Desktop Policy settings document can be used for domino administrator to configure and enforce the user location document in Notes Client.

However as the default desktop policy settings document, it does not allow to pass down the all location document’s fields.

For example, “Recipient name type-ahead” field of location document cannot be configured in the default desktop policy settings document.

In that case,  There is sill the way to add the desired parameters into the default desktop policy settings document by editing server names.nsf with lotus designer.

Below is the information regarding desktop policy and location parameters.

You can use Desktop Policy settings documents to set field value in users' current Location documents.This can be done by adding a new field to the policy settings document using the Domino Designer. The new field must be named LocAllVariableName, where VariableName is the name of the field you are setting in the Location documents.

Original source: IBM – Using a Desktop Policy to set notes.ini and Location parameters.

Here is the step by step example for adding “Recipient name type-ahead”  into Desktop Policy settings document.

1. Open server names.nsf from Lotus Designer.
2. Open PolicyDesktop form from form list view.
3. Click Mail tab, and then create “LocAllNameLookupPref” field in anywhere you want.
4. Save the form. and then close Lotus Designer.
5. Open Domino Administrator, and then open Desktop Policy settings document. If you don’t have any Desktop Policy settings document, create it.
6. If you click Mail tab, then you should be able to see the field which you created. Put value 0 or 1 or 2.
7. Save Desktop Policy settings document.
8. Test by the user who this Desktop Policy is assigned. This new value is set on the assigned users’ clients the next time they authenticate with their home server.

It is really difficult to pinpoint one particular feature of the IBM Lotus Foundations Start server as the “killer app”.  Lotus Foundations comes with so many handy, crucial SMB tools and each and every one of them is important.  However, if I was forced to choose one feature I would probably have to choose backups.

You’re only as safe as your most recent, reliable backup.  Without a proper backup, you could find yourself spending hours re-inputting data, recreating a spreadsheet, updating your address book, etc…  We all know how important backups are, but it is often the last thing on our laundry list of business to dos.  And, even if you did regularly take backups, what is the probability that the backup was a reliable one?  How often do you really do test restores to make sure that what you backed up is actually intact?

What about disaster recovery?  Have you planned for the worst case scenario?  Sure, you’re performing backups, but are you making sure that recent backups are also being taken off-site to another location for disaster recovery purposes?  If you are, how recent are those off-site backups?

Sure, you could use an online backup service for disaster recovery.  However, that can become expensive as you amass more files and data.  If you wanted to restore from an online backup, it will take as long as the download speed of your Internet connection.  For gigabytes of data, a full restore could take hours or days.

The Lotus Foundations Start server appliance has integrated IBM’s Intelligent Disk Backup (IDB) technology into its backup toolbox.  IDB allows you to perform incremental backups as often as 15 minutes.   You can backup daily, weekly, or as often as you need to.  If you are backing up frequently, IDB also makes “incremental” copies of recently modified files.  So, if you modified a file an hour ago and the same file two hours ago, you are able to restore either file to your system with the click of a button.  This is very useful if you realize that the file you saved an hour ago was somehow corrupted or you erased important information from it right before saving it.

In addition, the backups are encrypted.  So, even if the backup drive were to fall into the wrong hands, the data is secure.

Finally, what happens if your main hard drive fails?  Well, you just push a button and all of the server configuration and software is restored in minutes.  No need to reinstall the operating system, re-configure your software, or re-assign rights to folders and printers.  The IDB  backs everything up, not just your data files.

What about disaster recovery?  If you buy additional IDB drive cartridges with the server, you merely need to pull out one cartridge at the end of the day on Friday, plug in your other cartridge and take the first cartridge home with you so the data is off-site.  The act of plugging in a new cartridge tells Lotus Foundations to start backing up the whole system from scratch automatically.  No need to let the IDB know about the new cartridge.  It is all taken care of automatically.

If the unthinkable happens, and your server at the office were to be lost in a calamity, you would only need to buy a new IBM server, plug in the cartridge that you took home with you, push a button and you’re right back where you started, since your last backup.

