uniWIKI - User contributions [en]

Information Systems:Azure for Web Orders

2025-03-20T07:33:56Z

Norwinu: /* Databases */

==Summary==

The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscription.

==Components==

===Web Application===
The web application is hosted using Azure App Service, which is a serverless service that provides web runtimes e.g. PHP-CGI (PHP), WSGI (Python), to run web applications without having to maintain a server/VM.

====Code deployment and administration====
While there is no actual server/VM to administer, App Service allows for shell-like access and FTP/SFTP to enable some administrative tasks (although deployment through CI/CD is the better practice). Shell access is available via Kudu SCM.

====Deployment Slots====
Deployment slots allow for dev, test, and prod instances of the application.

===Databases===
Azure SQL (SQL Server) is used for the database(s). Currently, there is a single instance '''uwdintdb''' of Azure SQL that hosts multiple databases that share an elastic pool (for compute).

====Connectivity====
Direct connection (e.g. port 1433) to uwdintdb is allowed through firewall rules (IP whitelist) which can be administered in Azure. Connectivity from applications, such as Synapse and Web Orders itself, is done through Private Endpoint.

====Administration====

====Access====
Database access is available via direct connection (port 3306). Access is IP-restricted for security reasons.

===Source Control and DevOps===
Azure DevOps is used for both git / source control (using Azure Repos), and CI/CD (build pipelines).

There are two repos in the project, one each for the back-end and front-end.

===Integration with D365===
The integration between Web Orders and D365 occurs via 2 main patterns/methods:
# Through a dedicated integration/middleware database that is written to with D365 data and read by Web Orders. This database is found in the same MySQL instance as the one for the application (it is just a separate schema).
# Through REST API endpoints that allow Web Orders to POST data e.g. orders into D365. There are no Azure components for this on the Web Orders side, as API consumption is done in code.

[[Category: Web Orders]]
[[Category: Dynamics 365 Integrations]]

Information Systems:Azure for Web Orders

2025-03-20T07:20:45Z

Norwinu:

==Summary==

The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscription.

==Components==

===Web Application===
The web application is hosted using Azure App Service, which is a serverless service that provides web runtimes e.g. PHP-CGI (PHP), WSGI (Python), to run web applications without having to maintain a server/VM.

====Code deployment and administration====
While there is no actual server/VM to administer, App Service allows for shell-like access and FTP/SFTP to enable some administrative tasks (although deployment through CI/CD is the better practice). Shell access is available via Kudu SCM.

====Deployment Slots====
Deployment slots allow for dev, test, and prod instances of the application.

===Databases===
Azure SQL (SQL Server) is used for the database(s). Currently, there is a single instance '''uwdintdb''' of Azure SQL that hosts multiple databases that share an elastic pool (for compute).

====Access====
Database access is available via direct connection (port 3306). Access is IP-restricted for security reasons.

===Source Control and DevOps===
Azure DevOps is used for both git / source control (using Azure Repos), and CI/CD (build pipelines).

There are two repos in the project, one each for the back-end and front-end.

===Integration with D365===
The integration between Web Orders and D365 occurs via 2 main patterns/methods:
# Through a dedicated integration/middleware database that is written to with D365 data and read by Web Orders. This database is found in the same MySQL instance as the one for the application (it is just a separate schema).
# Through REST API endpoints that allow Web Orders to POST data e.g. orders into D365. There are no Azure components for this on the Web Orders side, as API consumption is done in code.

[[Category: Web Orders]]
[[Category: Dynamics 365 Integrations]]

Information Systems:Azure Resources

2025-03-20T07:16:55Z

Norwinu: Norwinu moved page Information Systems:Azure Resources to Information Systems:Azure for Web Orders over redirect

#REDIRECT [[Information Systems:Azure for Web Orders]]

Information Systems:Azure for Web Orders

2025-03-20T07:16:55Z

Norwinu: Norwinu moved page Information Systems:Azure Resources to Information Systems:Azure for Web Orders over redirect

==Summary==

The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscription.

==Components==

===Web Application===
The web application is hosted using Azure App Service, which is a serverless service that provides web runtimes e.g. PHP-CGI (PHP), WSGI (Python), to run web applications without having to maintain a server/VM.

====Code deployment and administration====
While there is no actual server/VM to administer, App Service allows for shell-like access and FTP/SFTP to enable some administrative tasks (although deployment through CI/CD is the better practice). Shell access is available via Kudu SCM.

====Deployment Slots====
Deployment slots allow for dev, test, and prod instances of the application.

===Database===
The database uses Azure MySQL Flexible Server, which is a serverless database MySQL instance.

====Access====
Database access is available via direct connection (port 3306). Access is IP-restricted for security reasons.

===Source Control and DevOps===
Azure DevOps is used for both git / source control (using Azure Repos), and CI/CD (build pipelines).

There are two repos in the project, one each for the back-end and front-end.

===Integration with D365===
The integration between Web Orders and D365 occurs via 2 main patterns/methods:
# Through a dedicated integration/middleware database that is written to with D365 data and read by Web Orders. This database is found in the same MySQL instance as the one for the application (it is just a separate schema).
# Through REST API endpoints that allow Web Orders to POST data e.g. orders into D365. There are no Azure components for this on the Web Orders side, as API consumption is done in code.

[[Category: Web Orders]]
[[Category: Dynamics 365 Integrations]]

Information Systems:Azure for Web Orders

2025-03-20T07:16:17Z

Norwinu: Norwinu moved page Information Systems:Azure for Web Orders to Information Systems:Azure Resources

==Summary==

The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscription.

==Components==

===Web Application===
The web application is hosted using Azure App Service, which is a serverless service that provides web runtimes e.g. PHP-CGI (PHP), WSGI (Python), to run web applications without having to maintain a server/VM.

====Code deployment and administration====
While there is no actual server/VM to administer, App Service allows for shell-like access and FTP/SFTP to enable some administrative tasks (although deployment through CI/CD is the better practice). Shell access is available via Kudu SCM.

====Deployment Slots====
Deployment slots allow for dev, test, and prod instances of the application.

===Database===
The database uses Azure MySQL Flexible Server, which is a serverless database MySQL instance.

====Access====
Database access is available via direct connection (port 3306). Access is IP-restricted for security reasons.

===Source Control and DevOps===
Azure DevOps is used for both git / source control (using Azure Repos), and CI/CD (build pipelines).

There are two repos in the project, one each for the back-end and front-end.

===Integration with D365===
The integration between Web Orders and D365 occurs via 2 main patterns/methods:
# Through a dedicated integration/middleware database that is written to with D365 data and read by Web Orders. This database is found in the same MySQL instance as the one for the application (it is just a separate schema).
# Through REST API endpoints that allow Web Orders to POST data e.g. orders into D365. There are no Azure components for this on the Web Orders side, as API consumption is done in code.

[[Category: Web Orders]]
[[Category: Dynamics 365 Integrations]]

Information Systems:Azure for Web Orders

2024-03-24T07:44:49Z

Norwinu: Norwinu moved page Azure for Web Orders to Information Systems:Azure for Web Orders without leaving a redirect

==Summary==

The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscription.

==Components==

===Web Application===
The web application is hosted using Azure App Service, which is a serverless service that provides web runtimes e.g. PHP-CGI (PHP), WSGI (Python), to run web applications without having to maintain a server/VM.

====Code deployment and administration====
While there is no actual server/VM to administer, App Service allows for shell-like access and FTP/SFTP to enable some administrative tasks (although deployment through CI/CD is the better practice). Shell access is available via Kudu SCM.

====Deployment Slots====
Deployment slots allow for dev, test, and prod instances of the application.

===Database===
The database uses Azure MySQL Flexible Server, which is a serverless database MySQL instance.

====Access====
Database access is available via direct connection (port 3306). Access is IP-restricted for security reasons.

===Source Control and DevOps===
Azure DevOps is used for both git / source control (using Azure Repos), and CI/CD (build pipelines).

There are two repos in the project, one each for the back-end and front-end.

===Integration with D365===
The integration between Web Orders and D365 occurs via 2 main patterns/methods:
# Through a dedicated integration/middleware database that is written to with D365 data and read by Web Orders. This database is found in the same MySQL instance as the one for the application (it is just a separate schema).
# Through REST API endpoints that allow Web Orders to POST data e.g. orders into D365. There are no Azure components for this on the Web Orders side, as API consumption is done in code.

[[Category: Web Orders]]
[[Category: Dynamics 365 Integrations]]

Information Systems:Azure for Web Orders

2024-03-24T07:43:31Z

Norwinu: Created page with "==Summary== The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscri..."

==Summary==

The new Web Orders site is hosted on Azure. The resources are grouped in the Resource Group '''rg-weborders''', within the '''Azure PAYG Subscription 1''' subscription.

==Components==

===Web Application===
The web application is hosted using Azure App Service, which is a serverless service that provides web runtimes e.g. PHP-CGI (PHP), WSGI (Python), to run web applications without having to maintain a server/VM.

====Code deployment and administration====
While there is no actual server/VM to administer, App Service allows for shell-like access and FTP/SFTP to enable some administrative tasks (although deployment through CI/CD is the better practice). Shell access is available via Kudu SCM.

====Deployment Slots====
Deployment slots allow for dev, test, and prod instances of the application.

===Database===
The database uses Azure MySQL Flexible Server, which is a serverless database MySQL instance.

====Access====
Database access is available via direct connection (port 3306). Access is IP-restricted for security reasons.

===Source Control and DevOps===
Azure DevOps is used for both git / source control (using Azure Repos), and CI/CD (build pipelines).

There are two repos in the project, one each for the back-end and front-end.

===Integration with D365===
The integration between Web Orders and D365 occurs via 2 main patterns/methods:
# Through a dedicated integration/middleware database that is written to with D365 data and read by Web Orders. This database is found in the same MySQL instance as the one for the application (it is just a separate schema).
# Through REST API endpoints that allow Web Orders to POST data e.g. orders into D365. There are no Azure components for this on the Web Orders side, as API consumption is done in code.

[[Category: Web Orders]]
[[Category: Dynamics 365 Integrations]]

Information Systems:Adobe Creative Cloud for Teams

2021-09-21T00:04:08Z

Norwinu:

==Configuration==
uniPHARM has an Adobe Creative Cloud for Teams monthly subscription (4 users). The current usernames/passwords are:

{| class="wikitable sortable"
|-
! Username !! Password !! Activation 1 !! Activation 2 || Notes
|-
| adobecc@unipharm.com || !NewVisionIT2051 || - || - || Used for billing only
|-
| ccmediauser1@unipharm.com || NewVisionIT2051|| teresab || - || Adobe Creative Cloud License
|-
| ccmediauser2@unipharm.com || NewVisionIT2051|| donnak|| norwinu || Adobe Creative Cloud License
|-
| ccmediauser3@unipharm.com || NewVisionIT2051! || anmolm || angelac || Adobe Acrobat Pro License only
|-
| ccmediauser4@unipharm.com || NewVisionIT2051 || || || No license.
|-
| ralphl@unipharm.com || same as windows login|| |||| Adobe Acrobat Pro License only
|-
| nancyn@unipharm.com || same as outlook login || |||| Adobe Acrobat Pro License only
|}

==Notes==
* During exchange deployment, ccmediauser* emails are now aliased to it@unipahrm.com
* June 2021, Adobe individual IDs created and assigned for Nancy and Ralph.
* 11:27, 25 May 2020 (PDT) Adobe Sign is an Acrobat module for e-signatures. Because Nancy and Ralph use this feature under ccmediauser4, this email address is now being forwarded to nancyn@unipharm.com. There are many alerts generated as part of the audit trail during the esignature document lifecycle.
* (Dec. 13, 2018) When signing in to the 3rd computer, Adobe CC now lets you sign another user out directly from said computer in order to free up a license/seat. It's a neat feature, and all but an official confirmation that
they understand people will use their licenses in revolving manner.
* On November 26, 2018 Darren created a new Adobe account because we changed from a monthly-credit-card-paying subscription to a yearly-purchase-order subscription. The new yearly purchase reduced the number of Creative Cloud licenses from 4 to 2 and added a quantity of 1 for Acrobat Pro.

[[Category: Desktop Software]]
[[Category: Adobe]]

Information Systems:Unitech handheld devices for Web Orders

2021-09-17T18:55:36Z

Norwinu: Fixed serial config screenshot

=Overview=

Some shareholder stores use handheld devices provisioned by uniPHARM to help build web orders. Essentially, staff at the store can scan UPC barcodes of front-store items to build a list. This list of items is uploaded as a file to [[:Category:Web Orders | Web Orders]], and is transferred into their cart. To date, there has been no development in this area, as the devices have proven to be fairly stable, while the task they perform is very basic (but offers a lot of value (convenience/ease of ordering) to the stores that use them).

To date, the device used is the Unitec HT-580. However, natural wear and tear has led to depleting stock. At the time of writing, new HT-630 devices will be purchased in small batches as necessary, reprogrammed, and provisioned as replacement units for those that have fallen into disrepair.

This page outlines the technical details of the operation and configuration of the HT-630.

=Programming and Configuration=

IMPORTANT: This information applies to the HT-630. See [[#Deploying a device for store use|Deploying a device for store use]] for information on the legacy HT-580.

The order-building program that runs on the Unitech is a simple application developed with the included Windows utility, JobGen Plus (can be downloaded from the Unitech US website). This utility allows you to develop programs via GUI (i.e. without having to code). The source {{unc | \\superserver.unipharm.local\tech\common\uniTECH Handheld\Program\version 1.1\Order | can be found here}} (must be opened with JobGen). The most recent program is called autoexec.jgp. The program logic is intuitive and can be followed fairly easily. Consult the JobGen and HT-630 manuals {{unc | \\superserver.unipharm.local\tech\common\uniTECH Handheld\Manual | here}} for more information.

===Serial communication parameters===
To configure dock and/or supplied cable communicates with the computer via serial connection. Therefore, when configuring the program to communicate with the device (either EasyJob or JobGen Plus), go to Device Manager and find the COM port e.g. COM4, COM5 etc.

In the program, go to the Communication section and configure as follows for the correct COM:
::[[File:2021-09-17 11_54_08-Window.png|200px]]

===Setting the program to run automatically===
The program must be called autoexec for it to auto-run on the handheld devices. Otherwise, the program will have to be manually launched, a process to which users are not accustomed.

===Changing the power-off timeout===

The HT-630 powers off automatically after a certain period of time. To change this:

# Turn off the device.
# Hold CMD + left arrow + PWR.
# Press 1 to enter Supervisor mode. Password is '630'.
# Press 5 to enter PWR settings.
# Press 2 to enter AUTO OFF settings.
# Use the right arrow to select the desired time, or to disable auto power-off.
# Enter to save changes.
# Press ESC multiple times to exit.

=Deploying a device for store use=

==HT-580==
These devices are all pre-programmed with order.ejp. This program requires the older EasyJob program and cannot be opened with JobGen Plus. If a device needs to be re-flashed with order.ejp, obtain EasyJob {{unc | \\superserver.unipharm.local\common\uniTECH Handheld\HT580 20140114 downloads| here}}, open order.ejp, and click on 'Run Program' with the device connected (counterintuitively, this effectively installs the program to the device).

The following comprises a complete kit for a store: unit, battery, AC adapter, dock, and USB-to-dock cable.

==HT-630==
'''Note: '''These are the newer devices, which are much larger in size. Also note that these devices do not come with a dock, and thus can be deployed to the store with the USB-to-device cable and power adapter only.

* Files required are located in the Tech/common/Unitech Handheld/Deploy HT-630 folder on superserver.
* With the device connected via USB, open JobGen Plus (install this program first if needed). Open the autoexec.jgp program and execute Build->Make Job. This compiles the program and loads it to the device.
* Stores require a program called uTransfer to download the order files to their computer for uploading into Web Orders. The executable will need to be transferred and installed on their computer. Once installed, configure the program to download the order files to the desired folder and filename (usually ORDER.TXT).

*for new deployment make sure that the comm port is set so that the device will plug and play* check the comm port in the device manager

==Deployment Tracking==
HT-630

* Regency #2 - 1 unit
* Delta Prescription - 2 units
* Glover's - 1 unit
* Balkwill 1 unit
* IT cage - 1 units

===Events===
* Aug. 2018: Purchased 2 additional units. Total of 6.
* Sept. 5, 2018: Exchanged 1 unit with Delta Rx.
* Sept. 19, 2018: Require batteries and extra charging cable for reserve.
* 2019: Purchased 2 more devices.

