Gregg Eldred - Category : Show-n-Tell

SnTT: Resolving a Sametime Meeting Connection Issue

Gregg Eldred — Wed, 28 Jul 2010 12:19:14 -0400

Some users, when attempting to attend a Sametime Meeting, never get connected to the meeting. Instead, they see a screen similar to this:

Restarting the browser doesn't help, neither does using a different browser.

However, there are two TechNotes that will help resolve this issue. The first one, "Java has discovered application components that could indicate a security concern" when attending Sametime classic meeting, will have you apply a hotfix for your version of Sametime. Before you start, you have to determine the version of Sametime you are running. Simple instructions for this can be found here. Once you have the version in hand, the next step is to download the hotfix. Click on the appropriate link on the TechNote. You will then see a screen similar to this:

Once you enter your credentials, a screen similar to this will appear:

Download the hotfix. You can then follow the instructions in the TechNote (with some additional information provided by my experience with these instructions):

1. Stop the Sametime server

2. Backup the following directory:
..Data\domino\html\sametime

3. Copy the contents of the data directory from the zip file into the Data directory on the Sametime server overwriting files which already exist

About the "copy:" Open the ZIP file, copy the files in the separate folders within the ZIP file, DO NOT simply copy the contents of the ZIP file to your Sametime server. If you do, refer back to Number 2, above (I really hope you did a backup before moving along). Each folder in the ZIP file has several files, those are the files you need to copy to your Sametime server, using the folder names as reference to where the files are to be dropped.

4. If the previous step did not overwrite files, the copy was not done to the correct location

5. Edit the the following files:
..\Lotus\Domino\data\domino\html\sametime\stappletver.txt
..\Lotus\Domino\data\domino\html\sametime\strequiredmrcversion.txt

Increment the STMRC_Version_Java2 value in both files.

For example, in the 8.0.2 resigned version (after following Technote 1385734) it is as follows:

STMRC_Version_Java2 = 8.00.02.133

Increment the least significant value by one:

STMRC_Version_Java2 = 8.00.02.134

For the stappletver.txt file, it looks similar to this:

The highlighted line has been incremented by 1, from 8.00.01.64 to 8.00.01.65.

The strequiredmrcversion.txt file looks similar to this:

The only line in this file, above, has been incremented from 8.00.01.64 to 8.00.01.65.

6. Start the Sametime server

The second Technote, "Java has discovered application components that could indicate a security concern" when accessing stlinks, has you changing a Java security setting. Open Control Panel, Java Control Panel. Click on the Advanced Tab. Change the Security - Mixed mode (sandboxed vs. trusted) security verification setting from "Enable - show warning if needed" to "Enable - hide warning and run with protections."

After applying the hotfix, editing two files, and changing your Java Control Panel, all users should now be able to access Sametime Meetings without any issue.

Link: "Java has discovered application components that could indicate a security concern" when accessing stlinks

Link: "Java has discovered application components that could indicate a security concern" when attending Sametime classic meeting

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Running 32-bit or 64-bit Domino? How Can You Tell?

Gregg Eldred — Thu, 8 Jul 2010 21:29:16 -0400

As my memory isn't the greatest, I may think that I have installed 64-bit Lotus Domino on a 64-bit operating system. But how can I tell for certain? Thankfully, you have two methods of determining this. First, the server console will display Server name: Lotus Domino Server (64-bit) at the top of the window. If that isn't enough, you can use a Server Statistic to display the version of Domino (this is my personal preference).

At the Domino Server Console type:

sh stat server.version.architecture

Press enter.

You will see a response similar to this:

Mystery solved.

Why would you consider running 64-bit Domino on a 64-bit operating system? From the FAQ: 64-bit version of Domino:

The objective of 64-bit Domino is to provide memory relief for customers who today are experiencing problems such as crashes, or system hangs due to out of memory conditions. Several customers are experiencing such issues where memory limitations especially on Windows and AIX result in such problems. If you are currently running 32-bit Domino on AIX or Microsoft® Windows® 64-bit platforms, and you are experiencing low memory issues, then using 32- bit or 64- bit Domino on Windows 2003 64-bit relieves this memory issue. In the case of AIX, 64-bit Domino is required for relief.

On Windows: 32-bit Domino on 64-bit Windows can obtain ~4GB of memory from the OS. 64-bit Domino on 64-bit Windows can obtain much more from the OS.

On AIX: If you were constrained by memory segments running 32-bit Domino on 64-bit AIX, then 64-bit Domino can help with that constraint.

Essentially, in 64-bit Domino, both OS memory limits and internal Domino memory limits have been greatly expanded, and this helps with memory issues that might be experienced with 32-bit Domino.

SnTT: Resolving a Blacklist Issue

Gregg Eldred — Wed, 2 Jun 2010 19:40:05 -0400

Not limited to only IBM Lotus Domino, one day you may be presented with an error message from a user. One sample of an error is:

Error transferring to foo.bar; SMTP Protocol Returned a Permanent Error 554 Service unavailable; Client host [127.0.0.1.mycompany.com] blocked by zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=127.0.0.1

Another could be something similar to this:

Error transferring to mail.yourdomain.COM; SMTP Protocol Returned a Permanent Error 550 5.7.1 127.0.0.1 has been blocked by Spamhaus

I think that if you work in messaging, the picture is becoming clear. Something is wrong with the IP Address of your outgoing SMTP server.

To make sure that there is really something amiss in messaging land, a little research is needed. There are several sites to assist you, I will outline my favorites. No matter the sites that you choose, the outcomes will be similar.

The first stop is TrustedSource. Entering your outbound SMTP server's IP Address, or the IP Address associated with your MX record, in the site's search box, you may be presented with a screen similar to this:

This graphic really shows you that there may be problem. Your eyes should be drawn to the last few days of outgoing mail originating from your server's IP Address. While this is alarming, we should still take the analysis a little farther.

Heading over to MXToolbox, you enter your domain name in the search box:

and click the MX Lookup button. The results may look similar to this:

Noticing that there is a link for "Blacklist Check," you click it. The results:

Where your IP Address is shown to be on a blacklist, MXToolbox provides a link for more details. In this example, we click on the link for CBL:

The nice thing about the "Details" links are that when you click them, you are usually taken to the page that will help you get your IP Address off of the selected blacklist. While this will reduce your time searching for answers, it does not reduce the time required to have your IP Address actually removed from the blacklist. Expect, in most cases, 24-48 hours until it is removed. Not pleasant, I know.

In this particular case, the work is still not done. Somewhere on the network is a workstation that, in my opinion, has been hijacked by a "bot," and will require a thorough cleaning before it will be permitted to plug back into the network. However, the Messaging Administrator now has the tools to get mail flowing out to the internet, without bouncing back to the sender because the organization is on a blacklist.

Technorati tag: Show-n-Tell Thursday SnTT

SnTT: SMTP TLS on Domino

Gregg Eldred — Thu, 25 Feb 2010 11:20:43 -0400

As I have been getting quite a few referrers looking for SMTP TLS on Domino or Domino TLS, a friend has graciously provided this primer on enabling TLS with Domino.

This post now fully peer reviewed and correct

For the purposes of illustration here, I have used 192.168.0.1 to mean the public IP address of your Domino SMTP/mail router server, domino.company.example to mean your Domino server's fully qualified host name and keyfile.kyr to mean the keyring file used for TLS.

Using SMTP TLS (Transport Layer Security) on Domino is very simple. I have broken down the process into 5 steps:

1. DNS Set Up

Before you start, you will need correct forward and reverse pointing for your Domino server. domino.company.example should have a host A record in public DNS pointing to 192.168.0.1 and 192.168.0.1 should have a PTR record pointing to domino.company.example.

When an SSL certificate is issued it will be issued bearing the fully qualified host name of your server and you will need to take steps to prove to the CA that the server is yours to secure. These steps include having correct DNS pointing and may well include others such as providing details of your company registration. Some CAs will verify your claim to secure domino.company.example by correlating the domain name registration with your company name and Dun & Bradstreet reference for example.

If you can't set up correct DNS for whatever reason, give up now and address that issue first.

2. Firewall Config

SMTP TLS uses TCP port 465. In addition to the other ports you have open at the firewall, you will need to open TCP/465 inbound to and outbound from domino.company.example.

If you have one of those firewalls that interferes with SMTP (example: Pix fixup), turn that off now (not the firewall, just the fixup or equivalent). Fixup and like firewall tomfoolery will prevent the use of EHLO by any SMTP client that connects. No EHLO, no TLS.

3. Keyring File Creation

If you already have an SSL certificate for domino.company.example (for HTTPS for example), you can skip this part.

To use TLS, you will need an SSL certificate on a keyring file. This keyring file is exactly the same as one used for other web security duties such as secure web access and is obtained the same way.

Open the Server Certificate Admin database on your server (typically certsrv.nsf) or create one from the template if none exists. Click Create Keyring File.

Here, Common Name means the fully qualified host name of your Domino server. Organisation should match whatever details exist in your domain registration. State should be the two letter abbreviation for your state if in the US, otherwise your region, province or whatever. British readers take note: Country is GB for Great Britain, NOT UK!

Click " Create Key Ring".

This will create two files, keyfile.kyr and keyfile.sth in the Domino root data directory. keyfile.kyr is the key ring and keyfile.sth is the stash file which holds the keyring password, hashed.

Now click Create Certificate request.

Click the Create Certificate request button:

You will need to copy and paste the entire certificate request from this screen into either an email to your certificate authority or their web form if they have one. If you are looking for an authority to use, I still recommend Digi-Sign.

Depending on how efficient your chosen CA is you should shortly receive back a certificate to be installed on the keyring. They may also send one or more trusted roots. If they do, you will need to install those on the keyring first.

To install trusted roots, click "Install Trusted Root Certificate into Keyring":

Here, File Name is the full path to the trusted root certificate file you have been sent and which you have dropped into the local file system temporarily. Repeat this step for all trusted roots you have been sent.

Now you can install your new certificate. Click "Install Certificate Into Keyring"

Here, File Name is the full path to the certificate for domino.company.example which you have dropped into the local file system temporarily.

That's it. You're done. You now have a keyring file containing an SSL certificate valid for domino.company.example and you can go ahead and modify server settings to use it.

4. Domino Server Configuration

Edit the Server Config document for domino.company.example. On the Router/SMTP / Advanced / Commands and Extensions tab, ensure that SSL negotiated over TCP/IP port: is set to Enabled. (Housekeeping tip: disable all the extensions you don't need while you're there.)

Now edit the server document for domino.company.example.

Pay close attention now! Even if your server uses Internet Site documents, you must temporarily set "Load Internet configurations from Server\Internet Sites documents:" on the "Basics" tab to Disabled. There is no need to save the server document in this state, but only by disabling Internet Site documents will you expose this part of the server document form on the Ports/Internet Ports tab. Select the Ports/Internet Ports tab now.

Every other type of Internet site has individual settings for SSL on an Internet Site document BUT outbound mail routing via SMTP does not. This is where you tell your server what keyring to use for outbound SMTP TLS. Enter the name of your new keyring file there, then go back to the Basics tab and re-enable Internet Sites if you need to.

Now you can go back to the Ports/Internet Ports tab. You will see that the SSL settings portion of the form has now been hidden. Set Mail (SMTP Inbound) and Mail (SMTP Outbound) like this:

Save the server document.

If you are not using Internet Site documents, you're done. Otherwise open your inbound SMTP Site document and configure the security tab like so:

Make sure the correct keyring file name is there. If you plan to use authentication, you can enable the Name & Password options. Otherwise leave them off.

Now you're done.

5. Testing

Restart the router and SMTP tasks.

To verify that inbound SMTP TLS is working you can set a notes.ini variable SSL_Trace_Keyfileread=1. This will log keyfile reads to the console.

Telnet into port 25 of domino.example.com. Type EHLO whatever after the greeting. You should see something like this:

220 domino.company.example ready at Thu, 25 Feb 2010 12:14:35 +0000
ehlo whatever
250-domino.company.example Hello whatever ([10.0.100.11]), pleased to meet you
250-TLS
250-STARTTLS
250 SIZE

The exact make-up of this may vary but you should see at least 250-TLS and 250-STARTTLS.

Now enter STARTTLS. You should see something like this at the Domino console:

02/25/2010 12:14:55.77 [078C:0029-0988] ReadKeyfile> Recovering password from stash file
02/25/2010 12:14:56.07 [078C:0029-0988] ReadKeyfile> Password is password
02/25/2010 12:14:56.07 [078C:0029-0988] ReadKeyfile> Reading keyfile c:\lotus\domino\data\keyfile.kyr
02/25/2010 12:14:56.09 [078C:0029-0988] ReadKeyfile> Looking for trusted roots
02/25/2010 12:14:56.19 [078C:0029-0988] ReadKeyfile> Found trusted roots
02/25/2010 12:14:56.19 [078C:0029-0988] ReadKeyfile> Exit status = 0
02/25/2010 12:14:56.19 [078C:0029-0988] ReadKeyfile> Recovering password from stash file
02/25/2010 12:14:56.19 [078C:0029-0988] ReadKeyfile> Password is password
02/25/2010 12:14:56.19 [078C:0029-0988] ReadKeyfile> Reading keyfile c:\lotus\domino\data\keyfile.kyr
02/25/2010 12:14:56.19 [078C:0029-0988] ReadKeyfile> Looking for cert chain
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Got cert chain
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Exit status = 0
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Recovering password from stash file
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Password is password
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Reading keyfile c:\lotus\domino\data\keyfile.kyr
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Looking for private key
02/25/2010 12:14:56.23 [078C:0029-0988] ReadKeyfile> Decoding keys
02/25/2010 12:14:56.27 [078C:0029-0988] ReadKeyfile> Keys decoded
02/25/2010 12:14:56.27 [078C:0029-0988] ReadKeyfile> Exit status = 0

Things to look out for: Correct keyring file is being used. Password is found. Exit status is 0.

Testing outbound is less straightforward. You need to wait until the Domino server encounters an external host which offers TLS. When one does, your server will attempt to negotiate a secure channel and you will see a similar SSL keyfile read debug trace at the Domino console.

Remember to set notes.ini SSL_Trace_Keyfileread=0 when you have finished.

Finished. That wasn't difficult or expensive and it does offer some real security benefit where the supposed security benefits of many other common practices around Internet mail are wholly illusory.

Technorati Tag: Show-n-Tell Thursday SnTT

SnTT: Accessing Archives on USB Hard Drives or: Watch for .acl files

Gregg Eldred — Thu, 11 Feb 2010 10:24:45 -0400

An interesting issue occured after upgrading Notes and Domino to 8.5.1. The Notes clients and the Domino server were upgraded without any issues. However, most users were archivnig their mail to a shared 1TB USB hard drive hanging off of a server. At first, everythiing was fine, from opening the archives to moving mail into them. Then, a few people would report that they were receiving an error message when they tried to either open their archive or add documents to it:

Short term fix was to restart the Domino server, which allowed the users to access their data. However, that was not an optimal solution and it only allowed access for a short time before the error message would appear again.

What seems to have resolved this issue was to unplug the USB hard drive's power, while keeping it connected to the server. Then, attaching the power. The "lock" on the files appears to have been removed.

Once it appeared that the issue was resolved, a quick look through IBM Lotus TechNotes revealed that there may have been Directory ACL files associated with the archives. While I did not check for these, if you are having a similar issue, you can use the Adminisration Client to see who has access. Go to the Files tab and select a database. Right click on the file, then select "Manage Directory ACL." You will be presented with a list of people who can access the database. By deleting the ".acl" file, you are removing this setting. You can delete these files while the Domino server is running. Restart the Administration Client to have it update this information.

Link: Restricting access to a server's data directory

Link: Directory ACL lock icon will never disappear even after ACL has been cleared

Lnk: User is unable to see a mail folder on a Domino server

Link: "You are not authorized to perform that operation" when accessing a directory link in Lotus Notes

Technorati tag: Show-n-Tell Thursday SnTT

SnTT: When Deny Lists Don't Work

Gregg Eldred — Wed, 30 Dec 2009 12:54:53 -0400

This is not my tip, it comes from an experienced Domino Administrator that discovered a little unwelcome surprise when simply adding an individual to a Deny Access List.

If you use the "Deny Access Group" to lockout disgruntled employees - you may be surprised to learn that it only denies access to *new* sessions. Pre-existing sessions remain active. And you must use the "Drop" command to force the user from all servers where a session may be active.

So if you have the following scenario, as i did, you may get a surprise.

Manager B asks that "Dave" be address to the Deny Access list at 4pm Thursday night. Because at 9am Friday morning he is going to be asked to clean out his desk
at 4pm your admin dutifully adds Dave to the list - replicates the list to all servers and heads home.
at 10am Friday - you get an angry call - asking how Dave could send email when he was supposed to be locked out!
You look at the server log - and see a lot of entries showing "Dave has been denied access to server" (so obviously the Deny Access is working, right?)
You look in Dave's mail file and see in the "database usage" and in the Sent messages tab - that Dave has been creating mail just fine since he was told he was being let go...
Then after a couple weeks of working with Lotus Technical Support - you finally get to the person who knows the answer (which is not documented in the Admin Manual)
Here's what happened....

Dave never closes his mail file or shutdowns down his PC
Dave has his refresh in-box interval cranked up to 10-15 minutes
Dave's refresh inbox interval defeats the idle session time-out
When Dave comes back to his desk in the morning - his original Notes ( pre-pink slip) session is still open and functioning
he only gets a failure when he tries to access the Domino Directory or any other resource (these are the deny access messages noted in the log).
he can compose and send mail just fine as long as he manually addresses the sendto: (which he does with great enthusiasm/anger)

Lesson Learned:

add Dave to Deny Access List
edit the acl in Dave's Mail File
at 4pm go to console, enter "drop dave/acme" (without the quotes)
repeat at each server (just to be sure)
send note to manager indicating that all reasonable measures have been taken.

Thanks, AJ.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Domino HTTP Task Cannot Bind to Port 80

Gregg Eldred — Thu, 10 Dec 2009 22:54:12 -0400

Performed an upgrade of a Domino server today, from Release 6.5.6 to 8.5.1. Everything was going well until I discovered that the HTTP task wasn't loading. Manually entering load http gave me the error:

HTTP Server: Error - Unable to Bind , port 80, port may be in use

Was IIS running on the server? No. Was there some other process grabbing port 80? A netstat -anb in a Windows command window didn't reveal anything. What about a TechNote? I did find one that seemed to fit the issue:

Domino 8 tests for and returns an error for a misconfiguration of the Server document. Domino 7 did not test for this condition.

If the "Host name(s)" field in the Server document > Internet Protocols > HTTP tab contains both an IP Address and server name when "bind to host name" is enabled, then an error occurs because you do not need to specify both an IP and server name in that field. Only one value is required.

Confirmed that there was only one value in the field, as the "bind to host name" was enabled.