So, yes, IBM’s Intelligent Disk Backup technology that comes with the IBM Lotus Foundations Start server appliance is the bomb.  Finally, no more tapes, no more carrying around an external USB drive from PC to PC, and no more worrying about disaster recovery.  And best of all, no more shelling out monthly fees to continue making online backups.  Let the IDB take care of the backups for you so you can just sit back, relax and focus on work.

We’ve begun selling and explaining the IBM Lotus Foundations Start (LFS) server software appliance to existing and potential customers.  I show them a side-by-side comparison chart with a competing small business solution so that they can compare apples-to-apples.  After a short explanation, I’ve gotten comments such as:

- “This sounds too good to be true”

- “Why would I not choose Lotus Foundations?”

However, customers still show hesitation because the underlying operating system is Linux and there is concern regarding interoperability with Windows.  Of course, we know that we can load a virtual environment with Windows on it, but that is not the same as having the whole appliance running Windows.  This is not a show stopper by any means.  Customers are wowed (as I stated above) by all that LFS can do and they are pleased that they are now afforded a choice in the SMB market.  At the same time, LFS is a significant upfront investment for smaller businesses, so they want to vet this new opportunity before taking the leap.

I’m confident that LFS can hold its own as it really is not “too good to be true”.  It is truly a great solution that, not only offer SMBs a stable and reliable alternative,  but, also, I believe will allow SMBs to streamline their IT infrastructure while also allowing them to spend more time focusing on their core business.

Lotus Protector for Mail Security is an appliance suitable for businesses who are looking to proactively protect their email systems from spam and viruses. This appliance comes in two flavors (deployment flexibility), as a hardware software combo appliance (Rack Unit : 2U) and as a virtual appliance using vmware.  Designed specifically for the Lotus Domino environment the appliance is very easy to setup on an existing Domino platform.

For evaluation purpose we chose to use the virtual appliance using VMWare server as it is easy to install on our existing vmware infrastructure. The vmware image is based on a linux OS and has the Lotus Protector software pre-installed. Once you have the Lotus Protector vmware image turned on, you will be guided through a series of configuration questions that took us about 20 minutes to configure. Nothing is better than a simple yet security rich management interface, and this appliance comes with it.

As soon as we opened the management interface we updated the licenses and made sure that the components (Content Filter Database, Appliance Firmware, Intrusion Prevention Signatures and AntiVirus Signatures) are up-to-date. We updated the time to sync with an external time server, made sure that the networking and firewall part is configured correctly and checked the Events for abnormalities.

The next step is to setup the appliance for LDAP access. In the Policy Objects under Directories, we added an entry to access our domino ldap server so that incoming mails can be verified against the mail field in the ldap directory. The trickiest part was to enter a username who has access to the ldap directory.  The correct format should be in LDIF format such as entering the DN into the Username field, in this case we entered “cn=FirstName LastName/o=OrganizationName”. We at first entered our Domino Short Name which didn’t work. We left everything by default except in the last tab “SMTP Domains” we added our domain. Next step is to setup a Who Objects in the Policy Objects section under the Who tab. Make sure that the type is “Directory” and choose the directory that we have previously setup. Once the changes have been saved, we can verify if the ldap directory is working by going to Verify Who Objects and choose All Who Objects. Click Submit. You should see an OK in the result column.

To verify an email address, simply select SMTP Address in the selection box and type in an exisiting email address.

The next step is to configure the Receiving SMTP setting so that the appliance can verify that a recipient actually exist in the Domino directory and what to do if the recipient is not found. There is also an option to silently drop the email if it is being addressed to an unknown recipient, however for our testing purpose we left it as Rejected with Error. This is nice to have when troubleshooting and testing a spam email from the Internet.

Once that is in place we can procede with the testing and here is the result when an exisiting user doesn’t exist

What about spam? To test this out I sent myself an email containing a simple text email that offers a viagra product. Here is the email sample so that you can use it for testing purpose too : Email. Immediatly Lotus Protector caught the email spam and quarantined it.