HT-580 (old devices)

* Cates - 1 unit
* Pender Island - 1 unit

=To-dos for this topic=

* Document Web Orders Upload instructions (uTransfer)
* Document standard protocol for provisioning devices to a shareholder store - done
* Maintain a list of stores actively using these devices
* More detailed instructions for provisioning to the store
* Compare order.ejp and autoexec.jgp

[[Category:Unitech]]
[[Category:Web Orders]]

Information Systems:Unitech handheld devices for Web Orders

2021-09-17T18:55:03Z

Norwinu: Added serial communication

=Overview=

Some shareholder stores use handheld devices provisioned by uniPHARM to help build web orders. Essentially, staff at the store can scan UPC barcodes of front-store items to build a list. This list of items is uploaded as a file to [[:Category:Web Orders | Web Orders]], and is transferred into their cart. To date, there has been no development in this area, as the devices have proven to be fairly stable, while the task they perform is very basic (but offers a lot of value (convenience/ease of ordering) to the stores that use them).

To date, the device used is the Unitec HT-580. However, natural wear and tear has led to depleting stock. At the time of writing, new HT-630 devices will be purchased in small batches as necessary, reprogrammed, and provisioned as replacement units for those that have fallen into disrepair.

This page outlines the technical details of the operation and configuration of the HT-630.

=Programming and Configuration=

IMPORTANT: This information applies to the HT-630. See [[#Deploying a device for store use|Deploying a device for store use]] for information on the legacy HT-580.

The order-building program that runs on the Unitech is a simple application developed with the included Windows utility, JobGen Plus (can be downloaded from the Unitech US website). This utility allows you to develop programs via GUI (i.e. without having to code). The source {{unc | \\superserver.unipharm.local\tech\common\uniTECH Handheld\Program\version 1.1\Order | can be found here}} (must be opened with JobGen). The most recent program is called autoexec.jgp. The program logic is intuitive and can be followed fairly easily. Consult the JobGen and HT-630 manuals {{unc | \\superserver.unipharm.local\tech\common\uniTECH Handheld\Manual | here}} for more information.

===Serial communication parameters===
To configure dock and/or supplied cable communicates with the computer via serial connection. Therefore, when configuring the program to communicate with the device (either EasyJob or JobGen Plus), go to Device Manager and find the COM port e.g. COM4, COM5 etc.

In the program, go to the Communication section and configure as follows for the correct COM:
[[File:2021-09-17 11_54_08-Window.png|200px]]

===Setting the program to run automatically===
The program must be called autoexec for it to auto-run on the handheld devices. Otherwise, the program will have to be manually launched, a process to which users are not accustomed.

===Changing the power-off timeout===

The HT-630 powers off automatically after a certain period of time. To change this:

# Turn off the device.
# Hold CMD + left arrow + PWR.
# Press 1 to enter Supervisor mode. Password is '630'.
# Press 5 to enter PWR settings.
# Press 2 to enter AUTO OFF settings.
# Use the right arrow to select the desired time, or to disable auto power-off.
# Enter to save changes.
# Press ESC multiple times to exit.

=Deploying a device for store use=

==HT-580==
These devices are all pre-programmed with order.ejp. This program requires the older EasyJob program and cannot be opened with JobGen Plus. If a device needs to be re-flashed with order.ejp, obtain EasyJob {{unc | \\superserver.unipharm.local\common\uniTECH Handheld\HT580 20140114 downloads| here}}, open order.ejp, and click on 'Run Program' with the device connected (counterintuitively, this effectively installs the program to the device).

The following comprises a complete kit for a store: unit, battery, AC adapter, dock, and USB-to-dock cable.

==HT-630==
'''Note: '''These are the newer devices, which are much larger in size. Also note that these devices do not come with a dock, and thus can be deployed to the store with the USB-to-device cable and power adapter only.

* Files required are located in the Tech/common/Unitech Handheld/Deploy HT-630 folder on superserver.
* With the device connected via USB, open JobGen Plus (install this program first if needed). Open the autoexec.jgp program and execute Build->Make Job. This compiles the program and loads it to the device.
* Stores require a program called uTransfer to download the order files to their computer for uploading into Web Orders. The executable will need to be transferred and installed on their computer. Once installed, configure the program to download the order files to the desired folder and filename (usually ORDER.TXT).

*for new deployment make sure that the comm port is set so that the device will plug and play* check the comm port in the device manager

==Deployment Tracking==
HT-630

* Regency #2 - 1 unit
* Delta Prescription - 2 units
* Glover's - 1 unit
* Balkwill 1 unit
* IT cage - 1 units

===Events===
* Aug. 2018: Purchased 2 additional units. Total of 6.
* Sept. 5, 2018: Exchanged 1 unit with Delta Rx.
* Sept. 19, 2018: Require batteries and extra charging cable for reserve.
* 2019: Purchased 2 more devices.

HT-580 (old devices)

* Cates - 1 unit
* Pender Island - 1 unit

=To-dos for this topic=

* Document Web Orders Upload instructions (uTransfer)
* Document standard protocol for provisioning devices to a shareholder store - done
* Maintain a list of stores actively using these devices
* More detailed instructions for provisioning to the store
* Compare order.ejp and autoexec.jgp

[[Category:Unitech]]
[[Category:Web Orders]]

File:2021-09-17 11 54 08-Window.png

2021-09-17T18:54:30Z

Norwinu: File uploaded with MsUpload

File uploaded with MsUpload

Distribution Centre:How to Sign Loss or Theft Report Form

2021-09-14T17:32:07Z

Norwinu:

==Instructions==

# Fill out form in browser Window.
# Download form using the down arrow at the top right of the window pane. Make sure to select "With changes".
:[[File:2021-09-14 10_27_18-Window.png|100px]]
# Open file using Windows Explorer. It should open in Adobe Acrobat Reader.
:[[File:2021-09-14 10_29_01-.png|100px]]
# Click on the signature field. In the pop-up, select your signature. If one has not been created for you, call IT.
# Save signed file and send attach to email.

Distribution Centre:How to Sign Loss or Theft Report Form

2021-09-14T17:31:12Z

Norwinu:

Distribution Centre:How to Sign Loss or Theft Report Form

2021-09-14T17:31:05Z

Norwinu:

==Instructions==

# Fill out form in browser Window.
# Download form using the down arrow at the top right of the window pane. Make sure to select "With changes".
[[File:2021-09-14 10_27_18-Window.png|100px]]
# Open file using Windows Explorer. It should open in Adobe Acrobat Reader.
[[File:2021-09-14 10_29_01-.png|100px]]
# Click on the signature field. In the pop-up, select your signature. If one has not been created for you, call IT.

Distribution Centre:How to Sign Loss or Theft Report Form

2021-09-14T17:30:58Z

Norwinu:

==Instructions==

# Fill out form in browser Window.
# Download form using the down arrow at the top right of the window pane. Make sure to select "With changes".
[[:File:2021-09-14 10_27_18-Window.png|100px]]
# Open file using Windows Explorer. It should open in Adobe Acrobat Reader.
[[File:2021-09-14 10_29_01-.png|100px]]
# Click on the signature field. In the pop-up, select your signature. If one has not been created for you, call IT.

Distribution Centre:How to Sign Loss or Theft Report Form

2021-09-14T17:30:44Z

Norwinu:

==Instructions==

# Fill out form in browser Window.
# Download form using the down arrow at the top right of the window pane. Make sure to select "With changes".
[[File:2021-09-14 10_27_18-Window.png|100]][[:File:2021-09-14 10_27_18-Window.png]]
# Open file using Windows Explorer. It should open in Adobe Acrobat Reader.
[[File:2021-09-14 10_29_01-.png|100px]]
# Click on the signature field. In the pop-up, select your signature. If one has not been created for you, call IT.

Distribution Centre:How to Sign Loss or Theft Report Form

2021-09-14T17:30:33Z

Norwinu: Created page with "==Instructions== # Fill out form in browser Window. # Download form using the down arrow at the top right of the window pane. Make sure to select "With changes". File:2021..."

==Instructions==

# Fill out form in browser Window.
# Download form using the down arrow at the top right of the window pane. Make sure to select "With changes".
[[File:2021-09-14 10_27_18-Window.png|400px]][[:File:2021-09-14 10_27_18-Window.png]]
# Open file using Windows Explorer. It should open in Adobe Acrobat Reader.
[[File:2021-09-14 10_29_01-.png|400px]]
# Click on the signature field. In the pop-up, select your signature. If one has not been created for you, call IT.

File:2021-09-14 10 29 01-.png

2021-09-14T17:29:31Z

Norwinu: File uploaded with MsUpload

File uploaded with MsUpload

File:2021-09-14 10 27 18-Window.png

2021-09-14T17:27:33Z

Norwinu: File uploaded with MsUpload

File uploaded with MsUpload

Information Systems:Box label program (PLZIU400) hangs for a single customer

2021-09-10T04:27:50Z

Norwinu: /* Explanation */

This is one of those crazy quirks of the system that leave you in awe.

==Background==
The warehouse uses a program in the UNITY menus (25 - Special box labels) to manually print one-off box labels (e.g. for a mail run or a special shipment). It presents the user with a simple interface to enter the customer number (blank for all), number of labels, and the thermal printer to print to.

==Problem==
A user prints x number of labels for a customer and then tries to print another x number of labels on the same day and notices that the program hangs. Anyone else that tries to print for the same customer using the same program experiences the hang as well. Once the program hangs, the user cannot force quit the sessions by closing the window; multiple attempts will therefore bog the CPU with hung sessions.

==Explanation==
Since this program generates box labels and Atlas is the primary transportation partner, part of the logic is to generate a ''unique'' Atlas waybill (even if the box is not being sent out through Atlas) using metadata: the '''customer number''' + '''Julian date (days part)''' + '''2-digit counter from 01-99'''.

Here is an example of how the problem can happen:

# On Sep. 9 2021, the Julian day is 252. A user prints 50 box labels for 10478. Hence, the waybills 1047825201 - 1047825250 are used and logged to the file ATLEXTRAP.
# The following year, on the same day, the user prints another 50 labels for 10478. On the 50th label, the wayill generator wraps back to 1 after the 2-digit counter reaches 99.
# 1047825201 is now a duplicate, which the program prevents from being written to ATLEXTRAP, and it handles this by incrementing the counter, thus yielding an infinite loop. You can examine this via SQL on CVUSDAP (filter by CLCUVE), where CVNUMB loops through 0-99 endlessly during the time one of the sessions is still hung.

If these were not legacy programs, a bug fix would've been attempted. The rarity of this problem also makes a patch not worthwhile.

==Fix==
Find today's Julian day. Examine ATLEXTRAP where the waybill number (ATLSHIP) starts with the customer number + Julian day e.g. '''10478252'''''01''. Delete records where ATLSDAT is a previous year, or if many were printed on the current day by accident, delete these records.

Information Systems:Box label program (PLZIU400) hangs for a single customer

2021-09-10T04:27:22Z

Norwinu: /* Explanation */

This is one of those crazy quirks of the system that leave you in awe.

==Background==
The warehouse uses a program in the UNITY menus (25 - Special box labels) to manually print one-off box labels (e.g. for a mail run or a special shipment). It presents the user with a simple interface to enter the customer number (blank for all), number of labels, and the thermal printer to print to.

==Problem==
A user prints x number of labels for a customer and then tries to print another x number of labels on the same day and notices that the program hangs. Anyone else that tries to print for the same customer using the same program experiences the hang as well. Once the program hangs, the user cannot force quit the sessions by closing the window; multiple attempts will therefore bog the CPU with hung sessions.

==Explanation==
Since this program generates box labels and Atlas is the primary transportation partner, part of the logic is to generate a ''unique'' Atlas waybill (even if the box is not being sent out through Atlas) using metadata: the '''customer number''' + '''Julian date (days part)''' + ''2-digit counter from 01-99''.

Here is an example of how the problem can happen:

# On Sep. 9 2021, the Julian day is 252. A user prints 50 box labels for 10478. Hence, the waybills 1047825201 - 1047825250 are used and logged to the file ATLEXTRAP.
# The following year, on the same day, the user prints another 50 labels for 10478. On the 50th label, the wayill generator wraps back to 1 after the 2-digit counter reaches 99.
# 1047825201 is now a duplicate, which the program prevents from being written to ATLEXTRAP, and it handles this by incrementing the counter, thus yielding an infinite loop. You can examine this via SQL on CVUSDAP (filter by CLCUVE), where CVNUMB loops through 0-99 endlessly during the time one of the sessions is still hung.

If these were not legacy programs, a bug fix would've been attempted. The rarity of this problem also makes a patch not worthwhile.

==Fix==
Find today's Julian day. Examine ATLEXTRAP where the waybill number (ATLSHIP) starts with the customer number + Julian day e.g. '''10478252'''''01''. Delete records where ATLSDAT is a previous year, or if many were printed on the current day by accident, delete these records.

Information Systems:Box label program (PLZIU400) hangs for a single customer

2021-09-10T04:22:17Z

Norwinu:

This is one of those crazy quirks of the system that leave you in awe.

==Background==
The warehouse uses a program in the UNITY menus (25 - Special box labels) to manually print one-off box labels (e.g. for a mail run or a special shipment). It presents the user with a simple interface to enter the customer number (blank for all), number of labels, and the thermal printer to print to.

==Problem==
A user prints x number of labels for a customer and then tries to print another x number of labels on the same day and notices that the program hangs. Anyone else that tries to print for the same customer using the same program experiences the hang as well. Once the program hangs, the user cannot force quit the sessions by closing the window; multiple attempts will therefore bog the CPU with hung sessions.

==Explanation==
Since this program generates box labels and Atlas is the primary transportation partner, part of the logic is to generate a ''unique'' waybill using "meaningful information" (as per the comments). This is the '''customer number''' + '''Julian date (days part)''' + ''2-digit counter from 01-99''. Here is an example of how the problem can happen:

# On Sep. 9 2021, the Julian day is 252. A user prints 50 box labels for 10478. Hence, the waybills 1047825201 - 1047825250 are used and logged to the file ATLEXTRAP.
# The following year, on the same day, the user prints another 50 labels for 10478. On the 50th label, the wayill generator wraps back to 1 as all the 2-digit counter is incremented past 99.
# 1047825201 is now duplicated, and the program checks for uniqueness of the waybill number, incrementing the counter if the waybill already exists, thus yielding an infinite loop. You can examine this via SQL on CVUSDAP (filter by CLCUVE), where CVNUMB loops through 0-99 during the time one of the sessions is still hung.

If these were not legacy programs, a bug fix would've been attempted. The rarity of this problem also makes a patch not worthwhile.

==Fix==
Find today's Julian day. Examine ATLEXTRAP where the waybill number (ATLSHIP) starts with the customer number + Julian day e.g. '''10478252'''''01''. Delete records where ATLSDAT is a previous year, or if many were printed on the current day by accident, delete these records.

Information Systems:Box label program (PLZIU400) hangs for a single customer

2021-09-10T04:21:48Z

Norwinu: Created page with "This is one of those crazy quirks of the system that leave you in awe. ==Background== The warehouse uses a program in the UNITY menus (25 - Special box labels) to manually p..."

This is one of those crazy quirks of the system that leave you in awe.

==Background==
The warehouse uses a program in the UNITY menus (25 - Special box labels) to manually print one-off box labels (e.g. for a mail run or a special shipment). It presents the user with a simple interface to enter the customer number (blank for all), number of labels, and the thermal printer to print to.

==Problem==
A user prints x number of labels for a customer and then tries to print another x number of labels on the same day and notices that the program hangs. Anyone else that tries to print for the same customer using the same program experiences the hang as well. Once the program hangs, the user cannot force quit the sessions by closing the window; multiple attempts will therefore bog the CPU with hung sessions.

==Explanation==
Since this program generates box labels and Atlas is the primary transportation partner, part of the logic is to generate a ''unique'' waybill using "meaningful information" (as per the comments). This is the '''customer number''' + '''Julian date (days part)''' + ''2-digit counter from 01-99''. Here is an example of how the problem can happen:

# On Sep. 9 2021, the Julian day is 252. A user prints 50 box labels for 10478. Hence, the waybills 1047825201 - 1047825250 are used and logged to the file ATLEXTRAP.
# The following year, on the same day, the user prints another 50 labels for 10478. On the 50th label, the wayill generator wraps back to 1 as all the 2-digit counter is incremented past 99.
# 1047825201 is now duplicated, and the program checks for uniqueness of the waybill number, incrementing the counter if the waybill already exists, thus yielding an infinite loop. You can examine this via SQL on CVUSDAP (filter by CLCUVE), where CVNUMB loops through 0-99 during the time one of the sessions is still hung.

If these were not legacy programs, a bug fix would've been attempted. The rarity of this problem also makes a patch not worthwhile.

==Fix==
Find today's Julian day. Examine ATLEXTRAP where the waybill number (ATLSHIP) starts with the customer number + Julian date e.g. ''10478'''''252'''''01''. Delete records where ATLSDAT is a previous year, or if many were printed on the current day by accident, delete these records.

Pharmacy Services:Medication Returns (from Patients)

2021-08-06T23:14:46Z

Norwinu:

abc
[[Category:Pharmacy Services]]

Information Systems:Software Repository

2021-07-21T23:34:13Z

Norwinu: Started article

Work-in-progress - we need a software repo that is publicly accessible. Needs to be curated/maintained so we don't overload it with admin software and drivers that will quickly become outdated.