The curious thing was that restarting the HTTP task sometimes returned another error:

HTTP Server: Error - Unable to Bind port 80, port may be in use or user needs net_privaddr privilege

In a moment of clarity, I decided to Google the problem. Not quite the first hit, but within the top 5, was a post by Ben Langhinrichs. Looking at the server, I noticed that they were running AVG 8. And I finally put it all together. Following Ben's advice, I modified AVG's Web Shield - Web Protection to not scan ports 80 and 8080, restarted the Domino HTTP task, and notified the client that iNotes was now available.

Thanks, Ben, for a great post.

Link: Error after upgrade: "HTTP Server: Error - Unable to Bind ... port may be in use"

Link: Ben Langhinrichs: Solution to 'Cannot bind port 80' error caused by AVG

Technorati tag: Show-n-Tell Thursday SnTT

SnTT - Resolving Two "Annoyances" for Notes Mail Users

Gregg Eldred — Fri, 4 Dec 2009 10:22:59 -0400

For the most part, upgrading from Lotus Notes 6.5.x or 7.x to Lotus Notes 8.5.x is painless for the users. However, in my travels, I have spent time resolving the same two "issues" for several organizations. Granted, a little training, setting of expectations, or a small Notes 8.5.x pilot group would go a long way in alleviating these "issues," however time can be precious. To that end, here are the two things that I find myself adjusting.

First, images do not display in HTML mail. An example of this is:

In order for you to see the images, you have to click on "Show images:"

And then your mail message looks like this:

The reason for this action is to help protect the user from image viruses.

To resolve this "problem," simply have the user click on File - Preferences - Mail - Internet. Then, under the section "Image Security", you can use the checkbox to enable or disable this feature:

If you are packaging a Notes install, you can change this using a notes.ini setting, NoDelayedRemoteImages:
To disable the option, set the parameter to 0: NoDelayedRemoteImages=0.
To enable the option, set the parameter to 1: NoDelayedRemoteImages=1.

The second "issue" requires the Domino Designer to resolve. When an internet message is received, the recipient is not shown the sender address details. To view them, you have to click "Show details:"

Once clicked, the user now sees:

I find this nice and clean. But, at times, I am in the minority. So, if you have people that prefer to see the details for all of their internet messages, break out your Domino Designer and let's go "fix" this. By the way, if more people than not want this ffeature, it would be best if you modified the mail template or, better, created a new template for only those that want this functionaility. Finally, it won't take long to make this change

First, in Domino Designer, open the mail file. Then, select Forms - Message - Objects panel and open "Memo (Form)." Finally, in the QueryOpen of the Memo form, add the following two lines (in italics):


If source.InPreviewPane Then Exit Sub
'*********************************************
'Begin Quota Checking Code
'*********************************************
Dim check_quota As Integer
Dim session As New NotesSession
Call session.SetEnvironmentVar("mHeaderDetails",1)
check_quota = False

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

Remember, if a majority of your mail users prefer to not click "Show details," seriously consider making this change to the mail template.

And document this change. :-)

Technorati tag: Show-n-Tell Thursday SnTT

SnTT: Starting the Domino 8.5 Console - Notes.INI Setting

Gregg Eldred — Fri, 20 Nov 2009 00:00:00 -0400

If you are new to Domino 8.5.x, you have discovered that when Windows starts the Domino Service, you are no longer presented with the Domino console. In order to view to console, you have to launch the Domino Console application (usually sitting right there on the Desktop).

When you first install, or upgrade, your Domino server, the Domino console application will launch without an issue. However, I have found that after a restart, the Domino console will not launch, as it presents you with a dialog box stating that it can't find the server or that the IP Address is wrong. This is probably my fault; something I have done (or not done). When I was presented with the dialog box, I had to enter two lines into the Notes.INI of the server in order to get the Domino console to start.

For the sake of this post, let's say that you have only one Domino server running on a Windows Server and it is on IP Address 192.168.1.100. Add these two lines to the Notes.INI:
TCPIP_TCPIPAddress=192.168.1.100
TCPIP_ControllerTCPIPAddress=192.168.1.100

A restart of the server is not necessary for these entries and once entered, the Domino 8.5.x console will start.

Technorati tag: Show-n-Tell Thursday SnTT

SnTT: Running Notes 8.5.1 on Microsoft Terminal Server 2008 64-bit

Gregg Eldred — Tue, 10 Nov 2009 21:23:42 -0400

A customer purchased a big, bad Windows Terminal Server 2008 64-bit. Among the applications to be deployed on the platform was supposed to be Lotus Notes Release 8.5.1. When asked about this, the first thing I did was search the TechNotes. That research resulted in this:

Question
Is the Lotus Notes client supported on Microsoft Windows Server 2003 or Windows Server 2008 Terminal Services? You are unclear as to whether Lotus Notes clients are supported in a Terminal environment on Windows Terminal server without Citrix MetaFrame installed. In this scenario, the Notes client would be installed on a Windows 2003 terminal client and on Windows Server 2003 Terminal Services.

Answer
No, the Notes client is not designed or supported to run in this scenario (using a Windows Terminal client and Windows Server Terminal Services). A Notes client can run on a Windows 2003 or 2008 Terminal Server only if Citrix MetaFrame is used as well. While Windows Server Terminal Services emulation with Lotus Notes can work, this configuration is not supported.

A correct assumption would be that Citrix MetaFrame was not being used.

As the network administrator was attempting to determine how to workaround this "setback," I continued to search for possible answers on PlanetLotus and the Forums. In the Notes/Domino 8.5 Forum, I found, and turned over to the network administrator, this (somewhat edited from the original):

1) After installing 8.5.1, search for the notes,ini and it should not appear in the windows folder. Delete it if you found it there.

2) The notes.ini file should appear in c:\documents and settings\All users\application data\lotus\notes\data\ and the content in it should be: (please note the actual path should be according to your environment)

[Notes]
KitType=1
SharedDataDirectory=C:\Documents and Settings\All Users\Application Data\Lotus\Notes\Data\Shared
InstallType=6

3) edit the following registry entries:
[HKLM\Software\Lotus\Notes\DataPath] Remove the value.
[HKLM\Software\Lotus\Notes\MultiUser] Change the value from 0 to 1.
[HKLM\Software\Lotus\Notes\8.0\DataPath] Remove the value.
[HKLM\Software\Lotus\Notes\8.0\MultiUser] Change the value from 0 to 1.

Moments later, I was confronted by a very happy administrator, as he had Notes 8.5.1 running successfully on Microsoft Terminal Server. The downside is that there will probably be no support from Lotus for this configuration.

Link: Is Lotus Notes supported on Windows Terminal Services?

Link: Notes/Domino 8.5 Forum: Yew Lee Yong: 8.5.1 works in Terminal Server 2003 32/64 bit

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Using 'Run on Behalf' Agents to Access Data Where One User Doesn't Have Reader Rights

Gregg Eldred — Thu, 8 Oct 2009 09:59:42 -0400

Let's welcome a guest blogger for today's Show-n-Tell Thursday, Branimir Ćorluka. He will show us how a "Run on Behalf" agent can allow one user to see data to which he does not have access, so that the same user can complete a task.

There may be a situation where a user needs to compare or check some data that is located in documents on which the user does not have reader rights. This may occur fairly regularly in the course of a day, especially where one person is responsible for an administrative task.

For example, one user enters data in a time sheet document for all the employees in his department. He picks a category (vacation, trip, sick) for each working day. When an employee goes to visit a customer, that employee creates a travel document. In this document are the facts about the trip (duration, expenses ...). It makes sense that the user that fills the time sheet does not have access to the travel details. But when the user saves the time sheet he should be warned if the data that he has filled in does not match the data from the travel document (for example, the hours worked may be different, due to travel duration, or some other circumstance).

There is a handy agent option, introduced in Lotus Notes and Domino Release 6, that can resolve this issue. It is called "Run on behalf of" and it allows you to specify on whose authority this agent can run. The agent property looks like this:

It allows developers to execute the code under someone else's rights. It seems simple, right? It is as long the agent's trigger is set to scheduled or we invoke the agent via @Command([ToolsRunMacro];""). However, it gets tricky when the trigger is "On event" and we already have some LotusScript code in the event which should trigger the agent. It is natural then to use the NotesAgent class and its method Run. The trouble with that is we cannot interact with the user; no Messagebox, no Print statement.

Lotus Designer Help says:
"The user cannot interact directly with a called agent. User output goes to the Domino log."

So there is no way to display the results? Actually there is, but we need a work-around.

First we need to create a form with one field on it, in this example I will call the form "msForm" and the field "body." Place the following code in the QueryOpen event:


Sub Queryopen(Source As Notesuidocument, Mode As Integer, Isnewdoc As Variant, Continue As Variant)
	Messagebox source.Document.body(0)
	continue = False
End Sub

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

This piece of code shows a Messagebox to the user with the content of the body field. Then it stops the form from opening.

Now, we need to create a "Run on behalf of ..." agent. The runtime properties of the agent should be set to On Event, Agent list selection and None. With the following code in the declarations section.


Class ShowNoAccesData
	
	Private msDoc As notesdocument
	
	Sub New(message As String)
		Dim s As New NotesSession
		Dim db As notesdatabase
		Set db = s.currentdatabase
		Set MsDoc = db.CreateDocument
		
		MsDoc.Form = "msForm"
		MsDoc.body = message
		
		Dim ws As New notesuiworkspace
		Call ws.EditDocument(False, msDoc)
	End Sub
	
End Class

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

As you can see, the simple class, ShowNoAcces, data consists of a constructor whose argument is the message we need to show to the user.

We create an instance of the document with the msForm we have created before, fill it with our data and open it in the UI. As you may recall, we won't allow this form to open. We will show the content of the form in the Messagebox and prohibit the opening of the form.

The following code comes into the Initialize section of the agent::


Sub Initialize
	Dim s As New notessession
	Dim noAccessView As notesview
	Dim doc As NotesDocument
	
	Set noAccessView = s.CurrentDatabase.GetView("noAccessView")
	Set doc = noAccessView.GetFirstDocument
	
	Dim	snad As New ShowNoAccesData(doc.data(0))
	
End Sub

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

Of course it is up to you how to find the document with the data, process the data and pass the results to the class constructor.

You also decide how to run the agent, for example you can choose to start it with a button click. Or like in this case in a QuerySave event:


Sub Querysave(Source As Notesuidocument, Continue As Variant)
	Dim s As New notessession
	Dim ourAgent As notesagent
	
	Set ourAgent = s.CurrentDatabase.GetAgent("(ShowNoAccessDataAgent)")
	If Not(ourAgent Is Nothing) Then
		Call ourAgent.Run
	Else
		Msgbox "Agent could not be found."
	End If	
End Sub

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

By following this, one user can see and act on data which he doesn't have Reader access, while maintaining the security of the data.

[UPDATE]: Craig Schumann has pointed out, in the comments to this SnTT post, that you need to be very careful with this scenario, and has given me a link to an excellent post detailing the issues. His post is entitled "Fragile UI? Don't do it on "my behalf!". Be sure to read the comments to his post, too.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Implementing RAID on Lotus Foundations Start

Gregg Eldred — Wed, 23 Sep 2009 11:02:02 -0400

One feature of Lotus Foundations that has eluded me is no longer a mystery.

An option, when configuring a Lotus Foundations server for a customer, is RAID. In the configuration tool, a Business Partner can choose "none," RAID1, or RAID5. Interestingly, there is never a cost for any of those choices. Conversations with several people indicated that it was either free or an additional cost. With no solid answer, I was a bit confused. However, a little patience and another reading of the Foundations Administrators Guide (this time, focusing on RAID), paid off.

RAID, on Foundations, is configured through the software (assuming you have purchased the appropriate number of drives).

Remember, if you are configuring the Foundations server, to add the appropriate number of 250GB drives to achieve the level of RAID that your customer requires. And then use Disk Status within the Lotus Foundations WebConfig to implement RAID through the software.

From the Lotus Foundations 1.1 Getting Started Guide:

For example, if you have two disks, the Disk Status section displays "The main disk is not configured. You can configure disks #1, #2 all in a RAID or disk #1 as a standalone disk and #2 as an IDB backup disk." If you have three disks, the Disk Status section displays "The main disk is not configured. You can configure disks #1, #2. #3 all in a RAID or disk #1.#2 in a RAID and disk #3 as an IDB backup disk." A Lotus Foundations server could have up to 6 drives, and a third-party server could potentially have more.
For a RAID configuration, click All in a RAID. If you want to enable IDB backup, click Disk #2 as an IDB backup disk.
If you select a RAID configuration, then the RAID array begins to rebuild. This process does not noticeably affect the performance of Lotus Foundations.

A little more careful research (and proper ordering of drives), a couple of mouse clicks, and you have an extremely solid SMB server. While I think that RAID would be a feature that would make a good selling point, none of the marketing materials from IBM mention it. But that doesn't make a difference, now that you (and I) know how to configure and implement it. :-)

Link: Configure disks (Lotus Foundations Start 1.1 - Getting Started Guide)

Technorati tag: Lotus Foundations SnTT Show-n-Tell Thursday

SnTT - Resolving IE and iNotes Issues - One Solution

Gregg Eldred — Wed, 16 Sep 2009 11:48:56 -0400

A little while ago, I posted a problem I was having with IE6/IE7 and iNotes. The issue was that if a user attempts to use the iNotes Address Picker to select addressees, the Subject and Body fields of the new memo are not accessible in the browser. The post generated some really good comments; the most thorough of which was one by Chris Whisonant. He linked to an excellent troubleshooting script he created for resolving a lot of IE and iNotes issues:

Disable Pop-Up blocker
Clean up spyware (use application such as Spybot and/or AdAware)
Add DWA server to Internet Explorer's Trusted Sites zone (this may be a good idea for any other intranet servers or via an Active Directory policy)
Clear out Java Cache by running C:\Program Files\Java\jre1.5.0_0X\bin\javacpl.exe
Clear out Windows temp folders.
Reset IE to default settings.
Tools > Internet Options > Advanced > Disable "Use HTTP 1.1" (you may need to enable it because sometimes IE just doesn't like the setting. I have actually seen it start working by enabling this option.)
Tools > Internet Options > Advanced > Disable "Do not save encrypted pages to disk"
Download the MSXML 4.0 SP2. This link will get you to the download. I selected the msxml.msi.
Clear Browser Cache
Delete iNotes or Domino Web Access class file
If one is currently installed, upgrade to the latest Sun JVM
Windows Update (also verify that a recent Windows Update has not broken this!)
Load Convert, Fixup, Updall, and Compact against the mailfile
Reboot
Defrag
Run a tool such as Symantec/Norton WinDoctor

As you might imagine, running through the script takes a little time. Once I completed it, however, there was no change in iNotes' behavior. It was then that I had a wild thought - these workstations all have Google Toolbar loaded on them. What if I uninstalled it?

That worked.

Now, it could have been that the Google Toolbar Pop-up Blocker was active, but I did not take the time to investigate that option. I simply used Control Panel and removed Google Toolbar. And, if was there, Google Updater, too.

The Lotus Support site has only a handful of documents referencing Google Toolbar: Likewise, the developerWorks:Lotus forums are rather light on search results as well, with the exception of the Notes/Domino 6 and 7 forum. Perusing the search results there, there were a couple of good hits. After the fact, of course. :-)

In this particular case, my advice would be to uninstall Google Toolbar, unless you want to take some time working with the Google Toolbar Pop-up Blocker.

Link: Chris Whisonant: Domino Web Access Warning

Link: developerWorks:Lotus Support Search 'Google Toolbar'

Link: Notes/Domino 6 and 7 Forum: 'Google Toolbar' Search Results

Technorati tag: SnTT Show-n-Tell Thursday Google Toolbar

SnTT: Rolling Back Domino Versions on AIX

Gregg Eldred — Thu, 13 Aug 2009 15:33:10 -0400

The installation of Domino on AIX is fairly well documented, and one place to learn is from a posting by Keith Brooks. Before installing the new version of Domino, you will want to back up the existing install. An easy method is to use the tar command for this purpose. However, you will want to make sure that you have enough disk space for this file, probably about 600MB (more or less). To create the tar file, at a command prompt, type:

tar -cfv * <===Note: the "splat" is part of the command

The v switch puts the command in verbose mode, so that you can see the files being added to the tar file.

Now, install the new version of Domino, following the steps outlined in, for example, Keith's post. Start your server, do your testing to confirm that mail is routing and any Domino add-ins are functioning properly. However, should you install, for example, 64-bit Domino 8.5 on AIX and find that some add-in does not work, you may be required to rollback to your previous version.

[Blog intermission - this is where you realize that operating systems like OS/400, AIX, Linux, and Solaris are really, really good].

Stop the Domino server. The Domino program files, for example, might be found in /opt/lotus/domino. Delete the domino folder. Change your directory to the location of the tar file that you created before you performed the upgrade. In that directory, type:

tar -xvf

This command might look like this:

tar -xvf domino801.tar /opt/lotus

Once you have extracted the files from the tar, start the Domino server. You will see that you are now running the previous version. At this point, check the core Domino files, admin4, names, and events for the template versions. You may have to replace the design of those files to use the older version's templates.

Please note: the tar commands and Domino file structure may not be exact, but should provide enough information to assist you.

Technorati tag: Show-n-Tell Thursday SnTT

SnTT - Implementing SSL on Your Domino Server

Gregg Eldred — Thu, 6 Aug 2009 22:20:07 -0400

Trying to implement SSL on your Domino server? Ready to punch the computer because the Help Files aren't helping? Having a hard time reconciling the fact that it should be "easy," yet you've been at it for a day? Thanks to a good search of the IBM TechNotes and an excellent post by Andrew Pollack, anyone can implement SSL in a very short time.

Andrew took the time to condense a lot of information into a short PDF that will show you how to implement SSL using a top level Certificate Authority (CA). You can find his post here.

IBM also has an excellent TechNote on the subject, probably one of the best written TechNotes I have seen. This particular one details how to use Domino as its own CA to implement SSL, which is quite handy. And free. You can find the TechNote here.

Between these two documents, you should have no problems with SSL and Domino.

Link: Andrew Pollack: Creating an SSL Certificate for IBM Lotus Domino

Link: Quick guide to setting up SSL using Domino as the Certificate Authority

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Lotus Notes Database Icons

Gregg Eldred — Thu, 30 Jul 2009 00:00:00 -0400

I came across this site today that has a lot of nice icons for your Lotus Notes databases. A little more up-to-date than the offering in the Sandbox. And from what I can tell, it is done in XPages, too.

Here are some sample Star Wars Icons:

I am always on the lookout for new icons, or icon sources, and NotesRing.com seems to have a nice selection.

Technorati tag: Show-n-Tell Thursday SnTT

SnTT - Limitations of Domino Server on Lotus Foundations Start

Gregg Eldred — Thu, 11 Jun 2009 11:09:41 -0400

If you watch the Lotus Web Community (aka "Lotus Bloggers"), you would have seen, over the last week, news that Lotus Foundations Start is attracting more Microsoft Business Partners to the fold.