Another feature in Lotus Protector is the automatic updates of the following components required for the appliance to effectively filter spam which I believe are being updated often by IBM :

• Content Filter Database
• Bayes Filter Database
• Spam Heuristics
• AntiVirus Signatures
• Intrusion Prevention Signatures

Not to forget the reporting tools are awesome too,  Lotus Protector can create an executive summary report from a time period of your choosing. To name a few, reports can be categorized according to top 10 Viruses or top 10 senders to traffic monitoring to matched rules. This report also includes a very nice graph to help us to assess patterns and trends.

Wednesday appliance test

As I am only touching the surface, for more information regarding this appliance, please visit IBM’s website directly :

http://www-01.ibm.com/software/lotus/products/protector/mailsecurity/

Then if you like to see if this product suits you, there is a 90-day trial for this appliance. Follow the link : http://www.ibm.com/developerworks/downloads/ls/lotusprotector/learn.html

A potential customer for IBM Lotus Foundations Start (LFS) server recently inquired whether the server appliance is able to support a RAID configuration.   At first, I thought that a RAID configuration was not supported.  However, after some research this is what I found out.

First of all, you may already know that the LFS server appliance advertises its inclusion of Intelligent Disk Backup (IDB) for true disaster recovery by taking incremental backups, as often as every 15 minutes, of all data and operating system and software settings.  However,  if the very unlikely event that the main hard drive fails for whatever reason, the server is only available in minimal operational mode until a full restore is possible.  Of course, a full restore can occur in minutes with a push of a button, but this can still be an inconvenience for a business in the middle of a business day.

If the LFS server appliance could also support a RAID configuration, then downtime could be drastically minimized with a hard drive failure.  After looking over the LFS administration manual, I was able to verify that a RAID configuration is possible.  In fact, with only a few clicks, LFS can put a RAID configuration into place quickly and easily. RAID 1 is supported if you 2 main drives of the same type, and RAID 5 is supported if you have 3 or more.  So, from the software standpoint, RAID is obviously supported.

If you look at the server appliance hardware specifications neither the Entry Level or Advanced Level servers from IBM make any mention of RAID.  Both server types come with one 250Gb main drive and a 500Gb (Entry) or 1Tb (Advanced) hard drive for IDB backups.  This is not a supported RAID hardware configuration.  So I inquired further.  What I found out was that you can add additional 250Gb hard drives to the standard server configuration to achieve RAID through the software configuration process.  You just need to specifically request the extra hard drives be added.

So, it appears, that RAID is an “unadvertised” feature of the LFS server appliance that will make this an even more appealing all-in-one-it-solution for SMBs!

It is useful to restore ghost image by using a bootable USB memory key.  The following are the steps for creating a bootable USB memory key with a ghost image on it.

1. Download and install the Windows based HP USB Disk Storage Format Tool.

2. Download the Windows 98 system boot up files.

3. Insert the USB memory key into your computer and run the HP USB Disk Storage Format Tool.

4. Make sure that the USB memory key is selected int the HP format tool program.

5.  In the HP format tool program, under the file system drop down list, select FAT32.

6. In the HP format tool program,  under the format options check “Create a DOS startup disk”. Select “using DOS system files locate at:  then click on the box with three dots.  Browse to the windows 98 boot up files folder then click on the OK button.

7. In the HP format tool program click the start button.

8. After you created the bootable USB memory key you can copy your ghost image to the USB key.

9. Now you should be able to boot your machine with the USB and restore the ghost image

Please note:  That some machines do not allow booting from a USB drive be default.  You may have to change some settings in your machines BIOS to enable this option.  Also, please realize that some older machines do not allow you to boot from a USB.

To manipulate the multiple byte characters like Japanese, Korean, Chinese with Notes C API, you will need to convert Native characters Code to LMBCS.

As per C++/CLI supports UNICODE as default, I recommend to use UNICODE for manipulating the String values on C++/CLI.

› Translate from UNICODE (managed code) to LMBCS

Here I wrote how to convert UNICODE characters to LMBCS so that C API functions can understand them.

Step1. First of all, Marshal String to UNICODE String Pointer from Managed code. Marshal::StringToHGlobalUni() function  allocates the string data to global memory, so you will need to release the data after all.

