Exchange 2010 SP1: a known issue, a canary and flip flopping…

Exchange 2010 SP1 contains a known issue (or a hidden feature). With SP1 for Exchange 2010 the canary is introduced in order to counter cross-site script attacks. The canary is a string which is used continuously between client and server in order to counter 'man in the middle attacks'.

The event log of an Exchange server however will shows events like these when the Test-ECPConnectivity cmdlet is being run in order to test the Exchange Control Panel :

When the Exchange 2010 SP1 environment is being monitored by SCOM R2, it will result in flip flopping. Open Health Explorer for the Organization State Object in the SCOM R2 Console.

Check out the State Change Events for the Entity Health (top level node in Health Explorer), it will look like this:

This is NOT good!

So it is time to disable the monitor KHI: Exchange Control Panel connectivity (External) transaction failures targeted at ECP:

Experience from the field learns that is best to target the overrides against For a specific object of class: ECP and select – one by one – all ECP Classes.

This will reduce the level of noise to a great extend.

All credits go to Maarten Piederiet who pointed this one out to me and Jaap Wesselius (Exchange 2010 MVP) who has written a good posting (in Dutch!) about the canary. I used his posting in order to describe the bird…