One of the more frequent questions heard in the Lotus Community has been something along the lines of "what is the difference between a 'normal' Domino Server and the one on Lotus Foundations Start?" IBM released a TechNote late last month that addressed this question. Among the differences are:

Users and Teams are synchronized between Lotus Foundations and Domino (Users and Groups)

If users or groups are defined in a Domino Administrative interface that do not exist as users or teams in the Lotus Foundations Start, those users or groups will be removed. Domino group membership must match the team membership in Lotus Foundations.

Constantly Changing Settings

The following settings in the server document or server configuration document are periodically set in the Foundations Start server. Those settings in the server document are indicated by [s] and those in the server configuration document are marked with [c].

o LDAP Setup ' always disabled
o SMTP Setup ' synchronized to settings in Webconfig
o POP3 Setup ' synchronized to settings in Webconfig
o IMAP Setup ' synchronized to settings in Webconfig
o WebMail Setup ' synchronized to settings in Webconfig
o Home URL is set to NitixDWA.nsf (a DWA redirector)
o Fully qualified Internet host name [s] = servers fully qualified domain name
o Automatically Restart Server after Fault/Crash [s] - enabled
o Transaction Logging is enabled with circular logging.
o Set warnings and error notification for quotas to per message.
o DenyAccess [s] = ensure it contains the "Disabled" group which maps to the disabled group for Foundations users
o TCP/IP Port number 60080
o TCP/IP port status Redirect to SSL
o SSL Port number 4443
o Home URL: /NitixDWA.nsf

More limitaions of the Domino Server on Lotus Foundations Start can be found in the link.

Link: Limitations of the Domino server within Lotus Foundations Start

Technorati tag: SnTT Shown-n-Tell Thursday

SnTT: Launching Notes Basic or Notes Standard Clients

Gregg Eldred — Fri, 29 May 2009 11:07:08 -0400

After migrating a Domino server to new hardware and upgrading it to Domino 8.5 (from R5), the client has a few workstations that cannot handle the Notes Standard Client. To mitigate performance issues on these older workstations, Lotus has two choices to allow the user to run the Notes Basic Client, which can be found in the TechNote, "What's new in Lotus Notes 8 Client?".

To launch Notes 8 (Basic Configuration), create a shortcut on your desktop to point to nlnotes.exe in the Notes program directory. Or, simply launch nlnotes.exe. In addition, you can create a shortcut which executes notes.exe within the Notes program directory and add one of two command line switches, -sa or -basic. For example: C:\Program Files\Lotus\Notes\notes.exe -sa.

As of Notes 8.0.2 and Notes 8.5, there is a Notes.ini parameter that can be used to control launching of Basic and Standard. Adding UseBasicNotes=1 to a Notes Standard install will launch Notes Basic instead. If the ini is not present or is set to UseBasicNotes=0, the Notes Standard client will run.

If you are wondering why you would choose one method over another, that is, why use the ini parameter when you can change the shortcut, there is another TechNote that addresses this question (emphasis, mine).

A new notes.ini feature in Notes 8.0.2 added the ability to install the 8.0.2 Notes Standard client, but launch the Basic client based on a Notes.ini parameter UseBasicNotes=1. This notes.ini parameter will allow external programs that launch Notes, such as a MailTo: URL, or launching an NSF file directly, to launch Notes in Basic mode if UseBasicNotes=1 is set in the Notes.ini. This will allow customers to rollout a single package, but define which users will launch Basic vs Standard via this Notes.ini parameter.

To assist with the differences between the Basic and Standard Notes Clients, you can find those on page 165 of the IBM Lotus Notes and Domino 8 Reviewers Guide. Finally, if you are new to R8, you will find that the menu structure has changed. Again, there is a TechNote to assist you and your users with the transition to Notes 8. The one menu option that I always enable is "Advanced Menus." Most users will not need this option, but it may be useful to enable this option. To enable Advanced Menus, simply click on View - Advanced Menus.

Link: What's new in Lotus Notes 8 Client?

Link: Using 'UseBasicNotes=1' in a multi-user installation causes Notes setup to hang

Link: Menu mappings: Where to find Notes 6/7 menus that have changed in Notes 8

Technorati tag: Show-n-Tell Thursday SnTT

SnTT: Controlling Concurrent Messages on BES

Gregg Eldred — Thu, 19 Mar 2009 14:09:38 -0400

Intermittent issues with a Blackberry Enterprise Server (BES) that required a restart caused me to look at the logs to see if I could determine an underlying issue. Since this site had only one BES, running on Domino, the search through the logs didn't really take a lot of time. Just prior to the server hanging, I saw that one user had sent one large e-mail to quite a few internal recipients, most of them with Blackberry devices. The time consuming part was trying to search the Blackberry and Lotus support sites to find a solution. Patience rewarded me with this Blackberry TechNote:

When a large email message that shares a Universal Identifier (UNID) is sent to multiple BlackBerry enabled recipients with accounts on the same BlackBerry Enterprise Server, an increase in memory usage occurs. This may destabilize the BlackBerry Messaging Agent, requiring that it be restarted.

As the BlackBerry Messaging Agent processes email messages, it requests a copy of the email message from the messaging server. The BlackBerry Messaging Agent is a multi-threaded application that can process more than one email message at the same time. A standard deployment of the BlackBerry Enterprise Server in a 32-bit environment has approximately 2 GBs of addressable memory space. A portion of this memory is reserved for processing messages. Sending a large email message to a large number of BlackBerry smartphone users that are on a single BlackBerry Enterprise server could result in attempts to exceed this portion of memory.

As the TechNote recommended, the value of DocumentThrottleMaxDocOpen should be between 20-30, so as not to create really noticeable mail delays. We have it set to 20 and are monitoring the users and the server to see if there are any issues. The command to set the value is:

TraitTool.exe -trait DocumentThrottleMaxDocOpen -global -set [value]

Link: How to control the number of concurrent documents that are opened based on UNID

Technorati tag: Show-n-Tell Thursday SnTT Lotus Domino Blackberry Enterprise Server

SnTT - Someone Else's SnTT Post Made Me Look Good

Gregg Eldred — Wed, 18 Feb 2009 23:32:25 -0400

There is a lot of value to the Show-n-Tell Thursday posts. The amazing thing is that I read them all, no matter the subject matter. And then, having them reflected on PlanetLotus, makes searching for them a breeze. Which brings me to today's used/reused SnTT post.

Working with the Notes Log at a client site today, I was struck by certain entries in the Log and on the console. Over and over again, I was seeing

Begin CD to MIME Conversion (Process: Router

And I remembered that someone posted on this topic. A quick search of PlanetLotus turned up this gem:

This is an oldie, yet continues to plague log files of the world over! I figured I'd spread the love as I see it regularly on Domino servers (much to the annoyance of their administrators!)

Begin CD to MIME Conversion (Process: Router

As if it wan't bad enough that the log file told us when it BEGAN, it then had to create a whole seperate entry to tell us when it ended. Sigh.

These notifications can be removed by the following Notes.ini parameter:

Converter_Log_Level=10

The router must be restarted for this parameter to take affect. For more information, read the IBM Technote, How to disable logging when a message is converted.

Ah. The log looks so much better now.

Without access to the server to make the change directly to the servers' Notes.ini file, I used a console command:

set config Converter_Log_Level=10

The console responded with the setting. I then took Jess' advice and restarted the Router task on the server by entering the following on the console:

restart task router

I agree with Jess: Ah. The log (and console) looks so much better now.

Thanks, Jess.

Technorati tag: Show-n-Tell Thursday SnTT

SnTT - Notes/Domino 8.5 TechNotes

Gregg Eldred — Thu, 8 Jan 2009 00:00:00 -0400

IBM has published a few Notes/Domino 8.5 related TechNotes for our consumption.

Two highlights from the linked TechNotes include:

New file formats supported in the KeyView filters: ODT, DOCX and DOCM, ODS, PPTX, PPTM, POTX, POTM, PPSX, and PPSM
Domino Configuration Tuner (DCT) is available

Speaking of DCT, it is, as IBM has said many times, free.

Domino Configuration Tuner is available to any customer free of charge. It works with Lotus Domino server 7.0 and later, and runs on the Lotus Notes client, standard or basic, version 8 and later. There are no required changes to a customer domain configuration in order to take advantage of DCT evaluation.

Link: Lotus Notes 8.5 - Detailed System Requirements

Link: Lotus iNotes 8.5 - Detailed System Requirements

Link: Domino 8.5 - Detailed System Requirements

Link: Domino and Notes 8.5 - KeyView filter formats supported

Link: Domino 8.5 - Supported LDAP directory servers

Link: Domino Configuration Tuner (DCT) provides easy-to-use self-service configuration

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Enabling Client Single Signon Using a MST

Gregg Eldred — Wed, 24 Dec 2008 11:14:58 -0400

If you are considering the use of InstallShield Tuner for Lotus Notes to roll out your Notes Clients, then you owe it to yourself to head over to Andy's blog to get the best information on this tool. This SnTT tip adds a specific function to his excellent information. Sometime, in the middle of a client rollout, we were asked to add Client Single Signon to the MST. After several attempts to get this functionality added to the MST, without success, Lotus Tech Support provided me with a TechNote that resolved the issue.

FOR A NEW INSTALL:

To modify an MST in the InstallShield Tuner to install the Client Single Logon Feature for a new install, follow these steps (for upgrades, see below):

Create a new MST.
Open the Table Editor Section --> Feature Section.
Go to the ClientSingleLogon row, to the Level -i2 Column.
The default value for this column is 101; this needs to be changed to 1.
Go back to the Setup Organization --> Features --> Client Single Logon Feature section, and you will see that it is now set to "This feature is installed on the local drive".
Save and close the MST.
The client can then be installed silently, as described in the document titled "General Overview of How To Perform a Silent Install of Notes 6 Client" (#1109400).

FOR EXISTING CLIENTS:

To add the feature to an existing client manually, launch the install again, choose to modify the install, and add the Client Single Logon Feature. To install the Client Single Feature silently, use the ADD the feature when calling the MSI, for example:

Msiexec /i "\\path\to\installfiles\Lotus Notes 6.5.x.msi" ADDLOCAL=ClientSingleLogon /qb+

and use:

/qn for a completely silent install (no user intervention) with no progress bar, or

/qb for a silent install (no user intervention) with progress bar.

Link: How to enable Client Single Logon feature using an MST during a silent install

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Running nlnotes.exe While Domino Server is Up

Gregg Eldred — Wed, 24 Dec 2008 10:59:16 -0400

This SnTT post is the result of a conversation I had with Lotus Tech Support. When sitting at the Domino Server (Windows) working on an issue, the Tech asked how I was accessing a database. I told him that I launched nlnotes.exe. Shortly after mentioning this, he sent me this TechNote:

Running the nlnotes.exe is not supported. If you need to access databases locally at the physical server, it is recommended to install the Notes Client or Administrative Client in a separate directory from the Domino server.

Notes:

If the Domino server is enabled with transaction logging, using nlnotes.exe on a database that is transactionally logged will change the DBIID.
If running a Notes 8 client, running nlnotes.exe is no longer possible. Running notes.exe is necessary to load the Eclipse framework.

I hesitate to recommend the installation of a Notes client on the server, but if you are running Transactional Logging, it's good to know the ramifications of using nlnotes.exe on the server.

Link: Running nlnotes.exe in the Domino directory while the Domino server is running

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Running Concurrent Agents in One Database

Gregg Eldred — Wed, 24 Dec 2008 10:26:58 -0400

Tomorrow is the last Thursday of 2008, and I have several Show-n-Tell Thursday posts that I started but never really finished. These posts are ones where I created as placeholders for things that balied me out of a few jams, but I didn't really have much more to add. But you may find value, as I did, in these. Here is the first one.

Domino does not provide you with the ability to run concurrent agents in a database. However, there are two methods that will allow you this feature, even though they are unsupported (read: don't call Lotus Tech Support if you run into issues). When I was presented with this task, I learned that Domino processes agents sequentially. But, spending a little time searching the TechNotes, I found these two techniques. First, you can use a Program Document:

Create a Program document, and fill out the following fields on the form as shown:

Program Name: nserver (or server if not Windows platform)

Command Line: -c "tell amgr run 'database.nsf' 'agent'"

Substitute your database name and agent name. The correct use of quotation marks ( " ) and apostrophe ( ' ) is important.

When Domino runs the agent this way, a separate thread is created to process the agent. This separate thread allows it to run while other agents are being processed through the Agent Manager task.

The caveats for this technique are worth your consideration. For example, if you do a tell agmr sched at the console, the agent will not appear. Also, you may experience some server performance issues.

The second method to achieve this, is to use a wrapper agent. As the Program Document worked for me, I didn't even consider this option. But you may find it useful. The caveats for this one include considering the use of document locking and issues with logic.

Link: How to run multiple agents in the same database using a Program document

Link: How to run two agents concurrently in the same database using a wrapper agent

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - A Strange Folder Icon

Gregg Eldred — Fri, 5 Dec 2008 15:45:14 -0400

Let's look at the standard Lotus Notes View and Folder icons, as provided to us in a TechNote.

However, this TechNote doesn't address Folder Icons that look like this ===> <=== Notice the blue shading of the entire folder icon? I realize that the icon is a little small, so this is what a couple of them look like in a mail file, along with some normal ones:

Before calling Lotus Tech Support, I did the following:

Thinking this was related to the workstation, opened the mail file on my PC. The folders maintained their blue-green shading
Refresh the design of the mail file
Replace the design of the mail file
Replace the design of the mail file with the Discussion Database template and then replace it with the mail template
Examine the design of the mail file. The folders are not Private (denoted by a key icon)
Noticed, in Designer, that the problem folders, while appearing heirarchical, curiously, didn't have a parent folder
Created new folder, using just the parent name. Folder created properly. But if I dragged one of the blue-green folders to the new folder, the Folder icon went missing.
Created new folders in the mail file. They all appear normal. That is, yellow.
Created a new copy of the mail file. The folder icons were still blue-green.
Tweeted my followers, asking for ideas

It was at this point that I called Lotus Tech Support. Unfortunately, the tech hadn't seen this behaviour before, so I uploaded a design copy of the mail to him for further analysis. And then I waited for a response.

The answer came back in about an hour (sweet!) with the contents of an existing TechNote.

When working with documents in a Lotus Notes® client, you are unable to drag and drop documents into a particular folder. As you drag the documents, a "not allowed" icon, a circle with a slash, appears over the folder name, indicating that the operation is not allowed.

Strange, I thought, but I'll test their theory. This is what I saw when trying to drag-n-drop a mail message into one of those folders:

And the cause of this issue?

If you attempt to drag and drop to a folder when a folder hierarchy does not contain a folder at that level, then the "not allowed" icon appears because that operation is not possible.

For example, you have created a folder named folder1\folder2, but you do not have a folder named folder1. If you attempt to drag to folder1, which does not exist as a separate folder, you see the icon. You might never have created folder1 or created but later deleted it.

Very nice. But I decided to take this a little further. We are in the process of upgrading to Notes/Domino Release 8.0.x. So, I made a design copy of the mail file on our test Domino 8 server and replaced the design with Domino 8 Mail Template. How do these particular folders look in R8?

As you can tell, the difference is striking in Release 8; The orange folders are the normal ones.

So, if you want to fix it (in this case, we are just going to leave it as it is) the TechNote will help:

If you want to drag and drop documents into a folder hierarchy, then a folder for the relative level of the hierarchy must exist. Create a folder if necessary to resolve the problem.

Examples:

You have a folder hierarchy of folder1\folder2, If you want to drag a document into folder1, then you must create a folder named folder1.

You have a folder hierarchy of folder1\folder2\folder3. If you want to drag documents into folder2 or folder3, but not folder1, then you must be sure you create a folder named folder1\folder2. Note: The folder folder1\folder2\folder3 does not need to be created; it already exists given the hierarchy.

I think that there should be one more entry in the "Standard Icons for Views & Folders" TechNote. :-)

Link: What are the Standard Icons for Views & Folders and What Do They Tell You?

Link: Unable to drag and drop a document into a folder because slash displays over the folder name

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Obsolete Notes.INI Parameters

Gregg Eldred — Wed, 3 Dec 2008 20:26:58 -0400

Ulrich Krause's post "Look into your Notes.ini, please" and other, recent posts concerning the Notes.INI reminded me of another topic related to that file.

As you upgrade your Domino servers to the next release, it is ~~a good~~ an excellent idea to examine your server's Notes.INI for obsolete entries and remove them. How do you know what lines to delete? IBM has several TechNotes to assist you with this process. For example, these are the obsolete entries for Domino 8.0 and 8.0.1:

Obsolete variables as of Notes/Domino 8.0:

ADMINUSEPROCESSES

BypassNewTotaling

CLUSTER_NAME_CACHE_SIZE

DEBUG_CONSOLETOSCRAP

DEBUG_DB2_QV_ENABLE_HTTP

DEBUG_DISABLE_JIT_SUPPORT

DEBUG_DISABLE_LARGE_FILE_SUPPORT

DEBUG_ENABLE_ODS42

DEBUG_LOGGER_BUF_FULL_MIN_WAIT

DEBUG_NAMELOOKUP_MISSES

DEBUG_NAMELOOKUP_NOHITS_NOERRORS

DEBUG_NLCGTRACE_TEARDOWN

DEBUG_NONQUINCY_DEBUGGER

DEBUG_SCR_ENABLED

DEBUG_SECURE_ALLOW_2048

DEBUGGING_NLMS

DEDICATED

DONT_CACHE_MONITOR_FORMULAS

DWSAddinMaxThreads

EVENT_SETUP_LEVEL_CLEAN_MESSAGES

FT_SUMM_DEFAULT_LANGUAGE

FT_SUMMARY_SIZE

HTTPDomWSForceFromValue

HTTPNoDomWSAppSpace

LSMODULE_TRACE

MACR6StatusBar

MAPI_602PSTFILE

MCC_DefaultLang

MEMORY_LOW_CUSHION

POLICY_USE_POLLASTMOD

PREEMPTIONTIMER

SEG_PER_FIXED_ALLOC

ServerRequiredFileHandles

SESSIONKEY_CHECK_FILE

SKIP_FIXUP

WINCON_GEOMETRY

Obsolete variables as of Notes/Domino 8.0.1:

ABSort

CALLWS_DUMPHEAP

DEBUG_CA_SERVER

DEBUG_CHECK_ABSTRACT_LENGTH

DEBUG_LS_MEMORY_DUMP

DEBUG_LS_MEMORY_DUMP_OUTFILE

DEBUG_SIMULATE_UNDO_LEAK

ENABLE_ON_DEMAND_COLLATIONS

EnableRTFMergedCells

WSINVOKE_DEBUG

Cleaning up the Notes.INI, in most cases, will require a server restart to flush newly removed values from the cache. Plan accordingly. :-)

Link: Obsolete notes.ini variables in Notes/Domino 8.x
Link: Obsolete notes.ini variables in Notes/Domino 7.x
Link: Obsolete notes.ini variables in Notes/Domino 6.5

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Hiding Person Documents in the Domino Directory

Gregg Eldred — Thu, 6 Nov 2008 22:16:55 -0400

Apparently, there are Domino Administrators that sometimes have a need to "hide" Person Documents in the Domino Directory. For whatever reason (probably, these are people that have been terminated), they still need mail delivered but do not want others to be able use the addresses when sending mail internally. How can this be accomplished?

