Exception type: Microsoft.Exchange.Data.Storage.InvalidSyncStateVersionException
Exception message: Sync state 'Policy' loaded from the user's mailbox has a newer version '37' than the Client Access server version '35'.  Please update the Client Access server to the latest version.
Exception level: 0
Exception stack trace:    at Microsoft.Exchange.Data.Storage.SyncState.Load(Boolean reloadFromBackend, PropertyDefinition[] additionalPropsToLoad)
   at Microsoft.Exchange.Data.Storage.CustomSyncState.GetSyncState(SyncStateStorage syncStateStorage, Folder syncStateParentFolder, SyncStateInfo syncStateInfo, StoreObjectId storeObjectId)
   at Microsoft.Exchange.Data.Storage.SyncStateStorage.GetCustomSyncState(SyncStateInfo syncStateInfo)
   at Microsoft.Exchange.AirSync.GlobalInfo.LoadFromMailbox(MailboxSession mailboxSession, SyncStateStorage syncStateStorage, ProtocolLogger protocolLogger)
   at Microsoft.Exchange.AirSync.Command.OpenSyncStorage(String deviceType, String deviceID, Boolean shouldOpenGlobalSyncState)
   at Microsoft.Exchange.AirSync.Command.WorkerThread()
--- Exception end ---.

We attempted to try and retrieve a list of any partnerships however the results were null. After a call to PSS we were told that we would have to upgrade the CAS to SP1 as there was no way to remove the legacy partnership information without exporting the mail to PST and re-creating mailboxes.