Currently, the folder is '''UWD Software''' on superserver. We used to have GPOs (ADSI) that referenced this path, but we're trying to transition into using PDQ Deploy for software provisioning (remote installation) rather than Active Directory. Still, be mindful of this if deleting software from this folder.

[[Category: Systems Administration]]

Information Systems:Office Label Printing

2021-07-21T23:31:04Z

Norwinu:

The company has 2 Brother desktop label printers (thermal) for office use e.g. asset stickers, mail address labels. Currently, only The IT department and Angela use these printers, so they each have a printer.

==Inventory==
The two printers are:

{| class="wikitable"
|-
! Model !! Location !! Usage !! Notes
|-
| QL-570 || Angela's office || Mail labels, asset stickers, personnel file folder labels || Connected to Angela's PC via USB
|-
| QL-720NW || IT Dept. common area || Tape labels, misc. || Reachable via network (WiFi). IP: 172.30.17.28 DNS: it-label-prt.unipharm.local
|}

==Administration==
===Label templates===
We do not have many, but these (lbx files) should be centrally stored on Superserver (check the Tech folder). It is possible to transfer templates to the printer directly but this has proven to be cumbersome (for example, templates made with P-touch editor for PC and transferred to a printer were not visible in the iPrint&Label app).

===Software===
The software to generate and print labels is called P-touch Editor, and can be downloaded from the Brother website. There are other utilities for more advanced usage (mail-merges and database input), but we likely won't be needing these. A copy is located in the [[Information Systems: Software Repository|software repo]].

There is also the iPrint&Label app, which can generate and print to networked label printers (of which we have 1).

===Film vs paper labels===
There are two types of labels, film and paper. Paper labels are cheap and common (i.e. lots of 3rd party makers). They are suitable for use on paper i.e. Manila envelopes. However, for things like asset stickers, the more expensive and more durable film label is a better choice.

* '''DK-2212''' - 2.4" film, continuous

[[Category: Printing]]

Information Systems:Office Label Printing

2021-07-21T23:30:49Z

Norwinu:

The company has 2 Brother desktop label printers (thermal) for office use e.g. asset stickers, mail address labels. Currently, only The IT department and Angela use these printers, so they each have a printer.

==Inventory==
The two printers are:

{| class="wikitable"
|-
! Model !! Location !! Usage !! Notes
|-
| QL-570 || Angela's office || Mail labels, asset stickers, personnel file folder labels || Connected to Angela's PC via USB
|-
| QL-720NW || IT Dept. common area || Tape labels, misc. || Reachable via network (WiFi). IP: 172.30.17.28 DNS: it-label-prt.unipharm.local
|}

==Administration==
===Label templates===
We do not have many, but these (lbx files) should be centrally stored on Superserver (check the Tech folder). It is possible to transfer templates to the printer directly but this has proven to be cumbersome (for example, templates made with P-touch editor for PC and transferred to a printer were not visible in the iPrint&Label app).

===Software===
The software to generate and print labels is called P-touch Editor, and can be downloaded from the Brother website. There are other utilities for more advanced usage (mail-merges and database input), but we likely won't be needing these. A copy is located in the [[Information Systems: Softwaare Repository|software repo]].

There is also the iPrint&Label app, which can generate and print to networked label printers (of which we have 1).

===Film vs paper labels===
There are two types of labels, film and paper. Paper labels are cheap and common (i.e. lots of 3rd party makers). They are suitable for use on paper i.e. Manila envelopes. However, for things like asset stickers, the more expensive and more durable film label is a better choice.

* '''DK-2212''' - 2.4" film, continuous

[[Category: Printing]]

Information Systems:Office Label Printing

2021-07-21T23:29:48Z

Norwinu:

The company has 2 Brother desktop label printers (thermal) for office use e.g. asset stickers, mail address labels. Currently, only The IT department and Angela use these printers, so they each have a printer.

==Inventory==
The two printers are:

{| class="wikitable"
|-
! Model !! Location !! Usage !! Notes
|-
| QL-570 || Angela's office || Mail labels, asset stickers, personnel file folder labels || Connected to Angela's PC via USB
|-
| QL-720NW || IT Dept. common area || Tape labels, misc. || Reachable via network (WiFi). IP: 172.30.17.28 DNS: it-label-prt.unipharm.local
|}

==Administration==
===Label templates===
We do not have many, but these (lbx files) should be centrally stored on Superserver (check the Tech folder). It is possible to transfer templates to the printer directly but this has proven to be cumbersome (for example, templates made with P-touch editor for PC and transferred to a printer were not visible in the iPrint&Label app).

===Software===
The software to generate and print labels is called P-touch Editor, and can be downloaded from the Brother website. There are other utilities for more advanced usage (mail-merges and database input), but we likely won't be needing these. A copy is located on superserver.

There is also the iPrint&Label app, which can generate and print to networked label printers (of which we have 1).

===Film vs paper labels===
There are two types of labels, film and paper. Paper labels are cheap and common (i.e. lots of 3rd party makers). They are suitable for use on paper i.e. Manila envelopes. However, for things like asset stickers, the more expensive and more durable film label is a better choice.

* '''DK-2212''' - 2.4" film, continuous

[[Category: Printing]]

Information Systems:Mail flow

2021-07-20T07:56:08Z

Norwinu: Add connector info

This page discusses the flow of email (mail flow), including Exchange connectors, MDaemon smart host configuration, and mail rules.

A mechanism to set up "rules" specifying actions when certain criteria are met (i.e. matching certain message properties) is central to most mail server systems. In MDaemon, this is known as the Content Filter. In Exchange, there is a ''Rules'' section within ''Mail flow''.

==Connectors==
Understanding connectors is crucial to understanding the overall mail flow.
A connector in Exchange is defined when special is routing is needed between Exchange and another mail server. It is required for our environment because email hosting for the domains unipharm.com and medicinecentre.com is split between Exchange and MDaemon i.e. there are mailboxes for both domains on Exchange and MDaemon. It is worthwhile to first state that all inbound mail goes through Exchange (MX records point to EOP). For addresses that correlate to Exchange mailboxes, the routing of inbound mail is straightforward. When Exchange receives an email that is destined for an MDaemon mailbox, it sends it to MDaemon ''through a connector'', which must be properly configured. ''Although the name may suggest it, a connector isn't a stateful connection between 2 servers. It's more just a route.''

A connector can be from Exchange to another mail server or vice versa. This is called Send and Receive connectors in on-prem Exchange, but these labels are not applicable to connectors in Exchange Online. There are 2 connectors defined in our configuration, one for each direction:

* '''MDaemon to Exchange by Hostname''' - This connector accepts mail from MDaemon and is needed for email from MDaemon mailboxes to Exchange mailboxes. For example, when a shareholder (one that uses a unipharm.com email) sends to a staff member, the message goes through this connector.
* ''Exchange to MDaemon '' - This connector sends mail destined for MDaemon mailboxes to MDaemon.

'''Now for the fun part.''' The latter connector (Exchange to MDaemon) is rule-based. TBC...

==Mail Rules==
This section discusses mail rules (server-side rules) and their business impact e.g. their desired function and the rationale behind their implementation.
===Substitute Reply-to header for document distribution emails===
'''Implemented in:''' MDaemon

Document distribution emails describe emails such as remittance advices, A/R statements, invoices (PDF copy), purchase orders etc. These originate from JetForm (ultimately ASW), or custom mailer scripts on Bart, and are therefore sent using their assigned email accounts - unipharm@unipharm.com and uphadmin@unipharm.com. Recipients that reply by (naturally) hitting the reply button and accepting the suggested To address unknowingly send these emails back to these addresses, which are then forwarded to IT and require manual forwarding to get to their "true" intended recipient.

The MDaemon Content Filter rule (many rules, but based on the same template) that pertain to this policy works by looking for properties specific to these emails and then changing the Reply-To header. For example, in A/R statement emails, the subject always contains "AR STATEMENT" and contains a From: header with the value unipharm@unipharm.com. Replies to these emails should always go to accountsreceivable@unipharm.com, and so the rule specifies this as the Reply-To. The rule actually deletes this and 2 other headers as well, as these pertain to replies. For example, the Return-Path header is so that mail servers know where to send bounces in scenarios where the message cannot even be delivered to the intended recipient.

Note that the rules avoid changing the From: header. This should not be modified (i.e. it should remain as unipharm@unipharm.com or uphadmin@unipharm.com), because recipients may have email rules in place to detect this, or more importantly, machine recipients (servers that accept PO emails) may already be set to only accept messages from these addresses. The Reply-To header is more appropriate as it is only implicated when replying to the message.

Proof of the rule taking effect:
[[File:2021-03-15 12_45_02-Window.png|400px]]

===Include staff in shareholder correspondence===
'''Implemented in:''' Exchange

When emails are sent to shareholder distribution lists, it is currently a "business rule" to BCC select staff members, with the intent being so that staff remain informed of any mass correspondence in the case they receive calls and questions regarding said correspondence. Rather than implement this business rule by including staff members in the distribution lists themselves (which simply, is bad design), it is more apprporiate to institute a mail flow rule to achieve this same outcome. By doing this, you can also specify the senders to which this rule applies, because some senders that use distribution lists in a more conventional fashion may intend to send only to recipients suggested by the list name (i.e. sending to shareholders should only go to shareholders, because the name of the list is...Shareholders!).

The implementation of this rule is straightforward - if an email is sent to any of the specified lists, then place these users (individual users specified) in the Bcc field.

===Exempt messages to email order catch-all addresses from most scanning===
'''Implemented in:''' Exchange, MDaemon

There are still numerous shareholder stores (big ones at that) that use POS systems or versions of POS systems which transmit orders via email. These orders go to certain email addresses. Rules are set in both Exchange and MDaemon to relax/bypass the regular spam/threat scanning for messages intended for these addresses. The premise is that the priority of having these messages delivered trumps the low risk of impact from any email threats that are accepted. This is because the IBM i, where these messages eventually arrive, can't execute these threats anyway, and the i has demonstrated an admirably unwavering patience in dealing with unsolicited spam/bulk email.

[[Category: Microsoft Exchange/365]]
[[Category: Email]]

Information Systems:Mail flow rules

2021-07-20T07:29:56Z

Norwinu: Norwinu moved page Information Systems:Mail flow rules to Information Systems:Mail flow: Better title

#REDIRECT [[Information Systems:Mail flow]]

Information Systems:Mail flow

2021-07-20T07:29:56Z

Norwinu: Norwinu moved page Information Systems:Mail flow rules to Information Systems:Mail flow: Better title

This page attempts to discuss mail flow rules and their business impact e.g. their desired function and the rationale behind their implementation.

A mechanism to set up "rules" specifying actions when certain criteria are met (i.e. matching certain message properties) is central to most mail server systems. In MDaemon, this is known as the Content Filter. In Exchange, there is a ''Rules'' section within ''Mail flow''.

==Noteworthy Mail Rules==
===Substitute Reply-to header for document distribution emails===
'''Implemented in:''' MDaemon

Document distribution emails describe emails such as remittance advices, A/R statements, invoices (PDF copy), purchase orders etc. These originate from JetForm (ultimately ASW), or custom mailer scripts on Bart, and are therefore sent using their assigned email accounts - unipharm@unipharm.com and uphadmin@unipharm.com. Recipients that reply by (naturally) hitting the reply button and accepting the suggested To address unknowingly send these emails back to these addresses, which are then forwarded to IT and require manual forwarding to get to their "true" intended recipient.

The MDaemon Content Filter rule (many rules, but based on the same template) that pertain to this policy works by looking for properties specific to these emails and then changing the Reply-To header. For example, in A/R statement emails, the subject always contains "AR STATEMENT" and contains a From: header with the value unipharm@unipharm.com. Replies to these emails should always go to accountsreceivable@unipharm.com, and so the rule specifies this as the Reply-To. The rule actually deletes this and 2 other headers as well, as these pertain to replies. For example, the Return-Path header is so that mail servers know where to send bounces in scenarios where the message cannot even be delivered to the intended recipient.

Note that the rules avoid changing the From: header. This should not be modified (i.e. it should remain as unipharm@unipharm.com or uphadmin@unipharm.com), because recipients may have email rules in place to detect this, or more importantly, machine recipients (servers that accept PO emails) may already be set to only accept messages from these addresses. The Reply-To header is more appropriate as it is only implicated when replying to the message.

Proof of the rule taking effect:
[[File:2021-03-15 12_45_02-Window.png|400px]]

===Include staff in shareholder correspondence===
'''Implemented in:''' Exchange

When emails are sent to shareholder distribution lists, it is currently a "business rule" to BCC select staff members, with the intent being so that staff remain informed of any mass correspondence in the case they receive calls and questions regarding said correspondence. Rather than implement this business rule by including staff members in the distribution lists themselves (which simply, is bad design), it is more apprporiate to institute a mail flow rule to achieve this same outcome. By doing this, you can also specify the senders to which this rule applies, because some senders that use distribution lists in a more conventional fashion may intend to send only to recipients suggested by the list name (i.e. sending to shareholders should only go to shareholders, because the name of the list is...Shareholders!).

The implementation of this rule is straightforward - if an email is sent to any of the specified lists, then place these users (individual users specified) in the Bcc field.

===Exempt messages to email order catch-all addresses from most scanning===
'''Implemented in:''' Exchange, MDaemon

There are still numerous shareholder stores (big ones at that) that use POS systems or versions of POS systems which transmit orders via email. These orders go to certain email addresses. Rules are set in both Exchange and MDaemon to relax/bypass the regular spam/threat scanning for messages intended for these addresses. The premise is that the priority of having these messages delivered trumps the low risk of impact from any email threats that are accepted. This is because the IBM i, where these messages eventually arrive, can't execute these threats anyway, and the i has demonstrated an admirably unwavering patience in dealing with unsolicited spam/bulk email.

[[Category: Email]]

Information Systems:Microsoft 365 Exchange Online - Setup and Configuration

2021-07-20T07:28:10Z

Norwinu: /* Dynamic Distribution List= */

==Overview==
This wiki page attempts to document and discuss major topics of Exchange setup and configuration. This will be a mix of design/strategy talk and some how-tos for technical administration. Ultimately, another page should be made to adapt the information discussed here into more concise technical instructions for specific administration tasks.

Check [[Information Systems: Exchange and Outlook Administration|this page]] for how-tos. Any instructions below should eventually be migrated to that page as well.

==Mailboxes==
Users are essentially mailboxes in Exchange i.e. there is no Users section. In Exchange Online, a mailbox shows up when a user is created in 365 Admin Center.

===Shared Mailboxes===
Like groups/lists, shared mailboxes are communal to a group of users. But unlike groups/lists, they are actual mailboxes that accumulate mail. The company requires a few of these:
* Accounts Payable: accountspayable@unipharm.com
* Accounts Receivable: accountsreceivable@unipharm.com
* EDI Support: edisupport@unipharm.com
* Customer Service Voicemail: csvm@unipharm.com

====Adding a shared mailbox====
Given the limited number of shared mailboxes, and the company's particular use of them as mailbox "identities" rather than a communal email "sink", it has been decided to add shared mailboxes as separate accounts as opposed to opening them as additional mailboxes.

To add a shared mailbox:
* Remove any shared mailboxes previously opened as additional mailboxes (and not added as accounts).
* Perform the steps to add another email account (Office 365).
* Enter in the shared mailbox email.
* Instead of entering a password, click ''Sign in as another account''.
* Enter in the user's credentials. This will only work if the user has Full Access permissions to the shared mailbox (do this in EAC).

====Other methods====
The other ways of adding shared mailboxes are discussed here just for reference:

'''''Manually opening a shared mailbox'''''
:* In Outlook 2019, File -> Account Settings -> double-click account -> More Settings -> Advanced
:* In the Mailboxes section -> Add -> Enter exact Display Name of shared mailbox
:* Save/Apply

'''''Automapping'''''
:'''Note: Automapping has been disabled for all shared mailboxes.'''

:* Automapping is a feature that makes the shared mailboxes which a user has access to automatically visible in Outlook i.e. the shared mailboxes are automatically mapped to the user. This is enabled by default. There are implications:
::* Automapping lumps the data of shared mailboxes in the same OST file as the user's own mailbox. This is one of the reasons there is official documentation on how to disable automapping and [https://docs.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox how to reset an automapped Outlook configuration]. Considering the company's user base and computer/desktop assignments, this isn't expected to be a problem. But it's something to keep aware of. Imagine a case of 3 users that access 2 shared mailboxes ecah including their own, all logging in to the same computer with a 120GB SSD, with Outlook set to sync all mail. It is feasible for this to grow massively.
::* Automapping appears to be very finicky when mailbox delegation (permissions) are set to security groups instead of users. Discussion on the internet refers to having to reset permissions.

===Granting a user access to another mailbox===
The preferred method of granting a user access to another mailbox is to have them access to read (and send from, if necessary) using Outlook for web (OWA). This is especially true when access is only needed on a temporary basis. [[Information Systems:Exchange Online administration with PowerShell|The commands can be found here.]]