One option is to change the Person Document to put a "z" in front of the last name:

Once saved, the Person Document will go to the end of the Domino Directory. If a user tries to address mail to this Person, the search will not provide a hit. Also, mail addressed to "Test User3," in this case, will bounce. Further, most people won't scroll through the entire Domino Directory to find the missing user.

But, there is another way to accomplish this: Change the Document Properties for the Person Document.

Open the Person Document, right click on it, select Document Properties, and go to the Security tab. Deselect "All readers and above." Select your Administration group, LocalDomainServers, and the Home Mail Server. The Document Properties will now look like this:

You need to have the Administration group in there, so that you can have access to the Person Document. LocalDomainServers and the Server are selected so that the server can find the Person Document in order to route mail to the mailfile.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Counting Folders and Views in a Database

Gregg Eldred — Mon, 27 Oct 2008 20:31:23 -0400

A Notes user calls to say that when he clicks to expand his Folders in his Inbox, nothing appears. I try it, and get the same result. A look at the design of the mail file shows a "few" folders. I am not counting the number of Folders. A search of developerWorks:Lotus brings me to this code, courtesy of Paul Smerdon:


Dim ns As New NotesSession
Dim db As NotesDatabase
folder% = 0
view% = 0
Set db = ns.CurrentDatabase
Forall v In db.Views
If v.isfolder Then
folder% = folder% + 1
Else
view% = view% + 1
End If
End Forall
Msgbox "There are " & Cstr(folder%) & " folders and " & Cstr(view%)
 & " views in this database"

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

The result of the agent?

1579 folders might be a problem. Even though there is no error message when trying to expand the Folders view, I think that there might be a memory problem somewhere. I think that the next steps will be the most painful - removing/consolidating folders to a more manageable number.

While I battle the number of folders, I thought that you might like to see some code that counts the number of folders and views in a database. Put the code in the database in question, set it to run on "None," then run it.

Very cool.

Link: Paul Smerdon: Count the no. of views in a database

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Automatically Changing Sametime Status

Gregg Eldred — Thu, 16 Oct 2008 15:25:39 -0400

One of the questions I sometimes get asked after implementing Lotus Sametime is "Can Sametime automatically change my status after some time of inactivity?" This is a very useful feature, which would cut down on the number of times you ping someone, only to find out that they are out to lunch, in a meeting, or similarily indisposed. But can you do this in Sametime?

Thankfully, the answer is "Yes," and there is a TechNote that spells it all out for you.

This feature became available in Notes client release 7.0.1, which allows Notes instant messaging clients to change their awareness status based on keyboard/mouse activity or inactivity.

The Notes client displays an "Away" state based on keyboard/mouse inactivity, and automatically changes that status based on the status of the OS (the keyboard or mouse being inactive). Previously, the Active/Away status was changed based on the Notes client status.

This feature is turned off by default. To enable this feature, set the following notes.ini variables:

$STActiveToAwayEnabled=1 to enable "Active to Away" on idle
$STAwayToActiveEnabled=1 to enable "Away to Active" on return from idle
$STActiveToAwayTimeout=time to set idle time threshold (in minutes)

If you are using the Sametime Connect Client, and want the same functionality, you have to make a change to the Auto-Status preference in the autostatus.xml file:

Auto-status changes preferences

com.ibm.collaboration.realtime.alertmanager (release 7.5.x and higher)

As of 7.5.1 CF1, the Auto-Status preferences cannot be preset using the plugin_customization.ini. In order to customize and set these values, you can update the autostatus.xml file located in the users' profile directory at the following location:

([USERPROFILE]\IBM\RCP\Sametime\.metadata\.plugins\com.ibm.collaboration.realtime.alertmanager\autostatus.xml)

Link: 'Automatically change my status' in Notes instant messaging client

Link: Setting the Sametime Connect client's preferences

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Outbound SMTP Authentication

Gregg Eldred — Wed, 17 Sep 2008 19:54:38 -0400

A question was posted to the Notes listserv today:

We are trying to configure a Domino 8 server to change how it handles outbound mail. Currently, it routes to a smarthost that just accepts all messages from the Domino server's address. The administrator for the smarthost is reconfiguring and they want the Domino server to authenticate when it connects to the smarthost (which is how their clients are required to send outbound messages). I don't have a Domino 8 server to look at, but my Domino 7 system does not have any places that I can find to enter username/password for the SMTP authentication.

Thankfully, the Domino server is on Release 8. In R8, a new feature was added allowing the Domino server to send authenticated SMTP to a relay host. From Administrator Help:

You can use SMTP sender authentication to ensure that the sender of a message is a legitimate user of an SMTP server. SMTP sender authentication requires an account name and password for the destination SMTP server. The account name you use must be an account on the relay host SMTP server to which a specific IBM® Lotus® Domino™ server routes messages. The purpose of SMTP sender authentication is to authenticate the connection between a Domino router and an SMTP server. Use this feature with SMTP servers that do not allow Anonymous connections, or with SMTP servers that allow both authenticated and non-authenticated connections.

Setting this up is, as friend likes to say, "easy peasy." Open the Messaging Configuration Document for your SMTP server and make the change, as shown below:

Save and close the document. Restart the Router. There you have it: SMTP Authentication on outbound messages.

One little item that might be of interest:

To ensure the security of the SMTP account name and password, the Server Configuration Document should be encrypted. A server ID must be included in the server's encryption list to allow the server to decrypt the document. For instructions on encrypting the Server Connection document, see the topic "Encrypting documents using secret keys" in the IBM® Lotus® Notes® client help.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Your Domino Administrator is Leaving. Now What?

Gregg Eldred — Wed, 10 Sep 2008 00:00:00 -0400

There are few things that worry management more than when a Domino Administrator leaves the company.The Domino Administrator has access to all mail files, can access the Domino servers and use the console to execute commands, sometimes signs agents, and can create/delete users, groups, and servers.

To reduce your exposure, you should have a documented plan when your Domino Administrator leaves. Especially, if it is on bad terms. This is one of those items that you should do, sooner rather than later.

To assist you with this, there are some things that IBM recommends that you secure, shown below. I have added some comments, in parenthesis, but this list should be used as a guideline. Your environment will probably require more items.

Ensure that you have access to the Domino Certifier ID file and password. (This is the step that scares me the most. Without those two files . . .)
Lock out the Administrator's Notes ID.
Obtain the Administrator's workstations.
Secure physical access to the Domino servers.
Disable the Administrator's remote access to the network, and disable their accounts at the operating-system level.
Change any operating-system-level passwords on other accounts that this person may have known.
Add the Administrator to a Deny Access group in the Domino Directory.
If the Administrator knew the password to any administrator-level accounts, these accounts should be added to the Deny Access group as well. Depending on the ID, this may cause users not to have access to their mail.
Alternatively, you can enable password checking and force all users to change their passwords. This would allow current users to maintain access, but leave the Administrator with an old password that is no longer valid. (If you do not have password checking enabled, some people may complain about Notes performance when it is enabled. There is a bit of overhead involved as the client and server compare passwords)
Monitor and audit for any strange Domino or network activity. (This is very important, especially if the Admin left on less than happy terms)

NOTE: Securing the environment can be more challenging if the Administrator may have IDs and passwords known only to them. If this is the case, and you do not have a complete list of their IDs and passwords, it can be very difficult to eliminate their access from a pure Domino perspective. If this scenario is possible in your environment, then you may consider implementing a stringent network and operating-system-level lockout. This will also minimize the possibility of this person using other IDs to try to access your Domino environment.

You can't remove the Administrator's name from the Domino Directory until you have audited the agents on the server. If the Admin has signed any agents, and his/her name is not in the Domino Directory, the agents will, most likely, fail to run. But by having the Administrator's name in the Deny Access group, s/he will not have access to the environment. Provided there are no other backdoors.

Link: Securing a Domino environment when an administrator is leaving

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - How To Change Domino URL Icon

Gregg Eldred — Wed, 27 Aug 2008 22:44:48 -0400

You may have wondered how some websites get cute little icons in front of their URLs. For example, some look like this:

The default icon for a Domino website icon is what you see next to my name. Nice, but you probably will want to change it.

That little icon is determined by favicon.ico, located in the Domino\Data\domino\html directory. You can use any 16x16 BMP file, rename it to "favicon.ico" (or, better, use an icon editor) and copy it into the Domino\Data\domino\html directory. It will display by any database accessed on that Domino Web server.

If you have a few web accessible databases, but want to change the icon for one (or more) and leave the default icon in place for other databases, you can accomplish this by adding a "LINK REF" line to the HTML Head Content section using the Designer Client. The general syntax is:

When you add it to the HTML Head Content section, you will need to add it as a string, and escape the special characters:

""

Some other links that might help with creating your own favicon:

Favicon - How To Create a Favicon In Photoshop

Get your own animated favicon

Declan Lynch: SnTT: Domino and Favicons

Lotus Notes Ninjas: Favicon Web Shortcut icon revisited

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Applying PTFs Using FTP and Virtual Devices

Gregg Eldred — Wed, 20 Aug 2008 22:41:09 -0400

Disclaimer: This post will probably appeal to only a very small audience: Domino on iSeries Administrators.

You need to get a PTF from an IBM FTP site to your iSeries. Your first stop is Fix Central to order the PTF. After filling out the request, and telling IBM that you are going to use "Disconnected" mode, you will receive an e-mail detailing the PTF location on an FTP site. If you have requested a few PTFs or some large ones, the e-mail could take a while to get to you. Also, the more you order, the bigger the download and the longer you will wait for the FTP session to complete.

When you get to the FTP site, you will find that there is a .bin file waiting for you. How do you apply a .bin PTF to your iSeries?

Thankfully, IBM has a TechNote on the process, which is provided to you, below. But within the TechNote, I have added a few of my own notes, which may help.

The first note is to use IBM's naming conventions, as outlined below. It will save you time by not having to remember a different Virtual CD Device name, download location, or Image Catalog.

The second note is to do the FTP first, then create the download folder on the IFS. Neither of those points are in the TechNote.

So, FTP the file to your workstation from the location provided in the e-mail from IBM.

Then create a folder on the IFS and name it download.

When you FTP the .bin file to the IFS you will need to use this command before putting the file on the server:

quote site namefmt 1

then you can change directory to the download folder.

To get the CD image file loaded into a Virtual Media device, do the following:

Note: The following procedure is available only for R520.
1. Create a Virtual CD Device, and vary this on (this can be reused so will not need to be done every time). On the operating system command line, type the following:

CRTDEVOPT DEVD(OPTVRT01) RSRCNAME(*VRT) TEXT('Virtual Media CD Device')

Press the Enter key.
2. To vary on the device, on the operating system command line type the following:

WRKCFGSTS CFGTYPE(*DEV) CFGD(OPTVRT01)

Press the Enter key. Select Option 1 against the device.
3. To create a Image Catalog (do this the first time only), on the operating system command line type the following:

Note: Specify CRTDIR(*YES) only if the directory specified in the DIR parameter does not exist.

CRTIMGCLG IMGCLG(IPTF) DIR('/iptf') CRTDIR(*YES) TEXT('Image Catalog for iPTF FTP orders')

Press the Enter key.

[It is at this point, that you should have FTP'd the file to the iSeries as the next step assumes that the file exists on the server]

4. To add the downloaded image file to the Image Catalog, on the operating system command line type the following:

WRKIMGCLGE IMGCLG(IPTF)

Select Option 1 to Add ( ADDIMGCLGE ), and specify From image file to be path where you have downloaded the image file to:

/download/iptf0050.bin

where download is the directory in the Integrated File System where the image file called iptf0050.bin was downloaded.
5. This should then show as loaded (for example, in the Virtual Media CD Changer) or mounted (for example, in the Virtual Media Drive).
6. To associate the Image Catalog with the Virtual CD Device, on the operating system command line type the following:

LODIMGCLG IMGCLG(IPTF) DEV(OPTVRT01) OPTION(*LOAD)

Press the Enter key.
7. Once this has been done, use the WRKIMGCLGE command to show a status of Ready .
8. Load the PTFs using GO PTF , Option 8, specifying the Virtual CD Device (for example, OPTVRT01).

Link: Fix Central and FTP Download - Getting the CD Image File into a Virtual Media Device

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Server ID is Lost or Corrupted

Gregg Eldred — Tue, 12 Aug 2008 22:01:22 -0400

Curtis posted to the developerWorks:Lotus forum that his server.id was "blank." Which led to some discussion on what to do to recreate the ID when you don't have a backup of it.

Should this fate befall you, you will need to follow these steps. However, these steps only work if the server is an additional server and not the only server or your first server.

To create a new ID in this scenario, delete the Server document from the Domino Directory and re-register it. To do this, from another server in the domain (preferably, the Administration Server), follow these steps:

1. Create a temporary Domino Directory from the PUBNAMES.NTF named, for example, NAMESBKUP.NSF.

2. Copy and paste the Server document corresponding to the server with the lost ID into the NAMESBKUP.NSF (this is used so that you have a copy of the Server Document before proceeding with the next steps). You may want to print out the Server Document, so that you have a ready reference when it comes time to register the "new" server.

3. Delete the server document from the production Domino Directory and replicate the deletion to all servers.

4. Re-register the server exactly as it was originally, referring to NAMESBKUP.NSF copy of the Server document, when necessary.

5. Edit the NOTES.INI on the server and verify that entries for MailServer and ServerKeyFilename are correct. Double check that the other lines in the Notes.ini are appropriate. Save and close the Notes.ini.

6. Detach the newly created server ID from the Server document in the Domino Directory, store a copy in a safe location, place a copy on the server, and bring the server up.

And please, for the love of all things holy, STORE A COPY of the server ID in a safe place. You don't want to have to do this again, do you?

One little note is that you might have to reinstall the Domino Server software or restore some databases. Although, while I think that unlikely, just prepare yourself. Another note is that I usually have a "backup" Domino Directory in place on a server. The reason is that it is the place where I copy and paste Person, Server, Group, and Mail-in Database documents before deleting them from the production Domino Directory. I like doing this because it allows me easy recovery should someone make a mistake with a deletion.

Link: Blank server.id

Technorati tag: SnTT Show-n-Tell Thursday server.id

SnTT - Mail Does Not Route "Check in Progress" Message

Gregg Eldred — Mon, 11 Aug 2008 13:27:33 -0400

A little early for a Show-n-Tell Thursday post, but I suppose that I couldn't wait. :-)

We performed an upgrade from Domino Release 6.5.6 to 8.0.1 last week. Everything went very well. However, we noticed on Wednesday, that if a user sent a message from one of the servers, the message stayed in the queue with a message of "Check in Progress." The message can be routed, provided the Administrator remembers to release the messages. That isn't the best resolution to the issue. So, what is causing this and how do you resolve it?

The cause is almost always your anti-virus package. Simply stopping the anti-virus services will not alleviate the issue. You have to remark the anti-virus lines from the Notes.INI, remove any reference to it in the servertasks= line, and check your extmgr= line for anti-virus references. Now, you can restart your Domino server, anti-virus will not be in memory or have any hooks into Domino, and the messages will route properly. It is at this point where you should probably uninstall your anti-virus, remove all traces of it from the server, and reinstall it.

At least, in this case, that resolved the issue. One other item: "Check in Progress" is not a Lotus Domino message routing notification.

Link: developerWorks:Lotus - R6/R7 Forum Postings with "Check in Progress"

Link: developerWorks:Lotus - R4/R5 Forum Postings with "Check in Progress"

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Forcing an OOO Summary

Gregg Eldred — Thu, 7 Aug 2008 22:59:25 -0400

Prior to Release 8, the user received a summary report telling of the e-mail addresses that received an Out of Office (OOO) message. This message would appear in the user's mail box on the return date, as specified by the user.

Now that Release 8 has introduced the OOO service, that summary report is generated at 4AM. If you have users that want the summary report immediately, the Administrator has to compact mail.box. For those environments that have multiple mailbox', you will probably have to compact each mail.box.

To generate the OOO summary report:
Open the Administration Client.
Open the user' Person Document to determine the Home Mail server.
Open the Home Mail server and go to the Server Tab - Server Console.
In the Console window, type:
load compact mailx.box (where x signifies a number, 1, 2, 3, etc., if you have multiple mail.box')
The OOO summary will be immediately generated.

Technorati tag SnTT Show-n-Tell Thursday

SnTT - Notes.INI on a Mac

Gregg Eldred — Wed, 30 Jul 2008 22:35:59 -0400

Running Lotus Notes on a Mac? Have you discovered that there is no notes.ini?

Notes Clients on the Macintosh do not use a NOTES.INI file like they do on a Windows machine. Instead, they have a Notes Preferences file. If you are running OS X, the Preference file is located in the user's home directory > Library > Preferences.

In Notes 7.0.2 (and above), the Notes Preference file is in plain text. To edit it, simply double-click on it and it will appear in the TextEdit program.

However, if you are running Notes 6.x.x, you need a utility, the Notes Preference Editor, to edit the Notes Preferences file. You can find the link to the Notes Preference Editor here.

There is a link to the Notes Preferences Editor for Releases 4 and 5, but this is what you get:

I will assume that this is because neither version is no longer supported. Further, why are you still running those versions?

If you are having problems finding the Notes Preference file, simply do a Find for "Notes Preference" from the Desktop.

Link: Notes Preference Editor for Notes 6.x and Mac OS X

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - When Do You Need To Restart Your Domino Server?

Gregg Eldred — Wed, 23 Jul 2008 22:36:03 -0400

You have made a change (or several) to your Server and Messaging Documents. What changes require a restart of the server?

While this list is not all inclusive, it should address most of the major changes. Feel free to add to the list in the comments, or correct my mistakes. I will probably create another post with your updates.

Make a change to Messaging Configuration Document - no restart, but need to restart SMTP and/or Router
Make a change to the LDAP section of Server Document - restart required
Make a change to Global Domain Document - restart required (I don't think that this is correct)
Make a change to web server of Domino server - no restart, but need to restart HTTP task.
Starting or changing Directory Assistance - restart required
Make a change to the behavior of Domino Web Access (like having all users open to their InBox) - restart required
Make a change to the Internet Ports in the Server Document - no restart, but need to restart the specific task.
Setup Fault Recovery - restart required
Enable Password checking on Notes IDs - restart required
Moving an Internet Certificate from one server to another - restart required.
Changing SSL Key Encryption strength - no restart, but need to restart HTTP task
Changing fields on the Security tab of the Server Document - no restart, but need to wait for Domino to recache the document (about 20 minutes).
Create or change Domain Indexing - restart required
Disable/enable Directory Catalogs in Server Document - restart required
Make changes to Cluster Replicator - restart required
Edits to the Notes.INI on the server - restart required unless you use SET CONFIG. Then you need to restart the affected task
Change Transactional Logging settings - restart required
Enabling SSL on Domino server - no restart, but need to restart HTTP task.
Make changes to logging for Domino Web Server Log (domlog.nsf) - no restart, but need to restart HTTP.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Administrator ID Has Expired

Gregg Eldred — Thu, 17 Jul 2008 00:05:53 -0400

In a previous SnTT post, I outlined how to recertify a server ID that had expired.