String^ idfile = gcnew String(“ほげほげ.id”);
// Convert String to UNICODE String Pointer ( memo:StringToCoTaskMemAuto )
System::IntPtr ptrIdfile = System::Runtime::InteropServices::Marshal::StringToHGlobalUni( idfile );

Step2. Translate string from UNICODE to LMBCS format with OS_TRANSLATE_UNICODE_TO_LMBCS as 1st parameter of OSTranslate.

WORD    idfile_len = 2*(wcslen(static_cast<const wchar_t*>(ptrIdfile.ToPointer())));
char    idfile_lmbcs[MAXBUFFER+1];
OSTranslate(OS_TRANSLATE_UNICODE_TO_LMBCS, (char*)ptrIdfile.ToPointer(), idfile_len, idfile_lmbcs, MAXBUFFER );

Now you can pass LMBCS characters which is contained in idfile_lmbcs to Notes C API functions.

After using the string, don’t forget to free the pointer which is allocated by Marshal::StringToHGlobalUni().

System::Runtime::InteropServices::Marshal::FreeHGlobal( ptrIdfile );

For example, To get the multiple byte characters from notes documents, you also need to translate string from LMBCS to UNICODE. Below is the steps.

Step1. Get the value as Char format.

char item_value[MAXTEXTBUFFER+1];
// for example, calling NSFItemConvertValueToText() to get the Text from item value.
text_len = NSFItemConvertValueToText( item_type,
value_block,
item_len,
item_value,
buffer_len,
0);

Step2. Translate text string from LMBCS to UNICODE. In this case you need to use OS_TRANSLATE_LMBCS_TO_UNICODE as 1st parameter of OSTranslate().

char    item_value_lmbcs[MAXTEXTBUFFER+1];
OSTranslate(OS_TRANSLATE_LMBCS_TO_UNICODE, item_value, text_len, item_value_lmbcs, MAXTEXTBUFFER );

Step3.Get string as managed code by converting with following code.

String^ itemValue = System::Runtime::InteropServices::Marshal::PtrToStringUni( (IntPtr)item_value_lmbcs );

Symptom : Users are not receiving emails to their blackberry handheld. After a reboot of the whole server including the OS, everything works as normal. After several hours have passed or sometimes days, users complained that they stopped receiving emails to their handheld again.

Rebooting the server every time a users complains was not the best solution and this has puzzled us for some time because all systems were working OK. Domino was running without any problem and test messages to user’s handheld from the Blackberry manager were successful. So we turned to blackberry support and they helped us right away. After sending Domino log as well as BES log, the support person came back in an email stating that this is a known issue (SDR201970) and a fix has already been posted in Maintenance Release 1.

The CPU spikes at about 99% when BES receives an email that contains rich text for certain mime types. If you have to wait for after hours or weekend to apply the MR, there is an option to disable “Rich Content” and “Inline Images” temporarily so to prevent the BES server from crashing. I believe this can be found in the BlackBerry Manager, under Server Properties, in the Messaging options.

Below is a sample of the log entry for Blackberry Enterprise Server :

[20148] (04/17 10:59:06.468):{0×1568} Thread: *** No Response *** Thread Id=0×1634, Handle=0×598, WaitCount=1, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN
[20148] (04/17 11:09:08.562):{0×1568} Thread: *** No Response *** Thread Id=0×1634, Handle=0×598, WaitCount=2, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN
[20148] (04/17 11:19:09.109):{0×1568} Thread: *** No Response *** Thread Id=0×1634, Handle=0×598, WaitCount=3, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN
[20148] (04/17 11:29:09.390):{0×1568} Thread: *** No Response *** Thread Id=0×1634, Handle=0×598, WaitCount=4, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN
[20148] (04/17 11:39:09.687):{0×1568} Thread: *** No Response *** Thread Id=0×1634, Handle=0×598, WaitCount=5, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN
[20148] (04/17 11:49:09.968):{0×1568} Thread: *** No Response *** Thread Id=0×1624, Handle=0x55C, WaitCount=1, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN
[20148] (04/17 11:49:09.968):{0×1568} Thread: *** No Response *** Thread Id=0×1634, Handle=0×598, WaitCount=6, Last Activity: Received NEW MAIL for user John Doe/YOUR-DOMAIN