==Contacts and Groups==
===Contacts===
Contacts (or more accurately, Mail Contacts) in Exchange are analogous to address book entries: they're simply names with email addressses (and other attributes like address and phone numbers). This is in contrast with full Exchange "Users" that have mailboxes. Currently, the primary use of contacts is to maintain distribution lists (we don't maintain a company directory outside CNS, oddly enough).

====Shareholder email addresses====
In an attempt to maintain clean and consistent entries, several conventions for creating contacts have already been adopted, best depicted in the following example entry for the personal email associated with Marks Marine Pharmacy (the one that would go in the private/sensitive list). The Classic Exchange Admin Center is shown, as it exposes more fields:
::[[File:2021-03-06 22_15_29-Edit Mail Contact.png|400px|border]]

Recommendations when creating new entries:
* If this contact/email will be used in private/confidential list only, prefix the Display Name with [Private]. Also, check the 'Hide contacts from the address list'. You may need to do this in Classic EAC.
* If this contact will be a member of both private and general/publicly-visible distribution lists, do not prefix the name.

===Groups===
The term "groups" in Exchange can mean 1 of 4 things: Microsoft 365 Groups, Distribution Lists, Dynamic Distribution Lists, and Mail-enabled Security Groups. The first is not used whatsoever.
====Distribution Lists====
Distribution Lists are akin to the conventional mailing list, wherein an email sent to the group address is distributed to its members. This group type is used for the shareholder mailing lists (both general and private/confidential lists).

::[[File:2021-03-06 16_53_57-Edit Mail Contact.png|400px|border]]
* Some groups are meant to be internal (e.g IT group), while others are meant to also be addressable by users outside the organization (e.g. Returns). Check related permissions and set up aliases accordingly. For example, Returns group follows the convention returnsgroup@unpharm.com, but it is logical to have '''returns@unipharm.com''' as an alias, as this is a more common format for a public-facing contact email address (same as customerservice@unipharm.com).
::[[File:2021-03-06 14_58_33-Exchange admin center.png|200px|border]]
====Mail-enabled Security Groups====
This type of group is appropriate for the departments, as the group can be used to send to its members as well as for permissions (hence, "mail-enabled security group").

* The email address convention for department groups (and most other groups) is '''''department'''''group@unipharm.com.
* The following is an example of a configured group. The manager has been specified as a group owner (in addition to IT) to enable self-management.
::[[File:2021-03-06 14_41_32-Exchange admin center.png|300px|border]]

====Microsoft 365 groups====
This type of group has additional functionality to enable better collaboration for the group's members. The company currently does not collaborate in such a fashion for these to be useful (e.g. no Sharepoint, no Teams, no shared folders on cloud storage).

====Dynamic Distribution List====
This is a good concept on paper as it allows distribution list membership to be dynamic based on attributes e.g. a Customer Service list could be set up to include any users with the "Department" user property set to "Customer Service". However, it was tested to have one major showstopping limitation - it is very inconvenient viewing current members of a DDL (i.e. has to be in PowerShell, and even then, it requires list iteration and filtering). Not being able to see the recipients severely limits its usefulness, and therefore, setting up the departments as dynamic lists was forgone as an endeavor to keep things simple.

====Nested groups====
'''A word of caution regarding nested groups.'''

Nesting groups within other groups generally leads to better-structured and therefore easier to manage permissions. This is especially true with Microsoft AD, where object hierarchy and the concept of RBAC are predominant (a user can be assigned one or more roles, which grants them the specific set of permissions associated with those roles). However, issues have been encountered with group nesting during setup, primarily related to "trying to get too fancy". The ultimate goal was to have permissions and group membership dynamically assigned based on attribute e.g. the user's department. This was found to not even be remotely achievable in Exchange. These general rules of thumb have been surmised from experimentation with group nesting:

* Nesting like group types appears to work. Distribution lists groups are ok to nest within other distribution list groups. The same goes for mail security groups.
* Nesting security groups can lead to some quirks, but is still recommended. For example, nested security groups seems to break shared mailbox automapping and ownership.
* Distribution list groups should not be nested within security groups (see point #1).

TL;DR - exercise caution when using group nesting, and assign permissions to users as a fallback (troubleshoot later).

==Address Book==
With Exchange address books, there exists two types of implementations: out-of-the-box or address book policies. This fork on the road comes early; either accept the out of the box functionality and do nothing else, or enter the world of address book policy routing and accept the more complex management. This of course depends on the needs of the company, and we needed and decided on the latter. This path also requires PowerShell (no options or visibility exists in EAC, besides the ability to assign an existing policy (created with PowerShell) to a user).

===Address book policies===
An address book policy allows you to customize what a user sees, from the sublists, to the contacts viewable in those sublists. For example, the default address book policy has the following address lists: All Groups, All Users, All Distribution Lists etc. It is both unintuitive if you are not fully invested in the Microsoft way. For example, we don't use Microsoft groups, so All Groups is empty, and what we know as groups are actually, Distribution Lists. All Users, on the other hand, contains staff, but also shared mailboxes and resources (Projector, iPad), but not rooms. To make even one customization to all of this, ABPs are needed.

* ABP routing is an Exchange flag that has been enabled for our domain.
* An address book policy specifies the following:
: * 1 x '''Global Address List (GAL)''' - contains all objects (mailboxes, contacts, rooms etc.) that a user is able to "see". An ABP is linked to 1 GAL and therefore a user can only see 1 GAL.
: * 1 x '''Offline Address Book (OAB)''' - specifies one or more address lists to download/cache. To make it more confusing, the Offline Address Book behaves more like an address list.
: * 1 x '''Room Address List'''
: * 1 or more custom (or built-in) '''Address Lists''' - Address Lists are groupings that are subsetted from the GAL. For example, the built-in All Rooms address list filters for GAL objects where the ObjectType is RoomMailbox (not quite, but something to that effect).

Again, all these are created/set in PowerShell.

====Current address book policies====
There are two ABPs (default still exists but is not meant to be used).

{| class="wikitable"
|-
! Address Book Policy !! Global Address List !! Offline Address Book -> Offline Address List !! Room List !! Address Lists !! Notes
|-
| Staff Address Book Policy || Staff Global Address List || Staff Offline Address Book -> Offline Address List (Staff) || Rooms and Resources || Company Contacts, Distribution Lists, Staff, Public Folders || Should be the default assigned to staff members.
|-
| Executive Address Book Policy || Executive Global Address List || Executive Offline Address Book -> Offline Address List (Executive) || Rooms and Resources || Company Contacts, Company Contacts (Executive), Distribution Lists, Distribution Lists (Executive), Staff, Public Folders || Can see what staff see, and the private lists/contacts.
|}

''Congrats if you're still following at this point.''

====Address Lists and Filtering====
The usefuleness of address book policies lies in filtering (inclusion filtering), which is used to produce address lists. This is a big topic and is mostly PowerShell talk. Therefore, this is left for official technical docs, but provided are two examples to try and explain the concept:
* The address list '''Distribution Lists (Executive)''' specifies a filter that translates to:
:Include only objects where:
::* ObjectClass equals 'group'
::* DisplayName is like '*(Private)'
* The address list '''Staff''' specifies a filter that translates to:
::Include only objects where:
::* ObjectCategory equals 'person' AND 'user'
::* RecipientType does not equal 'RoomMailbox'
::* RecipientType does not equal 'EquipmentMailbox'

''These are not the exact filters used, they're meant to explain the concept only.''

====Relationship between contact management and ABPs====
It should be noted that contacts, groups, and group membership are not affected by address book policies. ABPs only affect what a user sees in the address book. A not-good analogy: you can take out pages of a phone directory and group them differently or put stickers over some entries so they're not visible (ABPs), but you don't change what's printed in the directory (that's contact management).

==Mail flow and mail rules==
===Connectors===
Because mail hosting for unipharm.com is spread over 2 servers, configuring Exchange "connectors" is necessary to properly route mail to and from MDaemon (the on-prem mail server). This is a complex topic and should be described on another page.

==Email security==
Email security is handled by Exchange Online Protection, a feature that comes with all Exchange Online / 365 accounts. It "sits" before the mail routing/delivery process - for both inbound and outbound mail flows - and checks messages for threats and spam. The policies determine what gets detected as spam/threats and the outcome of those messages. Depending on if the new or classic admin portal is being used, there are various areas to configure or tweak these policies:
:* In Classic Admin Center, these policies are found in the '''protection''' section.
:* In New Admin Center, these policies are found in a separate '''Security and Compliance''' Admin Center altogether, under '''Threat management'''.

===Malware policies===
* Email servers do a fairly good job detecting and blocking viruses in emails, silently. As an organization, we also don't deal with attachment types (.exe, audio/video containers etc.) that are normally flagged as viruses. Therefore, these policies have not been changed from the defaults.

===Spam policies===
* Unlike spam-handling pre-Exchange that involved a user quarantine, the current spam policy is set to direct spam to a user's junk folder.
:[[File:2021-03-30 15_50_03-edit spam filter policy.png|400px]]

====Spam scoring====
There are two scores related to spam-handling: SCL (Spam Confidence Level), and BCL (Bulk Complaint Level). The Bulk Complaint Level threshold can be set, but the SCL appears to be set (at least for Exchange Online). These values are 5 (spam) and 9 (high-confidence spam), according to [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide the docs]

Note: These scores are present in the message headers, and have been validated to make it all the way to MDaemon (in messages destined for non-Exchange mailboxes). Therefore, we could potentially capitalize on the spam and bulk scoring done by EOP by having MDaemon recognize and act on these headers.

===Phishing===
Phishing remains the greatest threat when it comes to email security. Without Advanced Threat Prection (additional cost on top of EOP), we rely on reputation-based and heuristic-based detection mechanisms of the email security service (EOP) to flag emails that contain phishing content. Barracuda did a fantastic job (very low penetration from empirical evidence). It remains to be seen how EOP handles these types of "attacks" (they come in waves).

==Security/AAA==
===Custom Admin Roles===
Exchange allows for the creation of custom admin roles that have a specific combination of permissions. For example, the Company Directory Management role was created to allow users to manage the address book:
::[[File:2021-03-23 11_58_18-Exchange admin center.png|400px]]

===Password policies===
* Password expiry has been disabled in 365 from the 90-day default:
::[[File:2021-03-23 12_14_04-Microsoft 365 admin center.png|border|400px]]
* Self-service password resets have been enabled in Azure AD. Users will be notified when they reset their passwords:
::[[File:2021-03-23 12_21_01-Password reset - Azure Active Directory admin center.png|400px|border]][[File:2021-03-23 12_23_00-Password reset - Azure Active Directory admin center.png|400px|border]]
* (Update this section with info on password management strategy when it gets discussed)

==DNS==
===MX settings===
The MX record for our common domains point to Exchange. We do not have a round-robin or fallback configuration. Mail routing between Exchange and MDaemon is done through connectors and smart-host configuration.

===SPF record===
SPF was implemented as part of the Exchange project. [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing?view=o365-worldwide This article] summarizes how SPF works and is configured for Exchange.

A web tool like MXToolbox can be used to verify the SPF record after changes are made:
::[[File:mtoolboxupipharmspf.png|400px]]

==Other Notes==
* Microsoft is currently transitioning from what they're now terming Classic Exchange admin center to the New Exchange admin center. Some options remain editable only in the old portal.

[[Category: Microsoft Exchange/365]]

Information Systems:Microsoft 365 Exchange Online - Setup and Configuration

2021-07-20T07:27:44Z

Norwinu: /* Contacts and Groups */

==Overview==
This wiki page attempts to document and discuss major topics of Exchange setup and configuration. This will be a mix of design/strategy talk and some how-tos for technical administration. Ultimately, another page should be made to adapt the information discussed here into more concise technical instructions for specific administration tasks.

Check [[Information Systems: Exchange and Outlook Administration|this page]] for how-tos. Any instructions below should eventually be migrated to that page as well.

==Mailboxes==
Users are essentially mailboxes in Exchange i.e. there is no Users section. In Exchange Online, a mailbox shows up when a user is created in 365 Admin Center.

===Shared Mailboxes===
Like groups/lists, shared mailboxes are communal to a group of users. But unlike groups/lists, they are actual mailboxes that accumulate mail. The company requires a few of these:
* Accounts Payable: accountspayable@unipharm.com
* Accounts Receivable: accountsreceivable@unipharm.com
* EDI Support: edisupport@unipharm.com
* Customer Service Voicemail: csvm@unipharm.com

====Adding a shared mailbox====
Given the limited number of shared mailboxes, and the company's particular use of them as mailbox "identities" rather than a communal email "sink", it has been decided to add shared mailboxes as separate accounts as opposed to opening them as additional mailboxes.

To add a shared mailbox:
* Remove any shared mailboxes previously opened as additional mailboxes (and not added as accounts).
* Perform the steps to add another email account (Office 365).
* Enter in the shared mailbox email.
* Instead of entering a password, click ''Sign in as another account''.
* Enter in the user's credentials. This will only work if the user has Full Access permissions to the shared mailbox (do this in EAC).

====Other methods====
The other ways of adding shared mailboxes are discussed here just for reference:

'''''Manually opening a shared mailbox'''''
:* In Outlook 2019, File -> Account Settings -> double-click account -> More Settings -> Advanced
:* In the Mailboxes section -> Add -> Enter exact Display Name of shared mailbox
:* Save/Apply

'''''Automapping'''''
:'''Note: Automapping has been disabled for all shared mailboxes.'''

:* Automapping is a feature that makes the shared mailboxes which a user has access to automatically visible in Outlook i.e. the shared mailboxes are automatically mapped to the user. This is enabled by default. There are implications:
::* Automapping lumps the data of shared mailboxes in the same OST file as the user's own mailbox. This is one of the reasons there is official documentation on how to disable automapping and [https://docs.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox how to reset an automapped Outlook configuration]. Considering the company's user base and computer/desktop assignments, this isn't expected to be a problem. But it's something to keep aware of. Imagine a case of 3 users that access 2 shared mailboxes ecah including their own, all logging in to the same computer with a 120GB SSD, with Outlook set to sync all mail. It is feasible for this to grow massively.
::* Automapping appears to be very finicky when mailbox delegation (permissions) are set to security groups instead of users. Discussion on the internet refers to having to reset permissions.

===Granting a user access to another mailbox===
The preferred method of granting a user access to another mailbox is to have them access to read (and send from, if necessary) using Outlook for web (OWA). This is especially true when access is only needed on a temporary basis. [[Information Systems:Exchange Online administration with PowerShell|The commands can be found here.]]

==Contacts and Groups==
===Contacts===
Contacts (or more accurately, Mail Contacts) in Exchange are analogous to address book entries: they're simply names with email addressses (and other attributes like address and phone numbers). This is in contrast with full Exchange "Users" that have mailboxes. Currently, the primary use of contacts is to maintain distribution lists (we don't maintain a company directory outside CNS, oddly enough).

====Shareholder email addresses====
In an attempt to maintain clean and consistent entries, several conventions for creating contacts have already been adopted, best depicted in the following example entry for the personal email associated with Marks Marine Pharmacy (the one that would go in the private/sensitive list). The Classic Exchange Admin Center is shown, as it exposes more fields:
::[[File:2021-03-06 22_15_29-Edit Mail Contact.png|400px|border]]

Recommendations when creating new entries:
* If this contact/email will be used in private/confidential list only, prefix the Display Name with [Private]. Also, check the 'Hide contacts from the address list'. You may need to do this in Classic EAC.
* If this contact will be a member of both private and general/publicly-visible distribution lists, do not prefix the name.

===Groups===
The term "groups" in Exchange can mean 1 of 4 things: Microsoft 365 Groups, Distribution Lists, Dynamic Distribution Lists, and Mail-enabled Security Groups. The first is not used whatsoever.
====Distribution Lists====
Distribution Lists are akin to the conventional mailing list, wherein an email sent to the group address is distributed to its members. This group type is used for the shareholder mailing lists (both general and private/confidential lists).

::[[File:2021-03-06 16_53_57-Edit Mail Contact.png|400px|border]]
* Some groups are meant to be internal (e.g IT group), while others are meant to also be addressable by users outside the organization (e.g. Returns). Check related permissions and set up aliases accordingly. For example, Returns group follows the convention returnsgroup@unpharm.com, but it is logical to have '''returns@unipharm.com''' as an alias, as this is a more common format for a public-facing contact email address (same as customerservice@unipharm.com).
::[[File:2021-03-06 14_58_33-Exchange admin center.png|200px|border]]
====Mail-enabled Security Groups====
This type of group is appropriate for the departments, as the group can be used to send to its members as well as for permissions (hence, "mail-enabled security group").

* The email address convention for department groups (and most other groups) is '''''department'''''group@unipharm.com.
* The following is an example of a configured group. The manager has been specified as a group owner (in addition to IT) to enable self-management.
::[[File:2021-03-06 14_41_32-Exchange admin center.png|300px|border]]

====Microsoft 365 groups====
This type of group has additional functionality to enable better collaboration for the group's members. The company currently does not collaborate in such a fashion for these to be useful (e.g. no Sharepoint, no Teams, no shared folders on cloud storage).