In this post, your one and only Administrator ID has expired, severely impacting your ability to perform even the most basic administrative tasks. When attempting to connect to the server with the Administrator ID, you get an error like this:

"Server error - your certificate has expired"

Don't panic, this is easily remedied.

1. Open the Domino Administrator client. (The server should be set to "Local".)

2. Select the Configuration tab.

3. Select Tools -> Certification -> Certify.

4. Select the appropriate certifier ID and enter the password (I hope you remembered the certifier password).

Note: An error may appear: "The public key that is being used does not match the one that was certified." This occurs because the client cannot connect to the Notes certifier document in the address book on the server. To continue past this error, at the prompt, "Do you wish to continue without updating the Certifier ID?," select "Yes."

5. Select the Notes/Admin ID to certify. Note: You may see the error: "Entry not found in index, Do you want to certify anyway?" Click Yes.

6. Double check that the server is still set to "Local" (at the top of the dialog), set the expiration date*, and then click Certify.

7. At this point you should have access to the server, provided public key checking is not enabled on the server. If public key checking is enabled on the server, you have a few more steps to complete, shown in the next point, before you can access the server.

8. Copy the public key from the ID into the Person document (Certificates tab -> Notes certified public key field.)
File -> Security -> User Security (this opens the user ID)
Select Your Identity -> Your Certificates
Click the "Other actions" button and choose Mail, Copy Certificate (Public Key)...
Select Copy Certificate (this will place the public key on the system clipboard)
Close the open windows to exit User Security.
Select the People view in the server's Domino Directory, open the user's Person document in Edit mode, and click the Certificates tab
Select the entire contents of the Notes certified public key field and paste the key from the clipboard; Save and Close
Rebuild the view by pressing the key combination Shift + F9.

I might also note here, that prior to pasting the new public key over the old one, I usually paste the old one into Notepad or a mail message just in case something doesn't go according to plan. Further, while the steps are fairly straightforward and easy, as you step through the procedure, it is not the time to be answering the telephone, IM's, Twitter, or anything else that can be construed as "distracting." This requires your undivided attention.

* - the date should be within your company's policy for setting Administrative level expiration dates.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Enabling Domino SMTP TLS

Gregg Eldred — Wed, 9 Jul 2008 22:59:18 -0400

First, what is SMTP TLS?

[It is an] extension to the SMTP service that allows an SMTP server and client to use transport-layer security to provide private, authenticated communication over the Internet. This gives SMTP agents the ability to protect some or all of their communications from eavesdroppers and attackers . . . In many cases, [SMTP] communication goes through one or more router that is not controlled or trusted by either entity. Such an untrusted router might allow a third party to monitor or alter the communications between the server and client.

Further, there is often a desire for two SMTP agents to be able to authenticate each others' identities. For example, a secure SMTP server might only allow communications from other SMTP agents it knows, or it might act differently for messages received from an agent it knows than from one it doesn't know.

TLS [TLS], more commonly known as SSL, is a popular mechanism for enhancing TCP communications with privacy and authentication. TLS is in wide use with the HTTP protocol, and is also being used for adding security to many other common protocols that run over TCP.

~from RFC 2487.

I think that the RFC makes it clear, but if not: TLS provides secure electronic communications between two SMTP servers over the public internet. Another explanation comes from the Domino Administrator Help file:

SMTP sessions conducted over a standard TCP/IP channel are vulnerable to eavesdropping because the unencoded transmission can be easily intercepted. To protect SMTP communications, servers can use transport-layer security (TLS), more commonly known as SSL encryption, to provide privacy and authentication.

Configuring TLS on a Domino server can be challenging, but Lotus has a draft TechNote on the process.

I brought this subject up because the draft TechNote isn't as comprehensive as another reference document at your disposal. I am referring to another "Show-n-Tell Thursday"article that I have posted, "Setting up Domino SMTP TLS."

Of course, another option would be to enable it on your anti-virus/anti-spam appliance, if applicable.

If you think that ALL of your outbound SMTP traffic will be using TLS, you will be mistaken. Again, from the Domino Administrator Help file:

If the receiving server did not advertise support for STARTTLS in response to the Domino server's EHLO command, the sending Domino server continues with an unencrypted SMTP TCP/IP session.

For inbound SMTP traffic:

You can configure Domino to support the STARTTLS command for inbound SMTP transactions. When a Domino SMTP server is set to use negotiated SSL for inbound sessions, the server advertises support for STARTTLS in response to EHLO commands the TCP/IP port receives from connecting hosts. A connecting host can then issue the STARTTLS command to request an encrypted session.

If Domino is configured to require STARTTLS for SMTP sessions over TCP/IP and a connecting host cannot meet this demand, no mail is sent over the connection.

I would give some serious thought to requiring inbound SMTP to use STARTTLS for all connections. It has the potential to deny mail from some (most?) SMTP servers.

Link: How to Configure Domino for Secure SMTP Sessions Using STARTTLS (April 2005)

Link: DRAFT TechNote: Enabling TLS/SSL for SMTP

Technorati tag: SnTT Show-n-Tell Thursday

SnTT: Another Red X Issue

Gregg Eldred — Tue, 8 Jul 2008 23:01:38 -0400

An interesting twist the "Red X" issue: You forward an e-mail with an embedded .bmp image and the recipient gets the "Red X." Lotus has released a new TechNote that addresses this issue as it seems to occur in Releases 6, 6.5, 7, and 8.

The Red X, in case you were wondering what it looks like:

The solution is a workaround:

Don't use the Forward button when forwarding a message with an embedded .bmp image. Instead, open the message and within the message body, right-click and select Forward. This will accurately render the image in the forwarded message.

I am sure that users will be thrilled with having to modify their behavior for forwarding e-mails with embedded bmp files.

There is an SPR on this issue, SPR #AONL7BUHHX.

Link: Image replaced by red X when forwarding message

Link: SnTT: HTML E-mail with Red X

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Domino Server Naming Conventions

Gregg Eldred — Wed, 25 Jun 2008 23:38:51 -0400

Wow, two SnTT posts in one week!

A question was posed to me concerning the naming of a new, additional Domino server. This particular server would begin its name with a numeric instead of an alpha. All of the servers that I have named, have always began with an alpha; example: Server01/Acme. This server would be named something like 01Server/Acme. Is that naming convention supported by IBM?

Well, through my own search of TechNotes, I found the following guides on naming conventions:

Notes/Domino naming conventions and standards

Recommended naming conventions for server names or domain names

The latter link has this passage (emphasis, mine):

Consider that replication and mail routing tasks are usually performed based on numerical then alphabetical order. For example,when the router faces multiple choices for a routing path, Domino routes mail to the server 01Finance, then the server Accounting, then the server Research.

I would take that as solid confirmation that a numeric is acceptable, even though it is fairly plain after reading both TechNotes. But this also points out something that you may encounter: If there is an issue, Domino will route mail and replicate to the first server in its list of servers, starting with numerics. Further, Jean-Yves noted that the Catalog will also default to the first server in the list, if there is any question. I am sure that there will be other tasks that will use the same sorting.

Finally, Phigment recommended that I confirm that leading numerics would be acceptable to DNS (they are). That was an excellent observation.

Link: Notes/Domino naming conventions and standards
Link: Recommended naming conventions for server names or domain names
Link: developerWorks:Lotus R4/R5 Forum: RE: Doclink issues between R4 and R5

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Methods to Resolve Manager ACL Issues

Gregg Eldred — Wed, 25 Jun 2008 00:00:00 -0400

You have just inherited a Domino environment. The prior Admin was the Manager in all databases on the server and was explicitly named as the only Manager of a database (or all databases). Your Admin "friend" never thought to use Groups. Further, before he left, he didn't leave his password or his ID. You need to change the Manager in the ACLs of all of the databases to reflect your new Administration Group. What do you do?

First, if an Administration group isn't in your Domino Directory, create one. If you have the right to do so. Then add the appropriate people to it. You may also want to consider the creation of an ID for administration of the databases (at this point, I hope that you have access to the Cert.ID and the password).

Next, the use of one of these little applications may be of some use:

ACL Setter

ACL "Modificator" 1.0

AdminACL

Admin ACL 2

R5 Database Manager

PowerTools from HelpSoft

ServerAdmin Plus from Axceler

The latter two are not free, but they do have trial software. And they are excellent tools (I've used them both).

Add Your Name to the ACL

ACLHelp

DomainPatrol

If you are really in pain, you might want to see Hacking the ACL

If you are running Domino R6 and above, you might find some solace in the Full Access Administrator function. From Administrator Help:

Full access administrator is the highest level of administrative access to the server. The full access administrator feature replaces the need to run a Notes client locally on a server. It resolves access control problems -- for example, such as those caused when the only managers of a database ACL have left an organization.

Full access administrators have the following rights:

All the rights as listed for all administrator access levels (see above).
Manager access, with all access privileges enabled, to all databases on the server, regardless of the database ACL settings.
Note ACL roles must still be enabled manually for full access administrators.
Manager access, with all roles and access privileges enabled, to the Web Administrator database (WEBADMIN.NSF).
Access to all documents in all databases, regardless of Reader names fields.
The ability to create agents that run in unrestricted mode with full administration rights.
Access to any unencrypted data on the server.

Unfortunately, if you aren't listed as Full Access Admin, and if you do not have the right to edit and change Server Documents, this won't work for you. Go back to the applications, above, and hope that one of them will crack an ACL for you.

If nothing else, I hope that this shows that you need to plan for this eventuality. No matter how large or small your organization, you need to prepare for an Admin to leave. Think of it as part of your "Disaster Recovery" plan. Think of it as good business.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - HTML E-mail with Red X

Gregg Eldred — Thu, 12 Jun 2008 22:59:54 -0400

Many of you know that I continue to surf developerWorks:Lotus. I am struck by the number of people that are still wondering how to resolve the issue when HTML mail is received with red X's in the body, like this:

In most of my experiences, it is due to a missing or wrong proxy entry in the Location Document - Basics Tab:

Of course, this setting depends on your networking configuration.

If this is not the issue, IBM has a TechNote that addresses the other causes of this issue. From the TechNote:

You receive an e-mail such as a newsletter from the Internet into your Lotus Notes® client. The e-mail is an HTML document containing images which display as red "X"s. You may also notice the following message in the status bar:

"Document attachment is invalid." (in R5)

or

"Image or Object not found on server/" (in R6).

Answer
Reachability is the main issue concerning red X images in the Notes client.
Notes makes requests from the client to the Internet to the images that reside on a specific server. For example, a specific Yahoo newsletter may make the following references:

Regardless of the browser setting in the Location Document, the "perweb" is the process that retrieves the images (see below for more information).

NOTE: Having an invalid proxy server can also cause this issue:

Link: Troubleshooting Internet HTML e-mails with images appearing as red Xs

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Bad 'From' and 'Reply to' Addresses

Gregg Eldred — Thu, 29 May 2008 23:21:29 -0400

Interesting issue: Domino 8, Notes 8, POP client. Only happening to a couple of users.

User sends a message to an internet address and the From field looks like this: Joe_User/ou/org%org@internetdomain.org

Example: Gregg_Eldred/Acme%Acme@Acme.acme.com

Since the primary mail client is a POP client, I looked at the Person Document. It had a valid internet address. Looked at the Global Domain Document, but nothing had changed for several months. Restarted the Router. No impact, the messages are still going out wrong.

To make sure that I didn't miss anything, I used this TechNote to confirm the addressing. From the TechNote:

1. If an address is found in the Internet Address field of the Location document, then the mailer will populate the InetFrom field with this address. Router will also use this address to format the From or Reply address.

2. If the Location document's Internet Address field is empty, the Person document is then referenced, and the Reply address will be the Internet address of the Person document. If the Internet Address field is populated, that address will be used.

A. The "Internet address lookup" feature on the Conversions tab of the Global Domain document. The Global Domain document can be found in the Domain view of the Domino Directory; if one does not exist, one can be created.

OR

B. The "Lookup Internet address for all Notes addresses when Internet address is not defined in document" field can be found on the SMTP Server Configuration document. To find the correct field, follow this tab path: (MIME\Conversions Options\Outbound).

If neither A nor B are enabled, and there is no address specified in the Location document, then the default settings of the Global Domain document will be used, and the address format will be as follows:

"Joe_User/ou/org%org@internetdomain.org" without the quotes.

3. If (1) there is no entry in the Internet Address field of the user's Location document, and (2) the user's Internet Address field in the Person document is empty and (3) there is no Internet address specified in the user's Shortname field of the Person document, then the user's Internet address will be built from the Server Configuration document and the Global Domain document.

All of those items were confirmed to be proper.

When I asked the Administrator what was unique about these people, I was told that there was some issue with them, and he deleted the Person Documents and registered "new" users. Hmmm. I opened one mail file and went to the Owner field. While it looked good, I changed it by pulling the same name out of the Domino Directory.

Sent a test message.

The "From" and "Reply to" addresses were properly formed.

While the Owner field looked okay, it was referencing a user that didn't exist. By pulling the name from the Domino Directory, the mail fields were populated correctly.

Link: How is a 'From' or 'Reply to' Internet address formed in Lotus Notes and Domino?

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Determining the Sametime Client Type

Gregg Eldred — Thu, 15 May 2008 00:00:00 -0400

A month ago, I shared with you how to determine the version of your Sametime server. How about a little tip on how to determine the clients that are attaching to your Sametime server? Further, with a small change to your sametime.ini on the Sametime server, you can limit the types of clients that are allowed to attach to instant messaging.

Evil? Perhaps. :-)

There are six (6) general methods of connecting to a Sametime server:

Toolkits
Sametime Connect Clients
Sametime Meetings
STLinks
Notes
Third-party

Whenever one of these methods is used, they each tell the Sametime server what client they are. For example, if you are using Sametime Connect Client 7.5, the client identification is 0x1304. If you are using Notes Client 8.0.1, the client identification is 0x1233. The entire list can be found in this TechNote.

That same TechNote also details what the Administrator needs to change in the sametime.ini on the Sametime server to limit the connectivity. You will need to add to the [Config] section of the sametime.ini, the entry:

VPS_ALLOWED_LOGIN_TYPES

To limit the clients to only the Notes Client 8.0.1 and Sametime Connect 7.5, the entry wold be:

[Config]
VPS_ALLOWED_LOGIN_TYPES=1233,1304

The caveat:

According to the TechNote, only the following Sametime servers accept this configuration:

Sametime 3.0 IF3
Sametime 3.1 with a hotfix.
Sametime 6.5.1
Sametime 7.x

Link: How to determine the Client Type that is connecting to a Sametime server

Technorati tag: SnTT Show-n-Tell Thursday Sametime

SnTT - How To Determine When You Need Another Mail.Box

Gregg Eldred — Thu, 8 May 2008 18:44:27 -0400

You have two mail.box files on your Domino server and you are wondering if you need another one. Is there a way to tell if your Domino server is need of a third mail.box?

You need to look at two Mail Statistics, Mail.Mailbox.Accesses and Mail.Mailbox.AccessConflicts. What are the meanings of these two stats?

From the Redpaper, Domino 7 Performance Tuning: Best Practices to Get the Most Out of Your Domino Infrastructure:

Mail.Mailbox.Accesses is the total number of times that threads accessed any mailbox on the server.

Mail.Mailbox.AccessConflicts is the he number of times that a thread attempting to access a mailbox had to wait because the number of concurrent threads exceeded the number of mailboxes configured. For example, if there are three mailboxes configured, and there are four concurrent accesses, the conflict count would be incremented. If the number of access conflicts consistently exceeds two percent of the value of Mail.Mailbox.Accesses, consider creating an additional mailbox.

To get these stats, go to the Server Console and type:

Sh stat mail

Then, with the numbers in hand, make this calculation:

(Mail.Mailbox.AccessConflicts / Mail.Mailbox.Accesses) x 100 = X.

If the value of X is greater than two, consistently, you need another mail.box.

But remember, you have to have two or more mail.box' on your Domino server in order to capture these statistics.

Link: Determining the number of mailboxes required for a server

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Lotus Notes Internet Passwords

Gregg Eldred — Thu, 1 May 2008 14:01:30 -0400

A few questions from client sites and some posts on developerWorks:Lotus has prompted me to share this information on Lotus Notes Internet Passwords.

Q: What characters are allowed in a Lotus Notes Internet Password?

A: Any keyboard character can be included in a Notes Password. This includes both standard ASCII characters as well as extended ASCII characters (for example, accented letters).

Q: How many characters can I have in a Lotus Notes Internet Password?

A: The maximum number of characters you can include in a Notes password is 64.

More details on this can be found at the link.

Link: What Are The Length and Character Restrictions For a Lotus Notes Password

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Policy Training and Tips

Gregg Eldred — Wed, 30 Apr 2008 00:00:00 -0400

Having a little difficulty with Policies? Maybe you want a little more information on them? I know that they are very powerful tools, but can also be somewhat daunting.

First, if you are not familiar with them, what are Policies?

Using a policy, you control how users work with IBM® Lotus® Notes®. A policy is a document that identifies a collection of individual policy settings documents. Each of these policy settings documents defines a set of defaults that apply to the users and groups to which the policy is assigned. Once a policy is in place, you can easily change a setting, and it will automatically apply to those users to whom the policy is assigned
--from Lotus Domino Administrator Help

Still confused? IBM has a good TechNote that will assist with troubleshooting them as well providing you with an excellent reference for determining what you can do with them.

Self Training - Troubleshooting Domino policies and settings documents

From the abstract:

This document is part of a collection of documents designed to help administrators better understand how to create, configure and troubleshoot Lotus® Domino® policies. The topic of this document, which includes an accompanying video, is troubleshooting policy settings documents.

Is there a setting you want to apply, but isn't available in the current Desktop Policies? Try this:

Using a Desktop Policy to set notes.ini and Location Preferences

Upgrading to Release 8? This should be of interest to you, if you set the Internet Browser using a Desktop Policy:

"Internet browser" property in Desktop policy does not apply to Notes 8 Standard client

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Determining the Version of Your Sametime Server

Gregg Eldred — Fri, 18 Apr 2008 16:30:01 -0400

Want to know the build number/version of your Sametime server?

Point your web browser to http:///sametime/buildinfo.txt

You will get a screen similar to this:

The entire list for the Version field can found on at the link.