YOUR_SERVER_MAGT_01_20090417_0001.txt(3855): [20149] (04/17 10:59:06.343):{0×1568} Thread 1634, utilization=99.7786%, failed health check 1 times
YOUR_SERVER_MAGT_01_20090417_0001.txt(4204): [20149] (04/17 11:09:08.562):{0×1568} Thread 1634, utilization=99.7866%, failed health check 2 times
YOUR_SERVER_MAGT_01_20090417_0001.txt(4339): [20149] (04/17 11:19:09.109):{0×1568} Thread 1634, utilization=99.5200%, failed health check 3 times
YOUR_SERVER_MAGT_01_20090417_0001.txt(4810): [20149] (04/17 11:29:09.390):{0×1568} Thread 1634, utilization=99.4300%, failed health check 4 times

I wrote this article since there are little information about how to use Notes C API on C++/CLI with CLR.

Below is the settings to configure the DLL project with using Notes C API on C++/CLI. I am using Visual Studio 2005 Standard Edition.

1. After creating New Project, Go to [Project] – [Properties]
2. Go to [Configuration Properties] – [General] from left Navigation.
   Configure Dynamic Library(.dll) and Common Language Runtime Support (/clr)
   

   Configuration Properties - General

3. Go to [C/C++] – [General]
   Add Notes C API include folder into [Additional Include Directories]
   

   C/C++ - General

4. Go to [C/C++] – [Peprocessor]
   Add W32;WIN32 into [Preprocessor Definitions]
   

   C/C++ - Preprocessor

5. Go to [C/C++] – [Code Generation]
   Configure Multi-threaded DLL (/MD) into [Runtime Library]
   

   C/C++ - Code Generation

6. Go to [Linker] – [General]
   Add C Notes API Library into [Additional Include Directories]
   

   Linker - General

7. Go to [Linker] – [Input]
   Add notes.lib into [Additional Dependencies]
   

   Linker - Input

   Point the relative path if you need (i.e) notesapi\lib\mswin32\notes.lib

That’s all!
Enjoy C++/CLI programming with Notes C API!

At one of our client sites, we experienced a strange behaviour where incoming emails were being rejected for policy reasons and outgoing emails were not being delivered.

04/15/2009 01:34:40 PM  Router: Failed to connect to SMTP host HOST.SOMEDOMAIN.COM because The server is not responding. The server may be down or you may be experiencing network problems. Contact your system administrator if this problem persists.

Or something like this : Mail from user@somedomain.com rejected for policy reasons. Domain not found in DNS.

The quick solution was to have “tell router update config” command run every 30 minutes (less is better) so that domino can flush its DNS record that have been cached. Strange behaviour as we have to do it often.

Here is the screen shot

**Update 4/20/2009**

We requested a PMR from IBM and it may turn out that there could be a problem in the Domino code itself. The support engineer has escalated this issue for a possible hotfix. We experienced this issue using Domino 8.0.2 FP1 plus another server that runs on Linux with Domino 8.5 has also had a similar problem, but mails for some reason get delivered after a couple of seconds on the 8.5 server.

IBM has provided us with a hotfix to solve the problem where Domino server caches an A record until 2043 when an MX record is not found during DNS query or when there is an error. In case you are interested, the hotfix number is 287 (02FP1HF287) but I believe you have to get it by calling in to IBM support. Here is a quote from the support engineer :

It sets a default TTL for DNS that router uses in its cache to 30 minutes when an error occurs or when a non-MX record is returned.

This default is adjustable by the INI RouterDNSErrorTTL. The INI expects seconds so a value of 3600 would be 1 hour. I would not recommend adjusting the TTL unless needed so do not use the INI unless there is a reason.

 To get more detail on your log and to see whether it caches certain A record until year 2043, increase the debug output level by entering the following into the Domino console:

start consolelog
set config debug_threadid=1          (0 to disable)
set config debugrouter=3                 (0 to disable)
set config log_mailrouting=40       (20 to disable)
set config smtpclientdebug=3        (0 to disable)
restart task router