====Dynamic Distribution List=====
This is a good concept on paper as it allows distribution list membership to be dynamic based on attributes e.g. a Customer Service list could be set up to include any users with the "Department" user property set to "Customer Service". However, it was tested to have one major showstopping limitation - it is very inconvenient viewing current members of a DDL (i.e. has to be in PowerShell, and even then, it requires list iteration and filtering). Not being able to see the recipients severely limits its usefulness, and therefore, setting up the departments as dynamic lists was forgone as an endeavor to keep things simple.

====Nested groups====
'''A word of caution regarding nested groups.'''

Nesting groups within other groups generally leads to better-structured and therefore easier to manage permissions. This is especially true with Microsoft AD, where object hierarchy and the concept of RBAC are predominant (a user can be assigned one or more roles, which grants them the specific set of permissions associated with those roles). However, issues have been encountered with group nesting during setup, primarily related to "trying to get too fancy". The ultimate goal was to have permissions and group membership dynamically assigned based on attribute e.g. the user's department. This was found to not even be remotely achievable in Exchange. These general rules of thumb have been surmised from experimentation with group nesting:

* Nesting like group types appears to work. Distribution lists groups are ok to nest within other distribution list groups. The same goes for mail security groups.
* Nesting security groups can lead to some quirks, but is still recommended. For example, nested security groups seems to break shared mailbox automapping and ownership.
* Distribution list groups should not be nested within security groups (see point #1).

TL;DR - exercise caution when using group nesting, and assign permissions to users as a fallback (troubleshoot later).

==Address Book==
With Exchange address books, there exists two types of implementations: out-of-the-box or address book policies. This fork on the road comes early; either accept the out of the box functionality and do nothing else, or enter the world of address book policy routing and accept the more complex management. This of course depends on the needs of the company, and we needed and decided on the latter. This path also requires PowerShell (no options or visibility exists in EAC, besides the ability to assign an existing policy (created with PowerShell) to a user).

===Address book policies===
An address book policy allows you to customize what a user sees, from the sublists, to the contacts viewable in those sublists. For example, the default address book policy has the following address lists: All Groups, All Users, All Distribution Lists etc. It is both unintuitive if you are not fully invested in the Microsoft way. For example, we don't use Microsoft groups, so All Groups is empty, and what we know as groups are actually, Distribution Lists. All Users, on the other hand, contains staff, but also shared mailboxes and resources (Projector, iPad), but not rooms. To make even one customization to all of this, ABPs are needed.

* ABP routing is an Exchange flag that has been enabled for our domain.
* An address book policy specifies the following:
: * 1 x '''Global Address List (GAL)''' - contains all objects (mailboxes, contacts, rooms etc.) that a user is able to "see". An ABP is linked to 1 GAL and therefore a user can only see 1 GAL.
: * 1 x '''Offline Address Book (OAB)''' - specifies one or more address lists to download/cache. To make it more confusing, the Offline Address Book behaves more like an address list.
: * 1 x '''Room Address List'''
: * 1 or more custom (or built-in) '''Address Lists''' - Address Lists are groupings that are subsetted from the GAL. For example, the built-in All Rooms address list filters for GAL objects where the ObjectType is RoomMailbox (not quite, but something to that effect).

Again, all these are created/set in PowerShell.

====Current address book policies====
There are two ABPs (default still exists but is not meant to be used).

{| class="wikitable"
|-
! Address Book Policy !! Global Address List !! Offline Address Book -> Offline Address List !! Room List !! Address Lists !! Notes
|-
| Staff Address Book Policy || Staff Global Address List || Staff Offline Address Book -> Offline Address List (Staff) || Rooms and Resources || Company Contacts, Distribution Lists, Staff, Public Folders || Should be the default assigned to staff members.
|-
| Executive Address Book Policy || Executive Global Address List || Executive Offline Address Book -> Offline Address List (Executive) || Rooms and Resources || Company Contacts, Company Contacts (Executive), Distribution Lists, Distribution Lists (Executive), Staff, Public Folders || Can see what staff see, and the private lists/contacts.
|}

''Congrats if you're still following at this point.''

====Address Lists and Filtering====
The usefuleness of address book policies lies in filtering (inclusion filtering), which is used to produce address lists. This is a big topic and is mostly PowerShell talk. Therefore, this is left for official technical docs, but provided are two examples to try and explain the concept:
* The address list '''Distribution Lists (Executive)''' specifies a filter that translates to:
:Include only objects where:
::* ObjectClass equals 'group'
::* DisplayName is like '*(Private)'
* The address list '''Staff''' specifies a filter that translates to:
::Include only objects where:
::* ObjectCategory equals 'person' AND 'user'
::* RecipientType does not equal 'RoomMailbox'
::* RecipientType does not equal 'EquipmentMailbox'

''These are not the exact filters used, they're meant to explain the concept only.''

====Relationship between contact management and ABPs====
It should be noted that contacts, groups, and group membership are not affected by address book policies. ABPs only affect what a user sees in the address book. A not-good analogy: you can take out pages of a phone directory and group them differently or put stickers over some entries so they're not visible (ABPs), but you don't change what's printed in the directory (that's contact management).

==Mail flow and mail rules==
===Connectors===
Because mail hosting for unipharm.com is spread over 2 servers, configuring Exchange "connectors" is necessary to properly route mail to and from MDaemon (the on-prem mail server). This is a complex topic and should be described on another page.

==Email security==
Email security is handled by Exchange Online Protection, a feature that comes with all Exchange Online / 365 accounts. It "sits" before the mail routing/delivery process - for both inbound and outbound mail flows - and checks messages for threats and spam. The policies determine what gets detected as spam/threats and the outcome of those messages. Depending on if the new or classic admin portal is being used, there are various areas to configure or tweak these policies:
:* In Classic Admin Center, these policies are found in the '''protection''' section.
:* In New Admin Center, these policies are found in a separate '''Security and Compliance''' Admin Center altogether, under '''Threat management'''.

===Malware policies===
* Email servers do a fairly good job detecting and blocking viruses in emails, silently. As an organization, we also don't deal with attachment types (.exe, audio/video containers etc.) that are normally flagged as viruses. Therefore, these policies have not been changed from the defaults.

===Spam policies===
* Unlike spam-handling pre-Exchange that involved a user quarantine, the current spam policy is set to direct spam to a user's junk folder.
:[[File:2021-03-30 15_50_03-edit spam filter policy.png|400px]]

====Spam scoring====
There are two scores related to spam-handling: SCL (Spam Confidence Level), and BCL (Bulk Complaint Level). The Bulk Complaint Level threshold can be set, but the SCL appears to be set (at least for Exchange Online). These values are 5 (spam) and 9 (high-confidence spam), according to [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide the docs]

Note: These scores are present in the message headers, and have been validated to make it all the way to MDaemon (in messages destined for non-Exchange mailboxes). Therefore, we could potentially capitalize on the spam and bulk scoring done by EOP by having MDaemon recognize and act on these headers.

===Phishing===
Phishing remains the greatest threat when it comes to email security. Without Advanced Threat Prection (additional cost on top of EOP), we rely on reputation-based and heuristic-based detection mechanisms of the email security service (EOP) to flag emails that contain phishing content. Barracuda did a fantastic job (very low penetration from empirical evidence). It remains to be seen how EOP handles these types of "attacks" (they come in waves).

==Security/AAA==
===Custom Admin Roles===
Exchange allows for the creation of custom admin roles that have a specific combination of permissions. For example, the Company Directory Management role was created to allow users to manage the address book:
::[[File:2021-03-23 11_58_18-Exchange admin center.png|400px]]

===Password policies===
* Password expiry has been disabled in 365 from the 90-day default:
::[[File:2021-03-23 12_14_04-Microsoft 365 admin center.png|border|400px]]
* Self-service password resets have been enabled in Azure AD. Users will be notified when they reset their passwords:
::[[File:2021-03-23 12_21_01-Password reset - Azure Active Directory admin center.png|400px|border]][[File:2021-03-23 12_23_00-Password reset - Azure Active Directory admin center.png|400px|border]]
* (Update this section with info on password management strategy when it gets discussed)

==DNS==
===MX settings===
The MX record for our common domains point to Exchange. We do not have a round-robin or fallback configuration. Mail routing between Exchange and MDaemon is done through connectors and smart-host configuration.

===SPF record===
SPF was implemented as part of the Exchange project. [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing?view=o365-worldwide This article] summarizes how SPF works and is configured for Exchange.

A web tool like MXToolbox can be used to verify the SPF record after changes are made:
::[[File:mtoolboxupipharmspf.png|400px]]

==Other Notes==
* Microsoft is currently transitioning from what they're now terming Classic Exchange admin center to the New Exchange admin center. Some options remain editable only in the old portal.

[[Category: Microsoft Exchange/365]]

Information Systems:Microsoft 365 Exchange Online - Setup and Configuration

2021-07-20T07:27:05Z

Norwinu: Clarify, optimize info

==Overview==
This wiki page attempts to document and discuss major topics of Exchange setup and configuration. This will be a mix of design/strategy talk and some how-tos for technical administration. Ultimately, another page should be made to adapt the information discussed here into more concise technical instructions for specific administration tasks.

Check [[Information Systems: Exchange and Outlook Administration|this page]] for how-tos. Any instructions below should eventually be migrated to that page as well.

==Mailboxes==
Users are essentially mailboxes in Exchange i.e. there is no Users section. In Exchange Online, a mailbox shows up when a user is created in 365 Admin Center.

===Shared Mailboxes===
Like groups/lists, shared mailboxes are communal to a group of users. But unlike groups/lists, they are actual mailboxes that accumulate mail. The company requires a few of these:
* Accounts Payable: accountspayable@unipharm.com
* Accounts Receivable: accountsreceivable@unipharm.com
* EDI Support: edisupport@unipharm.com
* Customer Service Voicemail: csvm@unipharm.com

====Adding a shared mailbox====
Given the limited number of shared mailboxes, and the company's particular use of them as mailbox "identities" rather than a communal email "sink", it has been decided to add shared mailboxes as separate accounts as opposed to opening them as additional mailboxes.

To add a shared mailbox:
* Remove any shared mailboxes previously opened as additional mailboxes (and not added as accounts).
* Perform the steps to add another email account (Office 365).
* Enter in the shared mailbox email.
* Instead of entering a password, click ''Sign in as another account''.
* Enter in the user's credentials. This will only work if the user has Full Access permissions to the shared mailbox (do this in EAC).

====Other methods====
The other ways of adding shared mailboxes are discussed here just for reference:

'''''Manually opening a shared mailbox'''''
:* In Outlook 2019, File -> Account Settings -> double-click account -> More Settings -> Advanced
:* In the Mailboxes section -> Add -> Enter exact Display Name of shared mailbox
:* Save/Apply

'''''Automapping'''''
:'''Note: Automapping has been disabled for all shared mailboxes.'''

:* Automapping is a feature that makes the shared mailboxes which a user has access to automatically visible in Outlook i.e. the shared mailboxes are automatically mapped to the user. This is enabled by default. There are implications:
::* Automapping lumps the data of shared mailboxes in the same OST file as the user's own mailbox. This is one of the reasons there is official documentation on how to disable automapping and [https://docs.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox how to reset an automapped Outlook configuration]. Considering the company's user base and computer/desktop assignments, this isn't expected to be a problem. But it's something to keep aware of. Imagine a case of 3 users that access 2 shared mailboxes ecah including their own, all logging in to the same computer with a 120GB SSD, with Outlook set to sync all mail. It is feasible for this to grow massively.
::* Automapping appears to be very finicky when mailbox delegation (permissions) are set to security groups instead of users. Discussion on the internet refers to having to reset permissions.

===Granting a user access to another mailbox===
The preferred method of granting a user access to another mailbox is to have them access to read (and send from, if necessary) using Outlook for web (OWA). This is especially true when access is only needed on a temporary basis. [[Information Systems:Exchange Online administration with PowerShell|The commands can be found here.]]

==Contacts and Groups==
===Contacts===
Contacts (or more accurately, Mail Contacts) in Exchange are analogous to address book entries: they're simply names with email addressses (and other attributes like address and phone numbers). This is in contrast with full Exchange "Users" that have mailboxes. Currently, the primary use of contacts is to maintain distribution lists (we don't maintain a company directory outside CNS, oddly enough).

====Shareholder email addresses====
In an attempt to maintain clean and consistent entries, several conventions for creating contacts have already been adopted, best depicted in the following example entry for the personal email associated with Marks Marine Pharmacy (the one that would go in the private/sensitive list). The Classic Exchange Admin Center is shown, as it exposes more fields:
::[[File:2021-03-06 22_15_29-Edit Mail Contact.png|400px|border]]

Recommendations when creating new entries:
* If this contact/email will be used in private/confidential list only, prefix the Display Name with [Private]. Also, check the 'Hide contacts from the address list'. You may need to do this in Classic EAC.
* If this contact will be a member of both private and general/publicly-visible distribution lists, do not prefix the name.

===Groups===
The term "groups" in Exchange can mean 1 of 4 things: Microsoft 365 Groups, Distribution Lists, Dynamic Distribution Lists, and Mail-enabled Security Groups. The first is not used whatsoever.
====Distribution Lists====
Distribution Lists are akin to the conventional mailing list, wherein an email sent to the group address is distributed to its members. This group type is used for the shareholder mailing lists (both general and private/confidential lists).

::[[File:2021-03-06 16_53_57-Edit Mail Contact.png|400px|border]]
* Some groups are meant to be internal (e.g IT group), while others are meant to also be addressable by users outside the organization (e.g. Returns). Check related permissions and set up aliases accordingly. For example, Returns group follows the convention returnsgroup@unpharm.com, but it is logical to have '''returns@unipharm.com''' as an alias, as this is a more common format for a public-facing contact email address (same as customerservice@unipharm.com).
::[[File:2021-03-06 14_58_33-Exchange admin center.png|200px|border]]
====Mail-enabled Security Groups===
This type of group is appropriate for the departments, as the group can be used to send to its members as well as for permissions (hence, "mail-enabled security group").

* The email address convention for department groups (and most other groups) is '''''department'''''group@unipharm.com.
* The following is an example of a configured group. The manager has been specified as a group owner (in addition to IT) to enable self-management.
::[[File:2021-03-06 14_41_32-Exchange admin center.png|300px|border]]

====Microsoft 365 groups====
This type of group has additional functionality to enable better collaboration for the group's members. The company currently does not collaborate in such a fashion for these to be useful (e.g. no Sharepoint, no Teams, no shared folders on cloud storage).

====Dynamic Distribution List=====
This is a good concept on paper as it allows distribution list membership to be dynamic based on attributes e.g. a Customer Service list could be set up to include any users with the "Department" user property set to "Customer Service". However, it was tested to have one major showstopping limitation - it is very inconvenient viewing current members of a DDL (i.e. has to be in PowerShell, and even then, it requires list iteration and filtering). Not being able to see the recipients severely limits its usefulness, and therefore, setting up the departments as dynamic lists was forgone as an endeavor to keep things simple.

====Nested groups====
'''A word of caution regarding nested groups.'''

Nesting groups within other groups generally leads to better-structured and therefore easier to manage permissions. This is especially true with Microsoft AD, where object hierarchy and the concept of RBAC are predominant (a user can be assigned one or more roles, which grants them the specific set of permissions associated with those roles). However, issues have been encountered with group nesting during setup, primarily related to "trying to get too fancy". The ultimate goal was to have permissions and group membership dynamically assigned based on attribute e.g. the user's department. This was found to not even be remotely achievable in Exchange. These general rules of thumb have been surmised from experimentation with group nesting:

* Nesting like group types appears to work. Distribution lists groups are ok to nest within other distribution list groups. The same goes for mail security groups.
* Nesting security groups can lead to some quirks, but is still recommended. For example, nested security groups seems to break shared mailbox automapping and ownership.
* Distribution list groups should not be nested within security groups (see point #1).

TL;DR - exercise caution when using group nesting, and assign permissions to users as a fallback (troubleshoot later).

==Address Book==
With Exchange address books, there exists two types of implementations: out-of-the-box or address book policies. This fork on the road comes early; either accept the out of the box functionality and do nothing else, or enter the world of address book policy routing and accept the more complex management. This of course depends on the needs of the company, and we needed and decided on the latter. This path also requires PowerShell (no options or visibility exists in EAC, besides the ability to assign an existing policy (created with PowerShell) to a user).

===Address book policies===
An address book policy allows you to customize what a user sees, from the sublists, to the contacts viewable in those sublists. For example, the default address book policy has the following address lists: All Groups, All Users, All Distribution Lists etc. It is both unintuitive if you are not fully invested in the Microsoft way. For example, we don't use Microsoft groups, so All Groups is empty, and what we know as groups are actually, Distribution Lists. All Users, on the other hand, contains staff, but also shared mailboxes and resources (Projector, iPad), but not rooms. To make even one customization to all of this, ABPs are needed.