Link: How to determine the Version of a Sametime server

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Comparisons Courtesy Prevent Copy

Gregg Eldred — Wed, 19 Mar 2008 22:55:47 -0400

This SnTT post begins with a user telling me that he noticed that when someone sent him an e-mail, he was able to copy and forward to others even though it was marked "prevent copying/forwarding." A couple of questions, and I found out that he was using iNotes/DWA. I told him, without a shred of documentation, that iNotes/DWA was acting as designed because he was using a web browser to access his mail.

Thank goodness for some good search skills (at the link).

The key part of the TechNote, IMHO:

Since DWA is a web application, this type of functionality would need to be controlled by the browser. Since the browser does not allow applications to prevent copying any content from the browser to the clipboard, DWA does not have such capability.

But that conversation got me to thinking about what other differences are there between the Notes client and iNotes/DWA. A few more searches and I came up with two spreadsheets, courtesy of IBM Lotus.

These spreadsheets will be good for end user training, pre-sales support, and as handy guides.

Domino Web Access/Notes R6.5.x ( )
Domino Web Access/Notes R7.x ( )

There are probably other differences between the two, ones that aren't readily apparent until you work with each for a while. The way each interprets HTML mail, for example. But the spreadsheets and links should give you a good starting point.

Link: 'Prevent Copying' option does not work when sending mail to Domino Web Access users

Link: Mail Feature Comparison for Notes 6.x, Domino Web Access 6.x (iNotes) and Domino WebMail 6.x

Link: Mail Feature Comparison for Lotus Notes 7, Domino Web Access 7 and the Common PIM Portlets of WebSphere Portal 5.1

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Bad Return Addresses When Using POP/IMAP or DWA

Gregg Eldred — Thu, 6 Mar 2008 21:50:13 -0400

This may not be my best SnTT post, but I feel that I need somewhere to keep track of it and this will have to do.

You have POP and/or IMAP enabled on your Domino server. You also have DWA users. When those people send mail, and the recipient replies, the return address looks similar to this:

Gregg_Eldred%OU1/ORG@domain.com

You confirm that your Global Domain Document is set properly.

What you haven't checked is your Messaging Configuration Document - MIME settings:

Change the "Lookup Internet address for all Notes addresses . . . " field to Enabled then Save and Close the Configuration Document. Once that has been saved, restart the Router and test. I think that you will find that your reply to addresses will be formed properly.

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Mail and Domino Release 7.0.3 Upgrade

Gregg Eldred — Tue, 4 Mar 2008 21:51:14 -0400

Upgrading to Domino Release 7.0.3 may not be as seamless as one might expect.

After upgrading the server, some users (a very small percentage) may notify you that new mail does not appear in the Inbox, it appears in All Documents. Not all users will experience this issue. Hopefully, a FIXUP on the mail file will correct this issue. If it doesn't, you need to do a few things.

Confirm that the time/date on the workstation is correct.
Open the mail file.
Create a new folder.
Cut and paste all mail in the Inbox to the new folder.
Delete the Inbox, using Designer.
Do a Design Refresh/Replace.
Send a test message to the user.
Open the mail file, confirm that new mail is appearing in the Inbox.
Cut and paste the mail from the new folder to the Inbox.

If the user has a local replica, delete it and create a new replica (very important).

This is a unique issue to Release 7.0.3. Apparently, IBM changed the mail template to detect bad time/dates in folders and it prevents new mail from being delivered to the Inbox. How could you have a bad time/date? Maybe at one time the user adjusted their workstation to test for DST or was simply playing around with the time/date in Control Panel.

In any event, the upgrade to R7.0.3 locks this down and you find that new mail isn't going to the Inbox.

While researching this issue, I found a TechNote that explains this phenomena in better detail, including an SPR. This may be fixed in Release 7.0.4 and is fixed in Release 8.

From the TechNote:

One known cause is if the operating system time on a client or server is set greater than (>) 2 days into the future or greater than (>) 23 days into the past and then a folder operation occurs or a folder is modified. If the modified time of the folder or the modified time of the current folder operation is outside of this time frame, an error will be returned.

There is a debug parameter that can provide you with a proactive look at all of the mail files on your server to determine which mail files need to be fixed. As soon as I remember it, I will post it. The caveat is that it will scan ALL of your mail files and ALL of the folders in those mail files. If enabled, be prepared for a bit of logging to wade through.

[UPDATE]: If you want to discover which mail files will have this issue, prior to upgrading your Domino server, use this debug parameter:

Debug_Folder=3

Be prepared for a marked increase in your Notes Log.

Link: IBM TechNote: All new mail messages do not show up in the Inbox for some mail files on Domino 7.0.3 servers

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Troubleshooting an SMTP Issue

Gregg Eldred — Thu, 21 Feb 2008 21:35:56 -0400

I have to admit that I like mail routing issues. They make the day more interesting. They require a steady hand. And it is very satisfying when mail again routes. But there isn't an end to this story, as the Network/Telecommunications people have to do some work. This will, however, show you some additional troubleshooting ideas.

The backstory: Not all mail is routing to the internet. Certain domains, among them hotmail.com and yahoo.com addresses aren't being sent. There are also two other domains, not as large as those two, but people regularly send mail to them.

The first step. For those of you that don't want to click the link, I forced the Domino server to look at specific DNS using the Notes.INI setting, dnsserver= parameter. In this case, that did not help.

Next, check the server's name in Windows and compare that to the Domino Fully Qualified Internet Host Name. If they match, great. If not, change the Domino entry to match the Windows name. No need to restart the Domino server, but you do have to restart the Router.

Run a trace route of one of the offending domains. Make sure that there are no errors/timeouts between your server and the destination server.

Look at the Notes Log. Turn up logging to Verbose to get more detail. Send some messages and then check the log or the console. You might be able to glean some information from there.

Since nothing really revealed itself in the log/console, I added another parameter to the Notes.INI, SMTPClientDebug=1. Get ready for some amazing results in the Notes Log. Here is an example of what you may see (emphasis, mine):

02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: CommandEHLO: EHLO xxxxxxxxx.xxx.xxx
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-mail.xxxx.xxxx.xxx.xx Hello [xx.xxx.xxx.xxx]
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-TURN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-SIZE
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-ETRN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-PIPELINING
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-DSN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-ENHANCEDSTATUSCODES
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-8bitmime
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-BINARYMIME
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-CHUNKING
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-VRFY
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-X-EXPS GSSAPI NTLM LOGIN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-X-EXPS=LOGIN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-AUTH GSSAPI NTLM LOGIN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-AUTH=LOGIN
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-X-LINK2STATE
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250-XEXCH50
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250 OK
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: Attempting to SubmitMessage:
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: Pipelined commands:
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: MAIL FROM: SIZE=35732
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: RCPT TO:
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: DATA
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: End of pipelined commands
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250 2.1.0 xxxxxxxxxx@xxxxxxxxx.com....Sender OK
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 250 2.1.5 nomail@yahoo.com
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: ReceiveResponse: 354 Start mail input; end with .
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: Data Send Succeeded 39470 bytes
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: Connection broken after an error sending DATA command
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: Attempting to Disconnect:
02/19/2008 10:19:57 AM [0398:0005-0DC4] SMTPClient: Connection already disconnected
02/19/2008 10:19:57 AM Router: No messages transferred to YAHOO.COM (host a.mx.mail.yahoo.com) via SMTP

Now, we are closer to the answer: "Connection broken after an error sending DATA command." This could be indicative of the release of Domino as it was fixed in Release 6.5.3. However, an IBM TechNote also mentions issues with anti virus on the Domino server:

When SMTP mail is sent from a Domino server with an attachment, some AntiVirus software vendors truncate the MIME structure when removing an attachment it believes has a virus. This causes the "Connection Broken" message when it attempts to send, and the problematic emails then stall outbound SMTP routing.

Or it could be a Cisco issue.

A better description of what is occurring:

The issue may occur because certain mail messages and/or network-related problems are causing the remote server or firewall/network to drop the connection after the DATA command has been sent.
Where does all of this leave the Messaging Administrator? Asking for more information or help from the Networking/Telecomm people. At this point, it doesn't appear to be strictly a messaging issue. But you have learned another troubleshooting tip: SMTPClientDebug=1 (remember to remove the line after you have completed your research).

A little note on SMTPClientDebug:

This parameter can be enabled to capture the outgoing SMTP protocol conversations. This is for all messages transferred by the router to other servers (Domino or otherwise) via the SMTP protocol. Note that this does not include the message content - just the higher-level protocol commands and responses.
1 - Enable capture of outbound SMTP message transfer protocol.

Link: SMTP Mail Requeued After the Error "Connection Broken After an Error Sending DATA Command"
Link: Domino 6.x: 'Connection Broken After an Error Sending DATA Command'
Link: Domino Router notes.ini debug parameters for SMTP

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - IMAP Idle and Wireless Synch

Gregg Eldred — Thu, 17 Jan 2008 22:31:02 -0400

Pardon me for a personal SnTT post.

While researching and testing my current "push" mail solution, ChatterEmail, I kept finding references to the IMAP Idle command. I searched through my Server and Messaging Configuration Documents looking for a setting to turn on IMAP idle.

Nothing.

A search turned up this blog entry:

Not so sure about Chatter ... from 2004. (Thanks for that, Rob!)

A late comment to that blog post, dated April 2006, told me that the Domino 7.0 Server didn't have IMAP idle. A quick run through the IBM TechNotes proved that to be true. Even the fix lists for the subsequent Domino Release 7 Fix Packs have no information on IMAP idle. Since this is a published RFC (RFC 2177 dated 1997):

The Internet Message Access Protocol [IMAP4] requires a client to poll the server for changes to the selected mailbox (new mail, deletions). It's often more desirable to have the server transmit updates to the client in real time. This allows a user to see new mail immediately. It also helps some real-time applications based on IMAP, which might otherwise need to poll extremely often (such as every few seconds). (While the spec actually does allow a server to push EXISTS responses asynchronously, a client can't expect this behaviour and must poll.)

I hope that some future release of Domino will include it.

So, while I do have IMAP access to my Notes mail on my Treo, it isn't a perfect synchronization, nor is it active like on a Blackberry. But it works and it is serviceable. Other, less patient people than I would probably have found another solution to fill their needs. If you are looking for access to your Notes mail, using IMAP, you will need to know about the idle command. Especially if you are deploying a wireless synch product.

Which brings me to two final thoughts:

First, when will the Domino server get some love? A "feature," like IMAP idle, is core to many other IMAP servers but the one that I care about. There are other things missing in the Domino server, too. Some of the things could be considered "core," others would bring the Domino server in line with Year 2008 expectations (and beyond). I understand that the Notes client needed some work, and we were rewarded for waiting. But when will the Domino server get a much needed "update?"

Second, IdeaJam was given another idea.

Technorati tag: SnTT Show-n-Tell Thursday IdeaJam IMAP

SnTT - Restricted Resources

Gregg Eldred — Thu, 10 Jan 2008 22:35:51 -0400

Background: You've upgraded your Domino servers to Release 7.x.x. Everything is fine, until Monday morning, when some user at a remote site calls to tell you they can't reserve rooms. Oh, they show up in the dialog box, but they all have this icon next to the rooms:

Where did that come from? What does it mean?

New in Release 7, is the ability to restrict resources, and this icon is a offshoot, to tell the users "You aren't allowed to reserve this resource."

What to do?

Actually, it's pretty easy. If you are patient.

Open the Resources database that refers to the resources that are restricted. Change the Owner Restrictions from "Autoprocessing" to one of the other options. Click on the Save and Close button. Allow AdminP to process the new request. Allow normal replication to take place (if required). You now have the right to reserve this room.

Link: New icon for restricted resource in Domino 7.x

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - No Blackberry Enterprise Activation Icon

Gregg Eldred — Fri, 28 Dec 2007 10:25:38 -0400

You have a nice, shiny Blackberry smartphone, but the Enterprise Activation icon doesn't appear on the Home screen and there is no Enterprise Activation option in the Options menu. What do you do?

Thankfully, Blackberry has a TechNote on this, which certainly helped me (Cause 5).

From the TechNote:

Cause
This issue might be caused by one of the following:
1. The BlackBerry smartphone does not have the BlackBerry Enterprise Server service class.
2. The BlackBerry smartphone is running BlackBerry® Device Software 3.8 or earlier.
3. The Enterprise Activation icon is hidden.
4. The BlackBerry smartphone is not registered on the wireless network.
5. A previous attempt was made to activate the BlackBerry smartphone over the wireless network.

Cause 1
The BlackBerry smartphone does not have the BlackBerry Enterprise Server service class.
Resolution
Contact your wireless service provider for further assistance.

Cause 2
The BlackBerry smartphone is running BlackBerry® Device Software 3.8 or earlier.
Resolution
Upgrade to BlackBerry Device Software 4.0 or later. For instructions, see KB03621.

Cause 3
The Enterprise Activation icon is hidden.
Resolution
Verify the icon is not hidden in the Home screen by pressing the ALT key and the trackwheel.

Cause 4
The BlackBerry smartphone is not registered on the wireless network.
Resolution
Perform a Register Now function. For instructions, see KB00510.

Cause 5
A previous attempt was made to activate the BlackBerry smartphone over the wireless network. The disappearance of the Enterprise Activation icon from the Home screen following activation of the BlackBerry smartphone over the wireless network is by default.
Resolution
Follow the steps below to locate the Enterprise Activation option on a BlackBerry smartphone with valid provisioning.
1. From the BlackBerry smartphone Home screen, Options.
2. Click Advanced Options.
3. Click Enterprise Activation.

Link: No Enterprise Activation icon is present on the BlackBerry Smartphone

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Customized Letterhead

Gregg Eldred — Mon, 17 Dec 2007 21:56:08 -0400

Sorry that this isn't Thursday, but I have been thinking about posting this little tip and Thursday would be too late. Of course, a smart person would have posted this even earlier in December. Plus, I have been getting a few hits from people looking for some sort of Christmas Letterhead.

I tried this tip out, and it seems to work okay, but with a few caveats. First, if you expect someone in your organization to see your new, custom letterhead, they have to have the same image resources and field entries. Second, if you want an internet recipient to see your custom letterhead, you don't know that it is stripped out on internet mail. Finally, your results may vary.

There are, AFAIK, two documents that will help you with creating custom letterheads, and they are referenced at the end of the entry. After following the instructions, this is my result. A simple image, no background.

I'm sure that you can do better. :-)

What else can you do with custom letterheads? Company logo's, for one.

Remember, everyone has to have access to the same design elements if you expect the internal recipients to see your letterhead. That means a change to the mail template. Be sure to document any changes, as upgrades will not include the letterhead.

Link: How to implement a custom letterhead in Notes (nice, detailed instructions)

Link: Creating a custom letterhead

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Domino Console Command

Gregg Eldred — Tue, 20 Nov 2007 22:29:29 -0400

Disclaimer: This post is a result of some search referrers and since we are heading into another holiday season, it might prove to be useful. I could also put this under the heading of "Things I Take for Granted." One thing I will take for granted is the Domino console - how to display it, how to enter commands, what command(s) to use to troubleshoot. If someone is unsure, just drop me an e-mail or leave a comment.

The Domino console is my friend. Sure, I can't do everything with it, but when it comes to troubleshooting, it is the first place I go.

Are you having problems with the Out of Office (OOO) agent? Need to know who has the OOO running? This is easily remedied by a simple console command:

tell agmr sched

(Blog interruption one: Right away, you can see that I use the least amount of typing to initiate a command. In the above example, I have used the word "shed" as shorthand for the whole word "schedule." Either works, but I prefer not to have to type more than needed.)

Entering this command, on the console, brings back all of the agents that are enabled to run on the server. If you have a user that says that their OOO agent isn't working, this is the first command I enter to see if it has been enabled. Here is an example of the results of entering the command:

Basically, the server sees the four mail files as having the OOO agent running. The next time they are scheduled to run are shown at the left (11:50, 12:01) as well as which mail file has the agent enabled.

Now you know how to identify that the OOO agent is running in a person's mail file.

(Blog interruption two: I am limiting the discussion only to the OOO agent. The results of the tell amgr sched command shows you more. You may have to look in the Notes Log for all of the results, especially if you have a lot of mail files on the server).

Since you have determined that the user has their OOO agent enabled, now you can look for other reasons why it isn't working. For example, open the mail file in Designer. Look at the Shared Code - Agents, and make sure that it is enabled. If that shows that the agent in enabled, but it still isn't working, check out this link, as it has a couple of other troubleshooting tips as well as links to TechNotes and articles on the OOO agent:

SnTT - Out of Office Agent Doesn't Work

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Moving BES to Another Server

Gregg Eldred — Thu, 15 Nov 2007 22:15:45 -0400

Things change.

For example, your initial installation of the Blackberry Enterprise Server (BES) has outgrown the server and needs room to grow. You installed BES on a server that shared several other applications. Whatever. In any case, you need to move your existing BES to another server.

This is strictly a Domino-based installation of BES. Exchange installations will differ.

Also, this is here because I never seem to find the information when I need it. If you have ever visited the RIM support pages, you know of what I speak.

First, do your normal Domino Admin stuff: Create a new server ID, modify the Server Document, setup replication and mail routing, install and configure the Domino server (to make this easier, keep the same directory structure), test replication and routing. Everything good? Change the Domino Server task to Manual. Okay, take the new Domino server down. Take the old server down.

Copy the Blackberry Profiles database to the new server, to the same directory as the old one.
Copy all State databases.
Copy the notes.ini (but give it a new name on the new server, so you have something to compare/contrast)

Install the BES code on the new machine.
Configure BES, keeping the same settings as you had on the old one.
If you've upgraded to the latest release of BES, be sure to apply the proper Fix Packs, to get you up to the proper release.
Once done, stop all of the BES tasks on the old server and the new one.

You should be ready to use the Blackberry TechNote KB04261. I have skipped around that document, but you are now prepared to pick up the TechNote and finish the cutover. The document is very thorough.

Remember not to bring up the old server until you have removed all traces of the Blackberry code. If you don't you'll end up with either two servers using the same SRP (which results in your servers being locked out of sending messages to the handhelds, or you end up with the new server referring all of its configuration settings to the old server). Both of those end badly, with a call to RIM.

Link: Perform a cutover to another Blackberry Enterprise Server in an IBM Lotus Domino environment

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Domino Security Bulletins

Gregg Eldred — Wed, 31 Oct 2007 09:01:29 -0400

You learn something new everyday.

In the past, if there was an issue with Domino, I would go directly to the Support site, try a few searches, and find the appropriate TechNote. Or, some nice blogger would post something about a security issue in Domino. Or, if I was really lucky, it would appear on developerWorks Lotus (Notes.Net for us old-timers).

Today, I found all of the Security Bulletins in one place: developerWorks Lotus: Security. October has nine bulletins, including an IMAP Buffer Overflow issue, a DoS due to bad SMTP mail, and an ECL vulnerability. The content comes from the Support site, but is nicely aggregated on this page.

The site is definitely worth your attention (and mine).

Link: developerWorks Lotus: Security

Technorati tag: SnTT Show-n-Tell Thursday

SnTT - Lotus Domino 8 Resources

Gregg Eldred — Wed, 17 Oct 2007 23:11:53 -0400

Looking for information on your Lotus Domino 8 upgrade? What about the new R8 Out of Office functionality? Education and certifications for R8? Those topics and more, much more, is aggregated on the IBM Lotus Notes and Domino 8 Resource Page.

Warning: There is so much on that page that it may be a little overwhelming. But it certainly is comprehensive.

Technorati tag: Lotus Notes Lotus Domino Release 8

A Fix for Domino SMTP Crash - SnTT

Gregg Eldred — Thu, 11 Oct 2007 23:39:31 -0400

A new TechNote has been published by IBM concerning a Lotus Notes/Domino crash when a specific internet message is received. From the abstract:

A fix has been developed for a Lotus Domino SMTP server and/or Lotus Notes client crash which results when an e-mail containing specific content is received. A temporary workaround may also avoid the crashes.

At the time of the crash, you will see the panic error, PANIC: Invalid pool free chain.

You can either upgrade your servers to Release 6.5.6 or 8, use the link for your 7.0.2 Domino servers, wait for the 7.0.3 maintenance release, or simply block some specific addresses from sending to your server. Those domains are:

beaudette.info
www.balkrishmiki.com
skincare@consectary.net
skincare@delettanteism.com
awards@direption.com
awards@direption.net

It may be prudent, in addition to the other workarounds and upgrades, to simply add those addresses to your Messaging Configuration Document. Specifically:

Router/SMTP - Restrictions and Controls - SMTP Inbound Controls - Deny messages from the following internet addresses/domains field

Link: Fix developed for Domino SMTP server and/or Notes client crashes due to e-mail containing specific content

Link: Fix for Domino 7.0.2.x SMTP server or Notes client crashes due to e-mail content

Technorati tag: SnTT Show-n-Tell Thursday

Exchange Server 2003 Connector for Lotus Notes

Gregg Eldred — Thu, 27 Sep 2007 21:19:22 -0400

SearchDomino.com is reporting that there is an update to the Exchange Server 2003 Connector for Lotus Notes. According to the article, the update ". . . addresses problems that crop up when Lotus Domino Server is used as an incoming SMTP gateway . . . "

The link contains all of the pertinent information, including the Microsoft KnowledgeBase article, a reference to the hotfix that corrects this, and the edits required to the exchconn.ini.

If your inbound internet mail addresses are getting mangled, and you use the Connector, this may be the issue.

Link: SearchDomino.com: Update to Exchange Server 2003 Connector for Lotus Notes

Technorati tag: Show-n-Tell Thursday SnTT

SnTT - Figuring Out the NSD File

Gregg Eldred — Tue, 25 Sep 2007 20:14:37 -0400

A couple of nice administration tool kits have hit the internet.

First, Jean-Yves Riverin has updated his FAQ, "How to Analyze Notes/Domino NSD's." Included in the FAQ, for those that will read through the link, is a little gem; The PDF of the Lotusphere 2007 session, "Using NSD - A Practical Guide." Jean-Yves has done some really nice work here, and it is an excellent start to troubleshooting your Notes/Domino NSDs.

Secondly, Lotus has posted a tool to the Sandbox, the Lotus Notes Diagnostics Tool. From the description of the tool:

This tool is based on the internal tool that Lotus Support uses to analyze NSD and other files resulting from a Lotus Domino server crash, hang, or performance issues.

Did you catch that? "This tool is based on the internal tool that Lotus Support uses . . . " How cool is that? Please read the documentation for the tool, especially where you are to run this from your client, not the server. If you want to know some of the features in this application, here is a small list:

Lnd supports:
Windows Rip files (R4 to ND6)
OS/2 Rip files (R4 to ND6)
Windows NSD (R5 & ND6/7)
UNIX NSD (R5 & ND6/7, Solaris, AIX, HP-UX, Linux, OS/390)
iSeries (OS/400) NSD (R5 & ND6/7)
MAC Crash report
Semaphore debugging files (R5 & ND6/7)
EBDCIC files by conversion to standard ASCII
Unicode files by conversion to standard ASCII
Notes/Domino Fault report database
Trapleak and debug pools output annotation
Lotus Notes Exception Report file (ND6/7)
DXL server or configuration documents (ND6/7)
Lnd does not support:
Files coming from beta or release candidate versions of Domino

Now, you have some nice additions to your Notes/Domino NSD troubleshooting toolkit.

Technorati tag: Show-n-Tell Thursday SnTT

Domino 8 and SSL and Reverse Proxies and Solaris - OH MY!

Gregg Eldred — Thu, 13 Sep 2007 22:56:04 -0400

While trolling through the forums today as well as the Support site, I came across a very recent TechNote on testing the implementation of Domino 8, running on Solaris 10, using SSL and Reverse Proxies. The reason it piqued my interest is that there seems to be quite a few people looking for information on implementing SSL in Domino. This document does a fantastic job of detailing the steps to implement SSL, using your Domino server as a Certificate Authority. Then it walks through the steps to enable SSL.

From the abstract:

The purpose of this document is to describe how the System Verification Test team deployed Domino 8.0 and other IBM companion products behind an Edge Reverse Proxy Server.

Most products were installed on Solaris 10 except for the Additional Domino Server, Proxy Server and Activities server.

Secure Socket Layer "SSL" was implemented throughout the configuration to test the added security and how the applications integrated with each other using SSL.

We used Sun One 5.2 LDAP for authentication along with Single Sign On.

Before you start wading through all of the Help Documentation in R8 (and even earlier releases), it may help for you to read this document. And they include pretty pictures, too. :-)

Link: Test Infrastructure: Solaris, SSL, Reverse proxy Domino 8 configuration

Some other links of interest:

Link: Quick guide to setting up SSL using Domino as the Certificate Authority (all Domino server platforms. Releases 5.x ,6.x, 6.5.x, and 7.x)

Link: Setting up Secure Socket Layer (SSL) on a Domino server (AIX, Linux, Solaris, Windows. Releases 5.x ,6.x, 6.5.x, 7.x, and 8)

Technorati tag: Show-n-Tell Thursday SnTT

The Tie Breaker

Gregg Eldred — Wed, 25 Jul 2007 00:00:00 -0400

This is a rather interesting issue. One that I didn't think would warrant a post, but post it I shall.

Let's say that you are using iNotes/Domino Web Access. You have two people in your Directory, Sam User and Sally Suser. When Sam tries to authenticate to the his mail file, he gets an error that says that Sally Suser does not have the right to access the mail file. Huh?

Looking at the Person Documents, everything is proper and correct. Both have Short Names, both have proper heirarchical names, both have unique internet addresses. And yet, Sam cannot authenticate using his short name (you can tell that most users are trained to log in using their short names).

Looking at this from another side: When Domino is faced with authenticating a user, it runs down a few items, especially in a case like this. We have two distinct users. BUT Sam has a short name that is equal to Sally's last name. What does Domino do? It makes two matches, one is the short name for Sam and the other is the last name for Sally. It needs a tiebreaker. What is it?

Wait for it . . . . .

It is the internet password.

And when two users have the same internet password, Domino throws up its hands and says, basically, I cannot authenticate Sam/Sally. Changing Sam's internet password to one that is not the same as Sally's solves the issue. Domino is now able to authenticate Sam.

There is another lesson in here concerning a few other topics, like Domino Policies and policies on passwords, but I will leave that for another day.

Technorati tag: Show-n-Tell Thursday SnTT

Renaming a Domino Server

Gregg Eldred — Fri, 6 Jul 2007 11:01:14 -0400

This may be a rather lame SnTT post (on Friday, no less), but I think that it is important (you can be the judge of that statement).

Lotus/IBM has published a new Technote on the correct procedures for renaming a Domino server. The TechNote prefers that you create a new server and move the data to it. It also steps you though several scenarios. An excellent resource.

Link: What are the correct procedures for renaming a Domino server

Technorati tag: Lotus Domino SnTT Show-n-Tell Thursday

Upgrading BES from 4.0 to 4.1

Gregg Eldred — Thu, 24 May 2007 22:26:45 -0400

If you are like me, and I hope you aren't, I find the documentation from RIM to be . . . overwhelming. When trying to do something "simple" like upgrading BES, you have to wade through several PDFs, the Administrators Guide and the Installation or Upgrade Guide. And even then, you may miss something. Well, after a recent BES 4.0 to 4.1 upgrade, I decided to document my tasks. I hope that this will benefit some of you.

In addition to the BES upgrade, right after that, I upgraded the Domino server to R7.0.2 from R6.5.5. It is worth knowing that if you want to do the same thing, RIM recommends that you first upgrade the BES then upgrade Domino.

This is an in-place upgrade, meaning that 4.1 will be installed over 4.0. With this type of upgrade, there is a chance that you will not be able to revert back to 4.0 if something bad happens. The only impact on the users will be a BlackBerry service interruption during the upgrade. Sometime, prior to the upgrade, you will need to download the FULL 4.1.x BES software. You will also want to download the 4.1 device software, so that the BlackBerry devices can upgrade to the new software and also take advantage of the new 4.1 features. This cannot be done wirelessly.

Prior to the upgrade, perform some system maintenance:
1) Delete all inactive users
2) Remove the pending messages from the queue:
In the BlackBerry Manager, in the left pane, click on your BlackBerry Enterprise Server
On the Users tab, click a user account
Click Service - Control & Customization
Click Purge Pending Messages
Click OK
3) Compact all Blackberry-related databases (they are in the Lotus\Domino\Data\BES folder). Use Compact -B.
4) Backup the BES Configuration database
If using SQL, use the Microsoft tools
If using MSDE, use BlackberryDBBackup.exe in the Tools folder on the Install CD (or, you can copy the folder to the BES)
Example: blackberrydbbackup.exe -d BESMgmt -f c:\BES_Backup -E -U username -P domainadminpassword

You are now ready to actually perform the upgrade.

1) Change the Domino Server Service Startup to "Manual"
2) Take down BES
3) Take down Domino
4) Insert the CD, or run the BES Package (if downloaded)
5) Double click the setup.exe file
6) Complete the on-screen instructions (most of them should be pre-populated)
7) Restart the server when prompted
8) Sign-in using the same account that you used for the setup program
9) Complete the on-screen instructions

NOTE: The MDS Services (MDSS) is not the same as MDS in BES 4.0. If you are not developing in-house mobile applications using the Blackberry MDS Studio, select "Blackberry Enterprise Server" (not "Blackberry Enterprise Server with MDS Services").

If, during the installation, you get an "incompatible version detected" error, you are attempting to upgrade from 4.0 to 4.1.x using a service pack. You need to get the FULL 4.1.x installer. See this TechNote.

Bring BES and your Domino server back up. Test messaging to/from the Blackberry devices. Test internet mail to/from the Blackberry devices. Once you are confident that mail is routing properly, upgrade the Domino server to R7.0.2. Change the Domino Server Service back to "Automatic."

Technorati tag: Blackberry Lotus Domino Show-n-Tell Thursday SnTT

Copying Documents - With an Agent

Gregg Eldred — Tue, 1 May 2007 17:47:39 -0400

I think that this may be my first Show-n-Tell Thursday post of 2007. Not good.

This post is the result of a head splitting problem with one users' mail file. See, when his mail file was created, Domino decided to add an apostrophe to the file name. Example: user name is Sam O'Smith. The file name is so'smith.nsf. Not good, especially if you want BRMS to actually back up the mail file on some schedule. Apostrophes are a no-no. We methodically changed all of the affected mail file names, removing the apostrophe. Every thing was good in Domino Land. Mail was routing to the new files, being sent from the new files, and locally replicating.

Except for one user, Sam O'Smith. Sam, you see, could not make a local replica of his mail file. Try as we might, we kept getting a replication error - "File does not exist." The curious thing was that the local Notes Log, and the Server Log both said the same thing:

"Server Error - file mail\so'smith.nsf does not exist"

No kidding, Domino - we changed the file name. And Domino knows that the file has changed, after all the Person Document reflects that fact. And I am in the mail file, asking to create a local replica. What more do I need to do?

After much running of Fixup, Compact, and Updall, we decided to create a new mail file. That was easy. The hard part was determining how to move all of the old mail documents into the new mail file.

FYI - the commands I ran on the server?

load fixup mail\sosmith.nsf -F -N

load compact mail\sosmith.nsf -C -D -i

load updall mail\sosmith.nsf -R

How to copy a couple hundred megabytes of mail from one mail file to another? Lotus/IBM Tech Support to the rescue. They pointed me to a TechNote that did the trick. Simply copy the text of the TechNote's attached file into a new agent in the new mail file, answer some easy questions, and let LotusScript do the rest. And if you read the TechNote, you will see that this agent isn't linited to just mail. Anywhere you need to copy a lot of docs from one database to another, this one will do the trick. Where is this magical agent? Click the link. :-)

Link: How to copy all documents and folders from one mail database to another using LotusScript

Technorati tag: Show-n-Tell Thursday SnTT

What's With the Time? A SnTT Post

Gregg Eldred — Thu, 22 Mar 2007 21:59:51 -0400

Hindsight, as they say is 20/20. This is a little tip that should have been posted last week, but I was tired of DST and DST-related issues. Yes, there are still some out there. Yes, I have found that for the most part, the issues are not Notes issues, but rather finding a Windows workstation that had not had the MS patch applied to it. And there are those far-flung Domino servers, outside of our direct control, that did not have the Room and Resource Reservation patch applied. Even though we specifically told those remote Admins that it was their responsibility to patch their RnR database. The good news? I can patch RnR in just a couple of minutes!

Enough of that, on with the Show-n-Tell.

Take a look at this screen shot. Notice the dual times in the Week view of the Calendar?

Check out the week in which it appears. Yes, the user believed that the time was wrong, as this only occurs during the extra weeks of DST. I confirmed that the MS DST patch had been applied and that the Lotus DST agent had been run against the mail file. Since those were discounted, what else could cause this?

If you guessed User Preferences, you would be correct. Specifically, User Preferences - International - Calendar:

The checkbox for "Display an additional time zone" is the culprit. The user had selected this as there was a need to keep track of the time for a different time zone. Lotus introduced this feature in R6. From the TechNote:

. . . you can display two different time zones, in any "gridded" calendar view (views that show individual time slots). This includes One Day, Two Day, and One Work Week Calendar formats. The dual time zones display lets you determine at a glance mutually convenient meeting times for remote locations. To display an alternate time zone:

1. Choose File - Preferences - User Preferences.
2. Click International and then click Calendar.
3. Select "Display an additional time zone."
4. Enter a label for the alternate time zone in the Time Zone Label field. (In our previous example, we selected GMT as the label for Greenwich Mean Time.)

For this user, it was a problem. Other users may find that this is cool tip to keep track of two time zones. Ahh, flexibility in Notes.

Link: Saving time with Notes 6 Calendar and Scheduling

Technorati tag: Show-n-Tell Thursday Lotus Notes SnTT

Determining Group Members in Sametime

Gregg Eldred — Thu, 8 Mar 2007 20:50:56 -0400

A while back, I posted on how to fix a Sametime issue when people discovered that they couldn't delete Sametime Groups (or the "Buddy List"). You can see the post here.

Since then, I have discovered that you can find out the group members before you delete the user document in vpuserinfo.nsf. Of course, the user could use the reliable paper and pen to write them down, but in lieu of that . . .

Open vpuserinfo.nsf on your Sametime server using your Notes client.
Open the Storage view.
Find and click on the user name of the person who's groups and members that you want to view.
Right click on the document, and select Document Properties.
Click on the field tab.
Find the field "0"
The right side of the field properties dialog box will now show the members of the group.

Before deleting the users' name from the Storage view, this might help you lessen the pain of recreating groups for the user.

Technorati tag: Show-n-Tell Thursday SnTT Lotus Notes Sametime

Lotus Notes and vCards - SnTT

Gregg Eldred — Thu, 1 Mar 2007 00:00:00 -0400

I wouldn't call two questions on vCards in a week a "trend," but I suppose that a quick SnTT post on vCards may help some people.

vCards are really nothing more than electronic business cards. The Internet Mail Consortium owns the format, after it was proposed by the Versit consortium, which consisted of Apple, Siemens, IBM, and AT&T.* Now, more often than not, you receive an e-mail message with an attached .vcf file.

Attached vCard (or .vcf files) in your mail message can be easily imported into your Lotus Notes Personal Name and Address Book (PNAB) simply by double-clicking on it and Viewing the vcf file. Lotus will provide a dialog box showing you the vCard file (like any other attachment) but with a prompt to Save. If you click on Save, the contents of the vCard will be added to your PNAB as a new Contact.

(from the Lotus Notes Client Help database - you knew that you could find this in there, didn't you?)

That is all well and good, but how do you create a vCard to send to your contacts/customers? That is fairly easy.

Create your personal contact information as a Contact in your PNAB. Some fields that you ought to fill out are First Name, Last Name, e-mail address, Company Name, phone, mobile, fax numbers, and your address. Once you have finished with your contact information, save the Contact.

Now, select and export your Contact as a vCard file.

Decide if you want ALL data to go into the vCard or just the basics (the basics should be fine):

Click on OK.

You have now created a vCard and can attach it into your next e-mail to your customers or contacts.

Link: Internet Mail Consortium: vCards
Link: Wikipedia: vCard

Technorati tag: vCard Show-n-Tell Thursday SnTT

* - from Wikipedia entry on vCard

Dynamic Client Configuration - SnTT

Gregg Eldred — Thu, 15 Feb 2007 22:53:19 -0400

From the files of "What Did You Learn in School Today?" I learned more than I cared to about a mechanism that is called Dynamic Client Configuration (DCC). This is a feature that has really been leveraged in Notes 6 and 6.5, but was introduced, AFAIK, in Release 5, that allows the Notes Client to synchronize some information from the users' Person Document when they authenticate to their home mail server. The most noticeable piece of information is the internet address.

Have you ever noticed that after you authenticate to your home mail server, that if you time it right and you edit your Location Document, that the Notes client reports that the Location Document was changed? That was DCC synching some information. Have you noticed that if you do not populate your internet address in the Location Document, automagically you have one? DCC.

What other pieces of information are synched? Policies, Sametime Server name, Roaming User, and if your mail file have been moved (using AdminP). There are probably others, as well.

You can tell if DCC is running properly just by looking in your Clients' Notes Log. Shortly after starting Notes and authenticating to the home mail server, you will see the following entries in the Notes Client Log:

02/15/2007 11:29:59 PM Dynamic Client Configuration started
02/15/2007 11:29:59 PM Initializing Dynamic Client Configuration
02/15/2007 11:30:01 PM Dynamic Client Configuration updating location information
02/15/2007 11:30:01 PM Dynamic Client Configuration shutdown

While this shows that DCC ran, how can you tell if a Policy was applied to the client? Kind of simple: Open the Personal Address Book, and go to the view $Policies. It will show you what policies have been applied to this particular user. You can cross check the Policy by looking at the Administration tab of the Person Document.