* ABP routing is an Exchange flag that has been enabled for our domain.
* An address book policy specifies the following:
: * 1 x '''Global Address List (GAL)''' - contains all objects (mailboxes, contacts, rooms etc.) that a user is able to "see". An ABP is linked to 1 GAL and therefore a user can only see 1 GAL.
: * 1 x '''Offline Address Book (OAB)''' - specifies one or more address lists to download/cache. To make it more confusing, the Offline Address Book behaves more like an address list.
: * 1 x '''Room Address List'''
: * 1 or more custom (or built-in) '''Address Lists''' - Address Lists are groupings that are subsetted from the GAL. For example, the built-in All Rooms address list filters for GAL objects where the ObjectType is RoomMailbox (not quite, but something to that effect).

Again, all these are created/set in PowerShell.

====Current address book policies====
There are two ABPs (default still exists but is not meant to be used).

{| class="wikitable"
|-
! Address Book Policy !! Global Address List !! Offline Address Book -> Offline Address List !! Room List !! Address Lists !! Notes
|-
| Staff Address Book Policy || Staff Global Address List || Staff Offline Address Book -> Offline Address List (Staff) || Rooms and Resources || Company Contacts, Distribution Lists, Staff, Public Folders || Should be the default assigned to staff members.
|-
| Executive Address Book Policy || Executive Global Address List || Executive Offline Address Book -> Offline Address List (Executive) || Rooms and Resources || Company Contacts, Company Contacts (Executive), Distribution Lists, Distribution Lists (Executive), Staff, Public Folders || Can see what staff see, and the private lists/contacts.
|}

''Congrats if you're still following at this point.''

====Address Lists and Filtering====
The usefuleness of address book policies lies in filtering (inclusion filtering), which is used to produce address lists. This is a big topic and is mostly PowerShell talk. Therefore, this is left for official technical docs, but provided are two examples to try and explain the concept:
* The address list '''Distribution Lists (Executive)''' specifies a filter that translates to:
:Include only objects where:
::* ObjectClass equals 'group'
::* DisplayName is like '*(Private)'
* The address list '''Staff''' specifies a filter that translates to:
::Include only objects where:
::* ObjectCategory equals 'person' AND 'user'
::* RecipientType does not equal 'RoomMailbox'
::* RecipientType does not equal 'EquipmentMailbox'

''These are not the exact filters used, they're meant to explain the concept only.''

====Relationship between contact management and ABPs====
It should be noted that contacts, groups, and group membership are not affected by address book policies. ABPs only affect what a user sees in the address book. A not-good analogy: you can take out pages of a phone directory and group them differently or put stickers over some entries so they're not visible (ABPs), but you don't change what's printed in the directory (that's contact management).

==Mail flow and mail rules==
===Connectors===
Because mail hosting for unipharm.com is spread over 2 servers, configuring Exchange "connectors" is necessary to properly route mail to and from MDaemon (the on-prem mail server). This is a complex topic and should be described on another page.

==Email security==
Email security is handled by Exchange Online Protection, a feature that comes with all Exchange Online / 365 accounts. It "sits" before the mail routing/delivery process - for both inbound and outbound mail flows - and checks messages for threats and spam. The policies determine what gets detected as spam/threats and the outcome of those messages. Depending on if the new or classic admin portal is being used, there are various areas to configure or tweak these policies:
:* In Classic Admin Center, these policies are found in the '''protection''' section.
:* In New Admin Center, these policies are found in a separate '''Security and Compliance''' Admin Center altogether, under '''Threat management'''.

===Malware policies===
* Email servers do a fairly good job detecting and blocking viruses in emails, silently. As an organization, we also don't deal with attachment types (.exe, audio/video containers etc.) that are normally flagged as viruses. Therefore, these policies have not been changed from the defaults.

===Spam policies===
* Unlike spam-handling pre-Exchange that involved a user quarantine, the current spam policy is set to direct spam to a user's junk folder.
:[[File:2021-03-30 15_50_03-edit spam filter policy.png|400px]]

====Spam scoring====
There are two scores related to spam-handling: SCL (Spam Confidence Level), and BCL (Bulk Complaint Level). The Bulk Complaint Level threshold can be set, but the SCL appears to be set (at least for Exchange Online). These values are 5 (spam) and 9 (high-confidence spam), according to [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide the docs]

Note: These scores are present in the message headers, and have been validated to make it all the way to MDaemon (in messages destined for non-Exchange mailboxes). Therefore, we could potentially capitalize on the spam and bulk scoring done by EOP by having MDaemon recognize and act on these headers.

===Phishing===
Phishing remains the greatest threat when it comes to email security. Without Advanced Threat Prection (additional cost on top of EOP), we rely on reputation-based and heuristic-based detection mechanisms of the email security service (EOP) to flag emails that contain phishing content. Barracuda did a fantastic job (very low penetration from empirical evidence). It remains to be seen how EOP handles these types of "attacks" (they come in waves).

==Security/AAA==
===Custom Admin Roles===
Exchange allows for the creation of custom admin roles that have a specific combination of permissions. For example, the Company Directory Management role was created to allow users to manage the address book:
::[[File:2021-03-23 11_58_18-Exchange admin center.png|400px]]

===Password policies===
* Password expiry has been disabled in 365 from the 90-day default:
::[[File:2021-03-23 12_14_04-Microsoft 365 admin center.png|border|400px]]
* Self-service password resets have been enabled in Azure AD. Users will be notified when they reset their passwords:
::[[File:2021-03-23 12_21_01-Password reset - Azure Active Directory admin center.png|400px|border]][[File:2021-03-23 12_23_00-Password reset - Azure Active Directory admin center.png|400px|border]]
* (Update this section with info on password management strategy when it gets discussed)

==DNS==
===MX settings===
The MX record for our common domains point to Exchange. We do not have a round-robin or fallback configuration. Mail routing between Exchange and MDaemon is done through connectors and smart-host configuration.

===SPF record===
SPF was implemented as part of the Exchange project. [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing?view=o365-worldwide This article] summarizes how SPF works and is configured for Exchange.

A web tool like MXToolbox can be used to verify the SPF record after changes are made:
::[[File:mtoolboxupipharmspf.png|400px]]

==Other Notes==
* Microsoft is currently transitioning from what they're now terming Classic Exchange admin center to the New Exchange admin center. Some options remain editable only in the old portal.

[[Category: Microsoft Exchange/365]]

Information Systems:Managing contacts and groups in Exchange (non-admin)

2021-07-20T06:59:46Z

Norwinu:

This page details instructions for managing contacts and groups in Exchange. It is intended for those with the [[Information Systems:Microsoft 365 Exchange Online - Setup and Configuration#Custom_Admin_Roles|Company Directory Management Role]] in Exchange.

==Web Portal==
Exchange Admin Center is the name of the web portal for management of contacts and groups.

* Log in using your Exchange/email credentials to:
:[https://admin.exchange.microsoft.com/ Exchange Admin Center]

==Managing contacts==
The Contacts section contains contacts, which are akin to entries in a conventional phone/email directory. The entries found here can be added to mailing lists (see [[#Managing Groups]]). Staff are not found here,
::[[File:2021-03-23 13_19_37-Exchange admin center.png|400px|border]]
'''Note: Contact email addresses will be prefixed with "SMTP:". It can be ignored and is managed automatically when adding/editing contacts.'''
===Adding contacts===
* Clicking ''Add a contact'' brings up following dialog box
::[[File:2021-03-23 13_29_49-Exchange admin center.png|400px|border]]
* Select ''Mail contact'' as the contact type.
* Enter the ''Display name'' and ''Email''.
:* If this is a store/pharmacy contact, ''First name'' and ''Last name'' can be skipped. These fields are useful if more than one contact/email exists for the store.
:* If this is a contact that will '''only''' be found in the Sensitive/Confidential lists, then the following steps apply:
::* Prefix the display name with ''[Private]'' (this is the current convention, it may be revised).
::* Save the contact.
::* Enter Classic Admin Center via the link/option on the left menu pane.
::* Navigate to ''recipients'' -> ''contacts''.
:::: [[File:2021-03-23 13_42_36-.png|400px]]
::* Find and double click the contact just created.
::* Check the following setting:
:::: [[File:2021-03-23 13_46_11-Edit Mail Contact.png|200px]]
::* Return to the New Exchange Admin Center

===Editing contacts===
* Click an existing contact to edit its fields. See note above about the SMTP: prefix.
==Managing Groups==
===Adding a group===
===Editing group membership===
==Other Notes==
===Address Book Delegation===

[[Category: Microsoft Exchange/365]]
[[Category: Email]]

Information Systems:Microsoft 365 Exchange Online - Setup and Configuration

2021-07-20T03:59:57Z

Norwinu: /* Groups */

==Overview==
This wiki page attempts to document and discuss major topics of Exchange setup and configuration. This will be a mix of design/strategy talk and some how-tos for technical administration. Ultimately, another page should be made to adapt the information discussed here into more concise technical instructions for specific administration tasks.

Check [[Information Systems: Exchange and Outlook Administration|this page]] for how-tos. Any instructions below should eventually be migrated to that page as well.

==Mailboxes==
Users are essentially mailboxes in Exchange i.e. there is no Users section. In Exchange Online, a mailbox shows up when a user is created in 365 Admin Center.

===Shared Mailboxes===
Like groups/lists, shared mailboxes are communal to a group of users. But unlike groups/lists, they are actual mailboxes that accumulate mail. The company requires a few of these:
* Accounts Payable: accountspayable@unipharm.com
* Accounts Receivable: accountsreceivable@unipharm.com
* EDI Support: edisupport@unipharm.com
* Customer Service Voicemail: csvm@unipharm.com

====Adding a shared mailbox====
Given the limited number of shared mailboxes, and the company's particular use of them as mailbox "identities" rather than a communal email "sink", it has been decided to add shared mailboxes as separate accounts as opposed to opening them as additional mailboxes.

To add a shared mailbox:
* Remove any shared mailboxes previously opened as additional mailboxes (and not added as accounts).
* Perform the steps to add another email account (Office 365).
* Enter in the shared mailbox email.
* Instead of entering a password, click ''Sign in as another account''.
* Enter in the user's credentials. This will only work if the user has Full Access permissions to the shared mailbox (do this in EAC).

====Other methods====
The other ways of adding shared mailboxes are discussed here just for reference:

'''''Manually opening a shared mailbox'''''
:* In Outlook 2019, File -> Account Settings -> double-click account -> More Settings -> Advanced
:* In the Mailboxes section -> Add -> Enter exact Display Name of shared mailbox
:* Save/Apply

'''''Automapping'''''
:'''Note: Automapping has been disabled for all shared mailboxes.'''

:* Automapping is a feature that makes the shared mailboxes which a user has access to automatically visible in Outlook i.e. the shared mailboxes are automatically mapped to the user. This is enabled by default. There are implications:
::* Automapping lumps the data of shared mailboxes in the same OST file as the user's own mailbox. This is one of the reasons there is official documentation on how to disable automapping and [https://docs.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/remove-automapping-for-shared-mailbox how to reset an automapped Outlook configuration]. Considering the company's user base and computer/desktop assignments, this isn't expected to be a problem. But it's something to keep aware of. Imagine a case of 3 users that access 2 shared mailboxes ecah including their own, all logging in to the same computer with a 120GB SSD, with Outlook set to sync all mail. It is feasible for this to grow massively.
::* Automapping appears to be very finicky when mailbox delegation (permissions) are set to security groups instead of users. Discussion on the internet refers to having to reset permissions.

===Granting a user access to another mailbox===
The preferred method of granting a user access to another mailbox is to have them access to read (and send from, if necessary) using Outlook for web (OWA). This is especially true when access is only needed on a temporary basis. [[Information Systems:Exchange Online administration with PowerShell|The commands can be found here.]]

==Contacts and Groups==
===Contacts===
Contacts are non-Exchange users i.e. either external to the organization e.g. a shareholder store. For now, the primary use of contacts is the distribution lists. Unlike in the previous Lotus Notes system where these contacts were merely email addresses e.g. "strings", contacts in Exchange are "objects" and therefore have attributes like Company, First Name, Phone Number etc. This makes it feasible to have a directory of external contacts instead of just internal users.
====Shareholder email addresses====
Note: It is not yet a company policy to maintain an address book of individual shareholder emails in Exchange/Outlook. These contacts are maintained for the sake of the mailing lists.
In an attempt to maintain clean and consistent entries, several conventions have already been put into play, best depicted in the following example entry for the personal email associated with Marks Marine Pharmacy (the one that would go in the private/sensitive list). The Classic Exchange admin center is shown as it exposes more fields:
::[[File:2021-03-06 22_15_29-Edit Mail Contact.png|400px|border]]

Recommendations when creating new entries:
* If this contact/email will be used in private/confidential list only, prefix the Display Name with [Private]. Also, check the 'Hide contacts from the address list'. You may need to do this in Classic EAC.
* If this contact will be a member of both private and general/publicly-visible distribution lists, do not prefix the name.

===Groups===
{{quote|03/31/2021 - Take these docs with a grain of salt, there's a lot of changes right now}}
The term "groups" in Exchange is encompassing of distribution lists and security groups (permissions). There are 4 types of Exchange groups. The two used primarily are ''Distribution list'' groups and ''Mail security'' groups. The former is equivalent to the idea of a conventional mailing list, wherein an email sent to the group address is distributed to its members. The latter is used for assigning permissions.
====Distribution Lists====
* The email address convention for department-based groups (and most other groups) is ''department''group@unipharm.com
* The following is an example of a configured group. The manager has been specified as a group owner in addition to IT to enable self-management.
::[[File:2021-03-06 14_41_32-Exchange admin center.png|300px|border]]
* Some groups are meant to be internal (e.g IT group), while others are meant to also be addressable by users outside the organization (e.g. Returns). Check related permissions and set up aliases accordingly. For example, Returns group follows the convention returnsgroup@unpharm.com, but it is logical to have '''returns@unipharm.com''' as an alias, as this is a more common format for a public-facing contact email address (same as customerservice@unipharm.com).
::[[File:2021-03-06 14_58_33-Exchange admin center.png|200px|border]]

====Shareholder mailing lists====
There exist several mailing lists for correspondence with shareholders and associate members. Refer to the Contacts section above for how shareholder email addresses are maintained.

====Sensitive mailing lists====
A few of the distribution lists are for sending confidential information to shareholders and associate members, and therefore have the 'Specified senders' permissons set. The option to prevent these lists and their constituent contacts from being displayed in the global address book should also be checked. The ability to hide contacts from address lists appears to currently be available only in the Classic admin center:
::[[File:2021-03-06 16_53_57-Edit Mail Contact.png|400px|border]]

====Other group types====
* '''Microsoft 365 groups''' have additional functionality to enable better collaboration for the group's members. The company currently does not collaborate in such a fashion for these to be useful (e.g. no Sharepoint, no Teams, no shared folders on cloud storage).
* '''Dynamic distribution list''' is a good concept on paper as it allows distribution list membership to be dynamic based on attributes e.g. a Customer Service list could be set up to include any users with the "Department" user property set to "Customer Service". However, it was tested to have one major showstopping limitation - it is very inconvenient viewing current members of a DDL (i.e. has to be in PowerShell, and even then, it requires list iteration and filtering). Not being able to see the recipients severely limits its usefulness, and therefore, setting up the departments as dynamic lists was forgone as an endeavor to keep things simple.

====Nested groups====
'''A word of caution regarding nested groups.'''

Nesting groups within other groups generally makes sense when it comes to permissions. This is especially true with Microsoft AD, where object hierarchy and the concept of RBAC are predominant (a user can be assigned one or more roles, which grants them the specific set of permissions associated with those roles). However, issues have been encountered with group nesting during setup, primarily related to "trying to get too fancy". The ultimate goal was to have permissions and group membership dynamically assigned based on attribute e.g. the user's department. This was found to not even be remotely achievable in Exchange. These general rules of thumb have been surmised from experimentation with group nesting:

* Nesting like group types appears to work. Distribution lists groups are ok to nest within other distribution list groups. The same goes for mail security groups.
* Nesting security groups can lead to some quirks, but is still recommended. For example, nested security groups seems to break shared mailbox automapping and ownership.
* Distribution list groups should not be nested within security groups (see point #1).

TL;DR - exercise caution when using group nesting, and assign permissions to users as a fallback (troubleshoot later).

==Address Book==
With Exchange address books, there exists two types of implementations: out-of-the-box or address book policies. This fork on the road comes early; either accept the out of the box functionality and do nothing else, or enter the world of address book policy routing and accept the more complex management. This of course depends on the needs of the company, and we needed and decided on the latter. This path also requires PowerShell (no options or visibility exists in EAC, besides the ability to assign an existing policy (created with PowerShell) to a user).

===Address book policies===
An address book policy allows you to customize what a user sees, from the sublists, to the contacts viewable in those sublists. For example, the default address book policy has the following address lists: All Groups, All Users, All Distribution Lists etc. It is both unintuitive if you are not fully invested in the Microsoft way. For example, we don't use Microsoft groups, so All Groups is empty, and what we know as groups are actually, Distribution Lists. All Users, on the other hand, contains staff, but also shared mailboxes and resources (Projector, iPad), but not rooms. To make even one customization to all of this, ABPs are needed.

* ABP routing is an Exchange flag that has been enabled for our domain.
* An address book policy specifies the following:
: * 1 x '''Global Address List (GAL)''' - contains all objects (mailboxes, contacts, rooms etc.) that a user is able to "see". An ABP is linked to 1 GAL and therefore a user can only see 1 GAL.
: * 1 x '''Offline Address Book (OAB)''' - specifies one or more address lists to download/cache. To make it more confusing, the Offline Address Book behaves more like an address list.
: * 1 x '''Room Address List'''
: * 1 or more custom (or built-in) '''Address Lists''' - Address Lists are groupings that are subsetted from the GAL. For example, the built-in All Rooms address list filters for GAL objects where the ObjectType is RoomMailbox (not quite, but something to that effect).

Again, all these are created/set in PowerShell.

====Current address book policies====
There are two ABPs (default still exists but is not meant to be used).

{| class="wikitable"
|-
! Address Book Policy !! Global Address List !! Offline Address Book -> Offline Address List !! Room List !! Address Lists !! Notes
|-
| Staff Address Book Policy || Staff Global Address List || Staff Offline Address Book -> Offline Address List (Staff) || Rooms and Resources || Company Contacts, Distribution Lists, Staff, Public Folders || Should be the default assigned to staff members.
|-
| Executive Address Book Policy || Executive Global Address List || Executive Offline Address Book -> Offline Address List (Executive) || Rooms and Resources || Company Contacts, Company Contacts (Executive), Distribution Lists, Distribution Lists (Executive), Staff, Public Folders || Can see what staff see, and the private lists/contacts.
|}

''Congrats if you're still following at this point.''

====Address Lists and Filtering====
The usefuleness of address book policies lies in filtering (inclusion filtering), which is used to produce address lists. This is a big topic and is mostly PowerShell talk. Therefore, this is left for official technical docs, but provided are two examples to try and explain the concept:
* The address list '''Distribution Lists (Executive)''' specifies a filter that translates to:
:Include only objects where:
::* ObjectClass equals 'group'
::* DisplayName is like '*(Private)'
* The address list '''Staff''' specifies a filter that translates to:
::Include only objects where:
::* ObjectCategory equals 'person' AND 'user'
::* RecipientType does not equal 'RoomMailbox'
::* RecipientType does not equal 'EquipmentMailbox'

''These are not the exact filters used, they're meant to explain the concept only.''

====Relationship between contact management and ABPs====
It should be noted that contacts, groups, and group membership are not affected by address book policies. ABPs only affect what a user sees in the address book. A not-good analogy: you can take out pages of a phone directory and group them differently or put stickers over some entries so they're not visible (ABPs), but you don't change what's printed in the directory (that's contact management).

==Mail flow and mail rules==
===Connectors===
Because mail hosting for unipharm.com is spread over 2 servers, configuring Exchange "connectors" is necessary to properly route mail to and from MDaemon (the on-prem mail server). This is a complex topic and should be described on another page.

==Email security==
Email security is handled by Exchange Online Protection, a feature that comes with all Exchange Online / 365 accounts. It "sits" before the mail routing/delivery process - for both inbound and outbound mail flows - and checks messages for threats and spam. The policies determine what gets detected as spam/threats and the outcome of those messages. Depending on if the new or classic admin portal is being used, there are various areas to configure or tweak these policies:
:* In Classic Admin Center, these policies are found in the '''protection''' section.
:* In New Admin Center, these policies are found in a separate '''Security and Compliance''' Admin Center altogether, under '''Threat management'''.

===Malware policies===
* Email servers do a fairly good job detecting and blocking viruses in emails, silently. As an organization, we also don't deal with attachment types (.exe, audio/video containers etc.) that are normally flagged as viruses. Therefore, these policies have not been changed from the defaults.

===Spam policies===
* Unlike spam-handling pre-Exchange that involved a user quarantine, the current spam policy is set to direct spam to a user's junk folder.
:[[File:2021-03-30 15_50_03-edit spam filter policy.png|400px]]

====Spam scoring====
There are two scores related to spam-handling: SCL (Spam Confidence Level), and BCL (Bulk Complaint Level). The Bulk Complaint Level threshold can be set, but the SCL appears to be set (at least for Exchange Online). These values are 5 (spam) and 9 (high-confidence spam), according to [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide the docs]

Note: These scores are present in the message headers, and have been validated to make it all the way to MDaemon (in messages destined for non-Exchange mailboxes). Therefore, we could potentially capitalize on the spam and bulk scoring done by EOP by having MDaemon recognize and act on these headers.

===Phishing===
Phishing remains the greatest threat when it comes to email security. Without Advanced Threat Prection (additional cost on top of EOP), we rely on reputation-based and heuristic-based detection mechanisms of the email security service (EOP) to flag emails that contain phishing content. Barracuda did a fantastic job (very low penetration from empirical evidence). It remains to be seen how EOP handles these types of "attacks" (they come in waves).

==Security/AAA==
===Custom Admin Roles===
Exchange allows for the creation of custom admin roles that have a specific combination of permissions. For example, the Company Directory Management role was created to allow users to manage the address book:
::[[File:2021-03-23 11_58_18-Exchange admin center.png|400px]]

===Password policies===
* Password expiry has been disabled in 365 from the 90-day default:
::[[File:2021-03-23 12_14_04-Microsoft 365 admin center.png|border|400px]]
* Self-service password resets have been enabled in Azure AD. Users will be notified when they reset their passwords:
::[[File:2021-03-23 12_21_01-Password reset - Azure Active Directory admin center.png|400px|border]][[File:2021-03-23 12_23_00-Password reset - Azure Active Directory admin center.png|400px|border]]
* (Update this section with info on password management strategy when it gets discussed)

==DNS==
===MX settings===
The MX record for our common domains point to Exchange. We do not have a round-robin or fallback configuration. Mail routing between Exchange and MDaemon is done through connectors and smart-host configuration.

===SPF record===
SPF was implemented as part of the Exchange project. [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-spf-in-office-365-to-help-prevent-spoofing?view=o365-worldwide This article] summarizes how SPF works and is configured for Exchange.

A web tool like MXToolbox can be used to verify the SPF record after changes are made:
::[[File:mtoolboxupipharmspf.png|400px]]

==Other Notes==
* Microsoft is currently transitioning from what they're now terming Classic Exchange admin center to the New Exchange admin center. Some options remain editable only in the old portal.

[[Category: Microsoft Exchange/365]]

Information Systems:Server Hardware Inventory and Assessment (2021)

2021-07-20T03:37:03Z

Norwinu:

{| class="wikitable"
|-
! Server name !! Server model !! Server description !! CPU !! RAM installed (GB) !! Storage (GB) !! Storage controller !! Notes
|-
| VMHost01 || X3650 M5 || ESXi virtualization host 1 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 5000 (6x1TB in RAID-5) || M5210 || -
|-
| VMHost02 || X3650 M5 || ESXi virtualization host 2 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 5000 (6x1TB in RAID-5) || M5210 || -
|-
| VMHost03 || X3550 M5 || ESXi virtualization host 3 || 2 x E5-2620 v3 || 32 (2x16) || 480 (2x240GB in RAID-0 || M5210 || -
|-
| UWDDC3 (former) || X3250 M5 || Former domain controller, physical server || E3-1230 || 16 || 2x128GB || - || -
|-
| UWDDC4 (former) || X3250 M5 || Former domain controller, physical server || E3-1230 || 16 || 2x128GB || -
|-
| Stewie || X3550 M4 || Unused || E5-2620 v2 || 8 || - || Can be replaced with 2xE5-2650 v2 = 16c/32t for very cheap!
|-
| Veeam || X3650 M3 || Currently a Veeam proof-of-concept machine. || E5620 || - || - || - || Should be an archive server. Should have more SSDs.
|}

==Notes==
* Same-generation servers use the same hard drive caddies.

==Ideas==
* Decommission old Superserver/Veeam machine.
* Decommission Stewie
* Add and reconfigure storage on VMHost03
* Reinstate UWDDC3/4 i.e. reinstall in the rack.
:* Create backup server out of one of these
:* Use the other as a play server
* Buy 32GB more memory for VMHost03 (https://www.axiomupgrades.com/productdetail/01KN301-AX/)

[[Category: Servers]]
[[Category: I.T. Projects and Ideas]]

Information Systems:Server Hardware Inventory and Assessment (2021)

2021-07-20T03:35:52Z

Norwinu: Updated with 2021 info

{| class="wikitable"
|-
! Server name !! Server model !! Server description !! CPU !! RAM installed (GB) !! Storage (GB) !! Storage controller !! Notes
|-
| VMHost01 || X3650 M5 || ESXi virtualization host 1 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 5000 (6x1TB in RAID-5) || M5210 || -
|-
| VMHost02 || X3650 M5 || ESXi virtualization host 2 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 5000 (6x1TB in RAID-5) || M5210 || -
|-
| VMHost03 || X3550 M5 || ESXi virtualization host 3 || 2 x E5-2620 v3 || 32 (2x16) || 480 (2x240GB in RAID-0 || M5210 || -
|-
| UWDDC3 (former) || X3250 M5 || Former domain controller, physical server || E3-1230 || 16 || 2x128GB || - || -
|-
| UWDDC4 (former) || X3250 M5 || Former domain controller, physical server || E3-1230 || 16 || 2x128GB || -
|-
| Stewie || X3550 M4 || Current Toshiba eManager/ACD Server || E5-2620 v2 || 8 || - || -
|-
| Veeam || X3650 M3 || Currently a Veeam proof-of-concept machine. || E5620 || - || - || Should be an archive server. Should have more SSDs.
|}

==Notes==
* Same-generation servers use the same hard drive caddies.

==Ideas==
* Decommission old Superserver/Veeam machine.
* Decommission Stewie
* Add and reconfigure storage on VMHost03
* Reinstate UWDDC3/4 i.e. reinstall in the rack.
:* Create backup server out of one of these
:* Use the other as a play server
* Buy 32GB more memory for VMHost03 (https://www.axiomupgrades.com/productdetail/01KN301-AX/)

[[Category: Servers]]
[[Category: I.T. Projects and Ideas]]

Information Systems:Server Hardware Inventory and Assessment (2019)

2021-07-20T03:31:28Z

Norwinu: Norwinu moved page Information Systems:Server Hardware Inventory and Assessment (2019) to Information Systems:Server Hardware Inventory and Assessment (2021): New iteration

#REDIRECT [[Information Systems:Server Hardware Inventory and Assessment (2021)]]

Information Systems:Server Hardware Inventory and Assessment (2021)

2021-07-20T03:31:28Z

Norwinu: Norwinu moved page Information Systems:Server Hardware Inventory and Assessment (2019) to Information Systems:Server Hardware Inventory and Assessment (2021): New iteration

{| class="wikitable"
|-
! Server name !! Server model !! Server description !! CPU !! RAM installed (GB) !! Storage (GB) !! Storage controller
|-
| VMHost01 || X3650 M5 || ESXi virtualization host 1 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 3000 || M5210
|-
| VMHost02 || X3650 M5 || ESXi virtualization host 2 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 3000 || M5210
|-
| VMHost03 || X3550 M5 || ESXi virtualization host 3 || 2 x E5-2620 v3 || 32 (2x16) || - || M5210
|-
| UWDDC3 (former) || X3250 M5 || Former domain controller, physical server || E3-1240 || 8 || 128 || -
|-
| UWDDC4 (former) || X3250 M5 || Former domain controller, physical server || E3-1240 || 8 || 128 || -
|-
| Stewie || X3550 M4 || Current Toshiba eManager/ACD Server || - || - || - || -
|-
| Veeam || X3650 M3 || Old superserver. Currently a Veeam proof-of-concept machine. || E5620 || - || - || -
|}

==Notes==
* M5 series use the same drive caddies.
* Veeam/Superserver was supposed to be used as a backup server because of the 16 bays. However, too old of a platform.

==Ideas==
* Decommission old Superserver/Veeam machine.
* Decommission Stewie
* Add and reconfigure storage on VMHost03
* Reinstate UWDDC3/4 i.e. reinstall in the rack.
:* Create backup server out of one of these
:* Use the other as a play server
* Buy 32GB more memory for VMHost03 (https://www.axiomupgrades.com/productdetail/01KN301-AX/)

[[Category: Servers]]
[[Category: I.T. Projects and Ideas]]

Information Systems:UniPHARM eLearning Web Server Administration

2021-07-20T03:29:59Z

Norwinu:

The information on this page is no longer relevant; eLearning software has been relocated to [[Information Systems: Owl LAMP server| Owl LAMP server]].

Placeholder for detailing Apache, MySQL, PHP installation on Smithers to host Moodle and Mediawiki.

=Cut-and-paste from another section=
These are all open-source software and available to use for both personal and commercial use. They do not come with commercial support (except for MySQL, which has a commercial option i.e. the software is based on the same source code but comes with paid support), and are community-maintained. As such, there is no default way to install these programs.

==Folder structure and versions==
Current versions of software being used:
*Apache: 2.4.16 (For 64-bit Windows)
**Install directory: C:\uniPHARM eLearning\Apache24
*MySQL: 5.6
**C:\Program Files\MySQL\MySQL Server 5.6
*PHP: 5
*MediaWiki:
*Moodle: 2.9

[[Category: uniKB Wiki]]
[[Category: Archived Pages]]

Information Systems:UniPHARM eLearning Web Server Administration

2021-07-20T03:29:44Z

Norwinu:

Information Systems:Laser Printers

2021-07-20T03:12:09Z

Norwinu: Grammatical

This article is to keep track of the laser printers used in the Distribution Centre and Office ''that uniPHARM owns.'' For the ''leased/managed'' Xerox copiers, refer to [[Information Systems:Xerox printers|this article]]
==Inventory==
The following table summarizes our printer inventory:
{| class="wikitable"
|-
! Hostname !! Location !! Model !! Notes
|-
| gm-printer || GM's office || Brother MFC-L3770CDW || -
|-
| it-lab-printer || IT Lab/Cage || Lexmark MS415DN || -
|-
| buying-dept-printer || Buying Department || Lexmark MS415DN || -
|-
| accounting-dept-printer || Accounting Department || Lexmark MS415DN || -
|-
| dc-office-printer || DC Office || Lexmark MS415DN || -
|-
| dc-large-down-invoice-printer || DC Large Down || Lexmark MS521DN || -
|-
| dc-fridge-invoice-printer || DC Fridge || Lexmark MS521DN || -
|-
| dc-narc-invoice-printer || DC Narc Cage || Lexmark MS521DN || -
|}

===Distribution Centre Printers===
Lexmark laser printers are used for printing invoices at each picking station (warehouse zone) in the Distribution Centre. The current models are the MS521 and T652, which replaced the previous T640s and T630s (some may still remain). While there is no restriction on the use of other brands of laser printers (HP for example) it is a best practice to keep the number of brands as close to 1 as possible so that users don't have to adjust to 10 different print drivers. The laser printer at each of the picking stations is connected to the HP JetDirect print servers with a parallel cable, but these are being transitioned to Ethernet connectivity. Keep in mind that the JetDirect-connected printers are not visible on the network and therefore are not "fully configured". The advantage to this is that they can be interchanged easily e.g. with printers in other zones, but this method is being retired in favor of fully networked printers.

The Lexmark printers at the picking stations are not set up as shared network printers from a Windows print server. The HP boxes are configured as TCP/IP printers on the Lucy Jetforms server, but they are not shared so that users can print to them.

===Office Laser Printers===
Lexmark printers are also used for departmental/workgroup printing. The current model is the MS417. These are [[Information Systems:Domain Printers (Windows Shared Printers)|shared through Windows]].

==Management==
===Setup===
Other articles exist that detail different setup processes depending on where/how the printer is used (IBM i printer, Windows printer etc.)

===Consumables===
Toner replacement is very common in the warehouse and so has become self-service (they order and replace the toner themselves). It doesn't help that the printers were not networked before and so IT could not proactively replace toner before it ran out. For departmental/office printers, IT initiates the internal order and does the replacement themselves.

Maintenance kits on the other hand, must be done on a case-by-case basis, as they are expensive and thus it may make more sense to buy a replacement printer. These kits, while user-installable, also require more effort to install, which must be factored in as well.

==Troubleshooting==
====Invoices not printing====
* If the Lexmark still does not print an invoice then power cycle the HP print server box at the picking station.
* If that still doesn't work then check the network cable (of the print server). If the green lights on the HP print server box are not blinking rapidly then there is no valid network connection.
* There are spare JetDirect servers in the IT Lab (cage), but these are virtually unconfigurable (require XP).
====Bad print quality====
* Try another toner cartridge. Regardless of toner level, sometimes a replacement can improve/fix image quality. This is because the fuser is built into the toner cartridge for some of these high-volume workgroup printers, and a dirty fuser causes bad print quality
====Maintenance warning (fuser)====
This is more than likely referring to the fuser; a fixed page counter triggers an alert to purchase a maintenance kit to replace a core set of printer parts (fuser, rollers etc.). There are some tips to keep in mind:
* The printer can still function if this message is bypassed.
* The print quality may be fine despite this message. It is only a recommendation that is triggered by the page count (I think...)
* The maintenance counter can be reset.
* If you need to install a new fuser into the LP05 printer in accounting (C748 model) and the printer refuses to see a brand new fuser as a brand new fuser, reboot the printer while holding down the 2 and the 6 buttons on the front panel. The printer will boot into a special configuration menu where you have to reset the page counter on the new fuser. I suppose you could do this same trick when that printer prompts for a new fuser because that printer eats consumables like the fat Austrian kid on the Simpsons eats chocolate.
* To reset the T650/52 d/dn maintenance counter turn the power off, hold the check mark and the right arrow while turning on and wait for the 128mb to flash then wait for the config menu.Reset the maintenance clock from there.
====Paper jam (Lexmark)====
At least for the Lexmark printers, some paper jam error messages correlate to worn paper pickup rollers, so this is the first thing to check after an actual paper jam has been ruled out (which the users would resolve themselves). Remove the tray, and this part is then located above where the paper would be (its job is to pick up a sheet of paper from the tray and feed it into where the printing occurs. As per Lexmark docs, a quick test and temporary workaround is to turn the rubber inside out. The entire roller assembly can be removed, or the rubber can be removed in-place (check YouTube or online pics). Once turned inside out, if it starts to pick up paper again, replacement rollers should be purchased. Keep in mind that this can happen on the extended tray as well, which have their own pickup rollers.
====Grinding noise when printing====
Online resources point to this also being related to the fuser/maintenance kit.

[[Category:Printing]]

Information Systems:Shared Calendars

2021-07-20T02:53:10Z

Norwinu: Norwinu moved page Information Systems:Shared Calendars to Information Systems:Shared Calendars in Microsoft Outlook: More appropriate title

#REDIRECT [[Information Systems:Shared Calendars in Microsoft Outlook]]

Information Systems:Shared Calendars in Microsoft Outlook

2021-07-20T02:53:10Z

Norwinu: Norwinu moved page Information Systems:Shared Calendars to Information Systems:Shared Calendars in Microsoft Outlook: More appropriate title

==Overview==
A shared calendar an O365 calendar that is created/owned by one person but is readable (and optionally, writeable) by the people it is shared to. Shared calendars can be useful at the department and company level. The process to create one is straightforward:

* Someone creates a shared calendar (this should be the manager). When prompted for the location of the calendar, the user's "Calendars" folder should be chosen so that it goes into this node. (''It would be preferred to save this under a common object like a shared mailbox or group, but I haven't found a way to do this - it always errors out.'').
* The creator shares the calendar through the "Share Calendar" feature. This prepares an email invitation. There is a tick box to "allow invitees to add entries to the calendar" that can be used accordingly.
* Invitees can use the "Open calendar" in the email invitation to add the calendar tot their list of calendars. This also propagates to the mobile app.

==Notes==
* By default, creating entries in any calendar sets a reminder/alert - this may not be desirable for entries in the shared calendar. The reminder can be configured off per entry at the time of scheduling or after the fact.

[[Category: Microsoft Exchange/365]]

Information Systems:Shared Calendars in Microsoft Outlook

2021-07-20T02:52:43Z

Norwinu:

Information Systems:Shared Calendars in Microsoft Outlook

2021-07-20T02:52:29Z

Norwinu:

Information Systems:Laser Printers

2021-07-20T00:30:28Z

Norwinu: /* Paper jam */

This article is to keep track of the laser printers used in the Distribution Centre and Office ''which uniPHARM own.'' For the Xerox copiers, which are managed/leased, refer to [[Information Systems:Xerox printers|this article]]
==Inventory==
The following table summarizes our printer inventory:
{| class="wikitable"
|-
! Hostname !! Location !! Model !! Notes
|-
| gm-printer || GM's office || Brother MFC-L3770CDW || -
|-
| it-lab-printer || IT Lab/Cage || Lexmark MS415DN || -
|-
| buying-dept-printer || Buying Department || Lexmark MS415DN || -
|-
| accounting-dept-printer || Accounting Department || Lexmark MS415DN || -
|-
| dc-office-printer || DC Office || Lexmark MS415DN || -
|-
| dc-large-down-invoice-printer || DC Large Down || Lexmark MS521DN || -
|-
| dc-fridge-invoice-printer || DC Fridge || Lexmark MS521DN || -
|-
| dc-narc-invoice-printer || DC Narc Cage || Lexmark MS521DN || -
|}

===Distribution Centre Printers===
uniPHARM uses Lexmark laser printers for printing invoices at each picking station (warehouse zone) in the Distribution Centre. The current models are the MS521 and T652, which replaced the previous T640s and T630s (some still remain). While there is no restriction on the use of other brands of laser printers (HP for example) it is a best practice to keep the number of brands as close to 1 as possible so that users don't have to adjust to 10 different print drivers. The laser printer at each of the picking stations is connected to the HP JetDirect print servers with a parallel cable, but these are being transitioned to Ethernet connectivity. Keep in mind that the JetDirect-connected printers are not visible on the network and therefore are not "fully configured". The advantage to this is that they can be interchanged easily e.g. with printers in other zones, but this method is being retired in favor of fully networked printers.

The Lexmark printers at the picking stations are not setup as shared network printers from a Windows print server. The HP boxes are configured as TCPIP printers on the Lucy Jetforms server, but they are not shared so that users can print to them.

===Office Laser Printers===
Lexmark printers are also used for departmental/workgroup printing. The current model is the MS417. These are [[Information Systems:Domain Printers (Windows Shared Printers)|shared through Windows]].

===Consumables===
Replacing the consumables should be evidence based, the print quality or page count should be used to determine if the consumable actually needs to be changed. Resetting the maintenance counter is sometimes preferred as the consumable being low may be inaccurate.

==Troubleshooting==
====Invoices not printing====
* If the Lexmark still does not print an invoice then power cycle the HP print server box at the picking station.
* If that still doesn't work then check the network cable (of the print server). If the green lights on the HP print server box are not blinking rapidly then there is no valid network connection.
* There are spare JetDirect servers in the IT Lab (cage), but these are virtually unconfigurable (require XP).
====Bad print quality====
* Try another toner cartridge. Regardless of toner level, sometimes a replacement can improve/fix image quality. This is because the fuser is built into the toner cartridge for some of these high-volume workgroup printers, and a dirty fuser causes bad print quality
====Maintenance warning (fuser)====
This is more than likely referring to the fuser and is set to a fixed page counter. There are some tips to keep in mind:
* The printer can still function once this message is bypassed.
* The print quality may be fine despite this message. It is only a recommendation that is triggered by the page count.
* The maintenance counter can be reset.
* If you need to install a new fuser into the LP05 printer in accounting (C748 model) and the printer refuses to see a brand new fuser as a brand new fuser, reboot the printer while holding down the 2 and the 6 buttons on the front panel. The printer will boot into a special configuration menu where you have to reset the page counter on the new fuser. I suppose you could do this same trick when that printer prompts for a new fuser because that printer eats consumables like the fat Austrian kid on the Simpsons eats chocolate.
* To reset the T650/52 d/dn maintenance counter turn the power off, hold the check mark and the right arrow while turning on and wait for the 128mb to flash then wait for the config menu.Reset the maintenance clock from there.
====Paper jam (Lexmark)====
Specifically on the Lexmark printers, paper jam error messages can indicate worn paper pickup rollers, so this is the first thing to check (assuming that any actual paper jam has been ruled out). To service, you can remove the roller assembly, remove each "wheel", or try to remove the rubber roller in-place (be careful, it's fragile). A quick test as per Lexmark docs is to turn the rubber inside out. If this is the case, it should start to pick up paper again, but replacement rollers should be purchased. Keep in mind that this can happen on the extended tray as well, which have their own assembly.

[[Category:Printing]]

Information Systems:Laser Printers

2021-07-20T00:28:48Z

Norwinu:

This article is to keep track of the laser printers used in the Distribution Centre and Office ''which uniPHARM own.'' For the Xerox copiers, which are managed/leased, refer to [[Information Systems:Xerox printers|this article]]
==Inventory==
The following table summarizes our printer inventory:
{| class="wikitable"
|-
! Hostname !! Location !! Model !! Notes
|-
| gm-printer || GM's office || Brother MFC-L3770CDW || -
|-
| it-lab-printer || IT Lab/Cage || Lexmark MS415DN || -
|-
| buying-dept-printer || Buying Department || Lexmark MS415DN || -
|-
| accounting-dept-printer || Accounting Department || Lexmark MS415DN || -
|-
| dc-office-printer || DC Office || Lexmark MS415DN || -
|-
| dc-large-down-invoice-printer || DC Large Down || Lexmark MS521DN || -
|-
| dc-fridge-invoice-printer || DC Fridge || Lexmark MS521DN || -
|-
| dc-narc-invoice-printer || DC Narc Cage || Lexmark MS521DN || -
|}

===Distribution Centre Printers===
uniPHARM uses Lexmark laser printers for printing invoices at each picking station (warehouse zone) in the Distribution Centre. The current models are the MS521 and T652, which replaced the previous T640s and T630s (some still remain). While there is no restriction on the use of other brands of laser printers (HP for example) it is a best practice to keep the number of brands as close to 1 as possible so that users don't have to adjust to 10 different print drivers. The laser printer at each of the picking stations is connected to the HP JetDirect print servers with a parallel cable, but these are being transitioned to Ethernet connectivity. Keep in mind that the JetDirect-connected printers are not visible on the network and therefore are not "fully configured". The advantage to this is that they can be interchanged easily e.g. with printers in other zones, but this method is being retired in favor of fully networked printers.

The Lexmark printers at the picking stations are not setup as shared network printers from a Windows print server. The HP boxes are configured as TCPIP printers on the Lucy Jetforms server, but they are not shared so that users can print to them.

===Office Laser Printers===
Lexmark printers are also used for departmental/workgroup printing. The current model is the MS417. These are [[Information Systems:Domain Printers (Windows Shared Printers)|shared through Windows]].

===Consumables===
Replacing the consumables should be evidence based, the print quality or page count should be used to determine if the consumable actually needs to be changed. Resetting the maintenance counter is sometimes preferred as the consumable being low may be inaccurate.

==Troubleshooting==
====Invoices not printing====
* If the Lexmark still does not print an invoice then power cycle the HP print server box at the picking station.
* If that still doesn't work then check the network cable (of the print server). If the green lights on the HP print server box are not blinking rapidly then there is no valid network connection.
* There are spare JetDirect servers in the IT Lab (cage), but these are virtually unconfigurable (require XP).
====Bad print quality====
* Try another toner cartridge. Regardless of toner level, sometimes a replacement can improve/fix image quality. This is because the fuser is built into the toner cartridge for some of these high-volume workgroup printers, and a dirty fuser causes bad print quality
====Maintenance warning (fuser)====
This is more than likely referring to the fuser and is set to a fixed page counter. There are some tips to keep in mind:
* The printer can still function once this message is bypassed.
* The print quality may be fine despite this message. It is only a recommendation that is triggered by the page count.
* The maintenance counter can be reset.
* If you need to install a new fuser into the LP05 printer in accounting (C748 model) and the printer refuses to see a brand new fuser as a brand new fuser, reboot the printer while holding down the 2 and the 6 buttons on the front panel. The printer will boot into a special configuration menu where you have to reset the page counter on the new fuser. I suppose you could do this same trick when that printer prompts for a new fuser because that printer eats consumables like the fat Austrian kid on the Simpsons eats chocolate.
* To reset the T650/52 d/dn maintenance counter turn the power off, hold the check mark and the right arrow while turning on and wait for the 128mb to flash then wait for the config menu.Reset the maintenance clock from there.
====Paper jam====
Specifically on the Lexmark printers, paper jam error messages can indicate a worn roller, so this is the first thing to check (assuming that any actual paper jam has been ruled out). To service, you can remove the roller assembly, remove each "wheel", or try to remove the rubber roller in-place (be careful, it's fragile). A quick test as per Lexmark docs is to turn the rubber inside out. If this is the case, it should start to pick up paper again, but replacement rollers should be purchased.

[[Category:Printing]]

Information Systems:Laser Printers

2021-07-20T00:28:41Z

Norwinu:

This article is to keep track of the laser printers used in the Distribution Centre and Office '''which uniPHARM own.''' For the Xerox copiers, which are managed/leased, refer to [[Information Systems:Xerox printers|this article]]
==Inventory==
The following table summarizes our printer inventory:
{| class="wikitable"
|-
! Hostname !! Location !! Model !! Notes
|-
| gm-printer || GM's office || Brother MFC-L3770CDW || -
|-
| it-lab-printer || IT Lab/Cage || Lexmark MS415DN || -
|-
| buying-dept-printer || Buying Department || Lexmark MS415DN || -
|-
| accounting-dept-printer || Accounting Department || Lexmark MS415DN || -
|-
| dc-office-printer || DC Office || Lexmark MS415DN || -
|-
| dc-large-down-invoice-printer || DC Large Down || Lexmark MS521DN || -
|-
| dc-fridge-invoice-printer || DC Fridge || Lexmark MS521DN || -
|-
| dc-narc-invoice-printer || DC Narc Cage || Lexmark MS521DN || -
|}

===Distribution Centre Printers===
uniPHARM uses Lexmark laser printers for printing invoices at each picking station (warehouse zone) in the Distribution Centre. The current models are the MS521 and T652, which replaced the previous T640s and T630s (some still remain). While there is no restriction on the use of other brands of laser printers (HP for example) it is a best practice to keep the number of brands as close to 1 as possible so that users don't have to adjust to 10 different print drivers. The laser printer at each of the picking stations is connected to the HP JetDirect print servers with a parallel cable, but these are being transitioned to Ethernet connectivity. Keep in mind that the JetDirect-connected printers are not visible on the network and therefore are not "fully configured". The advantage to this is that they can be interchanged easily e.g. with printers in other zones, but this method is being retired in favor of fully networked printers.

The Lexmark printers at the picking stations are not setup as shared network printers from a Windows print server. The HP boxes are configured as TCPIP printers on the Lucy Jetforms server, but they are not shared so that users can print to them.

===Office Laser Printers===
Lexmark printers are also used for departmental/workgroup printing. The current model is the MS417. These are [[Information Systems:Domain Printers (Windows Shared Printers)|shared through Windows]].

===Consumables===
Replacing the consumables should be evidence based, the print quality or page count should be used to determine if the consumable actually needs to be changed. Resetting the maintenance counter is sometimes preferred as the consumable being low may be inaccurate.

==Troubleshooting==
====Invoices not printing====
* If the Lexmark still does not print an invoice then power cycle the HP print server box at the picking station.
* If that still doesn't work then check the network cable (of the print server). If the green lights on the HP print server box are not blinking rapidly then there is no valid network connection.
* There are spare JetDirect servers in the IT Lab (cage), but these are virtually unconfigurable (require XP).
====Bad print quality====
* Try another toner cartridge. Regardless of toner level, sometimes a replacement can improve/fix image quality. This is because the fuser is built into the toner cartridge for some of these high-volume workgroup printers, and a dirty fuser causes bad print quality
====Maintenance warning (fuser)====
This is more than likely referring to the fuser and is set to a fixed page counter. There are some tips to keep in mind:
* The printer can still function once this message is bypassed.
* The print quality may be fine despite this message. It is only a recommendation that is triggered by the page count.
* The maintenance counter can be reset.
* If you need to install a new fuser into the LP05 printer in accounting (C748 model) and the printer refuses to see a brand new fuser as a brand new fuser, reboot the printer while holding down the 2 and the 6 buttons on the front panel. The printer will boot into a special configuration menu where you have to reset the page counter on the new fuser. I suppose you could do this same trick when that printer prompts for a new fuser because that printer eats consumables like the fat Austrian kid on the Simpsons eats chocolate.
* To reset the T650/52 d/dn maintenance counter turn the power off, hold the check mark and the right arrow while turning on and wait for the 128mb to flash then wait for the config menu.Reset the maintenance clock from there.
====Paper jam====
Specifically on the Lexmark printers, paper jam error messages can indicate a worn roller, so this is the first thing to check (assuming that any actual paper jam has been ruled out). To service, you can remove the roller assembly, remove each "wheel", or try to remove the rubber roller in-place (be careful, it's fragile). A quick test as per Lexmark docs is to turn the rubber inside out. If this is the case, it should start to pick up paper again, but replacement rollers should be purchased.

[[Category:Printing]]