As an Administrator, you should be able to see how to apply this technology. You bring up a Sametime Server. To rollout the Sametime Server name to your clients, simply populate the IBM Instant Messaging Server field of the Person Document. The next time the users authenticate, that field will populate the current Location Document, and the users should be ready to start chatting. Make changes to internet addresses? You should be comfortable knowing that the new address will be pushed down to the user.

Remember, DCC only occurs when the user authenticates to the home mail server. If you have users that keep their workstations on, and Lotus Notes active, DCC will not synch until they restart Notes. So, much like changing your MX record, you may want to consider applying changes to the Person Documents (like Policies, internet addresses, and the Sametime Server name) on Friday.

Another thing to know: If you apply a Policy to a user or to an OU, those policies will over-ride whatever DCC finds. Example: You populate the Sametime Server field in the Person Document with the hierarchical name, Sametime/ACME. But you create an Explicit Desktop Policy to apply to the user with the DNS name of the Sametime server, sametime.acme.com. When the user authenticates, DCC will see the change, but the Explicit Policy will push the DNS name to the Location Document.

Here are some links that may help:
Link: Frequently Asked Questions About Dynamic Client Configuration (DCC)
Link: Known Policy Issues with Dynamic Client Configuration
Link: Dynamic Client Configuration Does not Update Sametime Server in Location Doc

Class dismissed.

Technorati tag: Show-n-Tell Thursday Lotus Notes Dynamic Client Configuration

Problems in Multiple Release Land

Gregg Eldred — Thu, 1 Feb 2007 00:00:00 -0400

It may come as a shock that sometimes backward compatibility in Notes/Domino isn't backward nor compatible. This is one of those times.

The Domino application servers are the responsibility of the application side of the house. As such, they are running Domino 5.0.7a in most cases, some of the other ones are running a flavor of Domino 6.5. A lot of applications are running on the older 5.0.7a servers and therein lies the problem. If you have a mail-in database using the old R5 mail template, and a user, who is running R6.5.4, goes to add/modify a Rule, they may get the Red Screen of Death (RSOD). The workaround that I suggested, and tested, is to replicate the database locally, make your changes to the Rules, and replicate it back to the server. This seems to work fine, without resulting in the RSOD. However, a look at the Lotus Support Site, also provided some background, and a workaround (which includes downgrading the Notes client to R5.0.11 (or less) or upgrading the server to R5.0.12).

What pops up in the RSOD? The lovely "Lookuphandle: null handle" error. *sigh*

A thought - move some applications, and mail-in databases to one of the R6.5.x servers. Especially the mail-in databases.

Link: 5.0.12 (or Later) and 6.x Client Crashes with Redbox Error when Creating Additional Rules or Disabling Rule on 5.0.8 (or Earlier) Server

Technorati tag: Show-n-Tell Thursday

"Assert in LSP" Error When Launching Notes - SnTT

Gregg Eldred — Thu, 14 Dec 2006 00:00:00 -0400

One of the stranger errors to grace your Notes screen is the one that you see below:

Of course, when it pops up, people automatically think that this is a Notes error. Assert in LSP is not something that you will see everyday, but if you do, this should help.

How do you rid yourself of this? How about uninstalling Google Desktop instead of uninstalling Notes? Yes, crazy as that sounds, this is an error that comes from Google Desktop. The fix for this is to install Google Desktop 4.5 ("5.0.0611.15590"), which is available here.

Link: Assert in LSP on Google Groups

Technorati tag: Show-n-Tell Thursday Lotus Notes Google Desktop

Sametime Contacts Issue - SnTT

Gregg Eldred — Thu, 30 Nov 2006 20:44:59 -0400

Today's Show-n-Tell Thursday post has to do with the Sametime client that is integrated in Notes. I am sure that Chris and Carl will probably laugh at this one (being that they are ST Gods).

The setup: Two users call to tell me that when they try to remove entries from their Contact List, it won't let them. You can select Delete, but the contact isn't removed from the list. Also, one of the two reports that they created a Group in the Contact List with a blank name, and can't delete it. A little poking around the Sametime server, I was able to fix this for them.

First, make sure that your affected users are logged out of Sametime (rather important).
Then, on your Sametime server, and using your Notes client, open the database vpuserinfo.nsf
Open the Storage view.
Find and delete the affected users.
Have the users log back into Sametime. Sametime will create new entries for the users and they will be able to function properly.

The drawback? All of their Groups and Contacts will have to be re-created.

Technorati tag: Show-n-Tell Thursday Sametime Lotus Notes

DST, Calendars, and Notes (2007)

Gregg Eldred — Thu, 2 Nov 2006 00:00:00 -0400

Since we have recently moved our clocks back, I thought that a SnTT post on DST and Domino was in order. Also, starting in 2007, there will be a change extending DST in the US (in case you weren't aware of that).

If you are running Domino on the AS/400/iSeries/i5, and are running V5R3, the OS will (or should) automatically adjust for the time change. However, you may have to restart your Domino servers for the change to become effective. Or to correct any time issues with your Domino server (this happened to us). For those of you on other platforms, the Knowledge Collection, referenced below, should help.

Here are a couple of TechNotes to assist you with the change:

Setting up Domino iSeries for Daylight Saving Time (DST)
Effects of 2007 Daylight Saving Time (DST) changes on Lotus Notes Calendaring and Scheduling functionality and Resource Reservation functionality

General information on 2007 DST Changes:
Lotus software: United States and parts of Canada extend Daylight Saving Time (DST) in 2007
Daylight Saving Time (DST) 2007 information for Lotus Notes and Domino
Daylight Saving Time (DST) 2007 information for Lotus Sametime
Preparing for Daylight Saving Time changes in 2007 (Windows)

The Knowledge Collection:
Knowledge Collection: Daylight Saving Time in Notes/Domino

With these links, you ought to be ready for DST in 2007. If you remember. :-) Actually, I am surprised at how little fuss there is over this. So far.

Technorati tag: Show-n-Tell Thursday Lotus Domino DST

Agents Aren't Running - One Explanation

Gregg Eldred — Wed, 25 Oct 2006 00:00:00 -0400

Are you looking at your Notes Log on a daily basis? Do you have some developer complaining that their agents aren't working, even though they worked yesterday? This is just one explanation, especially if you DID look in your Notes Log and saw something similar to this:

DominoServer/Acme from host [10.10.10.1:63061] failed to authenticate: Your certificate has expired

Uh, oh, your Domino server's certificate has expired!

There are probably a few different ways to fix this, but this one may be the "easiest."

1) Open the Domino Directory
2) Click on Configuration - Servers - All Server Documents
3) Select the server that has had its certificate expire
4) Click on Actions - Recertify Selected Servers
5) Follow the prompts to recertify your server (you will need your cert.id/password)
6) Put the expiration date out farther than 2 years*
7) Once done, go to the server console and type: tell adminp process new
8) All done and your agents will now run properly (and you should be able to administer the server)

* Note - the date should be within your company's policy for server certificates. Me? I'd put it out 100 years and let someone else worry about it the next time. :-)

Technorati tag: Show-n-Tell Thursday Lotus Domino

Deny Access Groups and iNotes

Gregg Eldred — Thu, 12 Oct 2006 13:31:37 -0400

As a dutiful Domino Admin, you make use of Deny Access Groups. But recently, you have noticed that people in this group are able to access their mail using iNotes or any other database through a browser. Some may say that this is security hole. Whatever. You need to make a change to your Server Document. Go to the Ports - Internet Ports - Web tab. Change the field "Enforce server access setting" to Yes. Then restart the HTTP task. The users in your Deny Access Group will now be denied access using a browser.

TechNote addressing this issue: { Link }

Techorati tag: Lotus Domino Show-n-Tell Thursday

All New Mail Goes in All Documents View

Gregg Eldred — Thu, 28 Sep 2006 00:00:00 -0400

This was a question that was recently posted to a Notes/Domino forum and I figured that I would blog it so that I remember what was suggested, plus another couple of tips.

The issue: A user says that when new mail arrives in their mail file, it doesn't show up in the Inbox but rather in the All Documents view.

Solution 1: Open the mail file in Designer. There could be a very good chance that your user either created a folder called "Inbox" (which is a reserved name in the mail file). If this is the case, create a temporary folder in the users' mail file, like Tempmail, and move any documents in the Inbox folder, to that Tempmail. Delete the user created Inbox folder and perform a Design Replace. Once that has completed, move the messages from Tempmail to the $Inbox.

Solution 2: Open the mail file in Designer. There may be more than one $Inbox. Create a temporary folder in the users' mail file, like Tempmail, and move all documents in $Inbox to that new folder. Delete $Inbox (or $Inbox's if there are more than one) and perform a Design Replace. Once that has completed, move the messages from Tempmail to the $Inbox.

Solution 3: It is possible that $Inbox is corrupt and compact/fixup/updall can't repair it. In this case, open the mail file in Designer, delete $Inbox, and do a Design Replace.

Any other ideas?

Speaking of the Inbox, a funny thing happened today (well, it didn't happen to me or my mail file, so it is "funny"). User calls to say that when he opens his mail file, the views and the main view don't look like a mail file. I open the mail file and see . . . wait for it . . . a Document Library! The user replaced the design of his mail file with the Document Library template. *sigh* It was easy to replace the design with the Mail Template. If you ever wonder why you should list the users as Editor of their mail file, this would be Reason Number Two. What is Reason Number One? To prevent the users from "accidentally" deleting their mail files.

Technorati tag: Show-n-Tell Thursday Lotus Notes Domino

Blogger Code Post

Gregg Eldred — Thu, 21 Sep 2006 00:00:00 -0400

I know that this isn't a traditional SnTT post, but I have to point out a blogger that I recently discovered through developerWorks:Lotus. He is Charles Robinson and his blog can be found here. You may ask why am I pointing this out on SnTT, and that is a good question. It is because he has posted some excellent code on developerWorks:Lotus that deserves a special shout out.

I responded to a post concerning the use of Convert when upgrading mail templates, that you have to be careful that the Prohibit Design Refresh flag is set correctly with some folders in users' mail files. Charles posted that he, too, had this issue, but he had some code that would loop through the Domino Directory, looking at all of the mail files on the server and then correctly set the flag. This is a great tip, and I had to share it with you.

Here is his post.

And here is the code.


Sub Initialize
'*** January 21, 2005 - Charles Robinson
'*** Set the Prohibit Design Refresh flag on all non-template views and folders
'*** to prevent a design refresh from overwriting user-created folders
'***
On Error Goto ErrTrap
Dim nLog As NotesLog
Set nLog = New NotesLog("Set Prohibit Design Refresh for Mail")
Call nLog.OpenAgentLog

Dim nSession As NotesSession
Dim nDBNAB As NotesDatabase
Dim nDBMail As NotesDatabase
Dim nDBNTF As NotesDatabase
Dim nVW As NotesView
Dim nDoc As NotesDocument
Dim nDCPeople As NotesDocumentCollection

Set nSession = New NotesSession
Set nDBNTF = nSession.GetDatabase("mail/wmbird", "wmbinot6.ntf", False)
Set nDBNAB = nSession.GetDatabase("mail/wmbird", "names.nsf", False)

Set nDCPeople = nDBNAB.Search({Form = "Person"}, Nothing, 0)
Set nDoc = nDCPeople.GetFirstDocument
Do Until nDoc Is Nothing
Set nDBMail = nSession.GetDatabase("mail/wmbird", nDoc.MailFile(0), False)
If Not nDBMail Is Nothing Then
Forall vw In nDBMail.Views
'See if the view in the mail file exists in the template
Set nVW = nDBNTF.GetView(vw.Name)
'If not set the prohibitdesignrefresh flag
vw.IsProhibitDesignRefresh = (nVW Is Nothing)
End Forall
End If
GetNextDoc:
Set nDoc = nDCPeople.GetNextDocument(nDoc)
Loop

Set nVW = Nothing
Set nDBNAB = Nothing
Set nDBNTF = Nothing
Set nDBMail = Nothing
Set nDCPeople = Nothing
Set nSession = Nothing

Exit Sub

ErrTrap:
Call nLog.LogError(Err, "Unable to modify database " & nDoc.MailFile(0))
'This is necessary to prevent logging an error for every folder and overflowing the agent log
Resume GetNextDoc
End Sub

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

Technorati tag: Show-n-Tell Thursday Lotus Lotus Domino

Button Code to Change Connection Document(s)

Gregg Eldred — Thu, 7 Sep 2006 22:16:13 -0400

Usually, you are in an environment that utilizes DNS to resolve server names and IP Addresses. Sometimes, though, you are not so lucky. In those cases, you rely on Connection Documents for your users to connect to your Domino servers.

When you change server IP Addresses, you need a method to update those Connection Documents, with as little human intervention as possible. One choice is to send an e-mail out to your users prior to doing the upgrade with a button to update the Connection documents. In this example, which was initially found on SearchDomino.com and then modified, you can send a button out to the users in an e-mail that will update their Connection Documents. If a Connection Document isn't found for the specified users, it will create it for them. At the end, because it happens so fast, there is a Messagebox notifying the users.


Sub  Click As Button
Dim session As New NotesSession
Dim db As NotesDatabase
Dim view As NotesView
Dim doc As NotesDocument
Dim DestList As String
Dim SetFlag As String
SetFlag = ""

DestList ("Server1/Acme1/Acme") = "192.168.1.140"
DestList ("Server2/Acme1/Acme") = "192.168.1.141"
DestList ("Server3/Acme1/Acme") = "192.168.1.142"

Set db = session.GetDatabase("","names.nsf",False)
Set view = db.GetView("Connections")
Forall svr In DestList
Set doc = view.GetDocumentByKey(Listtag(svr))
If (doc Is Nothing) Then
SetFlag = "Document has been created"
Set doc = db.CreateDocument
Doc.Form = "Server Connection"
Doc.Destination=Listtag(svr)
Doc.OptionalNetworkaddress=svr
Doc.PhoneNumber=svr
Doc.ConnectionType="0"
Doc.LanPortName="TCPIP"
Doc.PortName="TCPIP"
Doc.Type="Connection"
Doc.Source="*"
Doc.ConnectionLocation="*"
Call doc.Save(True,True)
End If
If SetFlag = "" Then SetFlag = "Document has been updated"
doc.OptionalNetworkaddress=svr
doc.PhoneNumber= svr
Call doc.save(True,True)
End Forall
Messagebox "Your Connection "&SetFlag,MB_OK,"Updated"
End Sub

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

Discuss. :-)

Technorati tag: Show-n-Tell Thursday Lotus Notes

SnTT - Invalid Class String

Gregg Eldred — Thu, 17 Aug 2006 16:29:06 -0400

A feature of Internet Explorer that I have recently discovered, is that you can use your default mail program to e-mail URL links. Why would this discovery warrant a Show-n-Tell Thursday post? You are using Notes, and when you, or one of your users click on File - Send - Link by E-mail. . . in IE, they are getting a Notes MailMan error with an "Invalid Class String."

After looking at the IE Settings to make sure that Lotus Notes is defined as the default e-mail package, I asked the PC Support people how the Notes Client was installed. As you might imagine, I install Notes myself, so I wasn't having this issue. It seems that if Notes is installed using an account different from the one that will actually be using Notes and/or done with the Silent Install (again, with a Windows account other than the end users'), this issue may surface.

The solution? Back up all of the core Notes files, install Notes using the Windows account of the user, test the install and IE. If it is working, you can restore your backed up files to the Notes\Data folder.

Technorati tag: Show-n-Tell Thursday Notes

SnTT - Setting Up SSL Using Domino as the Cert Authority

Gregg Eldred — Thu, 3 Aug 2006 22:41:46 -0400

You may want to setup SSL on your web facing Domino server and use Domino as the Certificate Authority. This is especially useful if you are testing, doing a "proof of concept," or want to use your own Domino server as the Certificate Authority. After doing this on my own, I found that IBM has a wonderful TechNote that addresses this activity.

So that you don't have to slog through the Admin Help and try to keep straight all of the links in those Help Documents, here is a better, simpler approach. In fact, the introduction to the TechNote states that if you are looking for a quick guide to setting up SSL, this is the document for you. I know that it works with Windows and iSeries servers, but you will need access to the operating system, as you need to copy some files to the server.

TechNote: Quick guide to Setting up SSL using Domino as the Certificate Authority

Technorati tag: Show-n-Tell Thursday Domino SSL

BlackBerry Enterprise Manager Install

Gregg Eldred — Thu, 27 Jul 2006 22:29:20 -0400

You've installed BES, and now it's time to install the BlackBerry Enterprise Manager software on your workstation. All goes well, it installs. Except, you are running a different instance of SQL Server for your BESMgmt database. You try to enter the information during the install, and it appears to install properly. But every time you try to manage your BES, it doesn't connect. Now what?

Now for an adventure with Regedit.

Technorati tag: Show-n-Tell Thursday Lotus Blackberry

SnTT - Out of Office Agent Doesn't Work

Gregg Eldred — Thu, 29 Jun 2006 00:00:00 -0400

This is just one possible solution.

Here's the scenario: A user lets you know that when they Enable the Out of Office Agent, no one gets notified of their absence. You look at the design of their database, and the agent is enabled. You refresh/replace the design. No luck. So, because you are a good citizen of the Domino Community, you read two articles (Part 1 and Part 2) that Julie spent time to create. The one thing that you take away from those articles, this time, is a little scheduled mail agent that you used for testing purposes in the users' mail file:


Dim session As New NotesSession
Dim db AsNotesDatabase
Dim doc AsNotesDocument
Set db =session.CurrentDatabase
Set doc =New NotesDocument( db)
doc.Form ="Memo"
doc.SendTo = "your name /your org"
doc.Subject = "Testing mail"
Call doc.Send( False )

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

Not even that agent ran. Now what?

Let's look at the Properties of the users' mail file:

Notice the highlighted area. If the user has selected this option, no background agents will run. This includes the Out of Office Agent and your little mail test agent. Deselect the option, disable/enable the agents, and they will run. If this is the culprit. :-)

Links:

Lotus Notes Out of Office Agent, revisited: Part 1 (R6, R7)
Lotus Notes Out of Office Agent, revisited: Part 2 (R6, R7)
Notes/Domino Out of Office agent does not run - TechNote #1109712

Technorati tag: Show-n-Tell Thursday Lotus Notes Domino

SnTT - Forwarding of Calendar Entries

Gregg Eldred — Thu, 15 Jun 2006 00:00:00 -0400

This week, we take time to look at an issue where a user complains that all calendar entries are getting forwarded to him/her from another mail user. How does this happen? Actually, there is a setting in your Calendar Preferences to forward these invites to others. To access the setting, click on Tools - Preferences - Access & Delegation - Access to your mail file. Once in this screen, you will see some people that have been delegated to your mail file. You have to select a person. From there, click on the Access button. You will see a screen similar to the following:

Notice the highlighted/selected options. This is why a person that has been granted delegation to a mail file gets these notices (and waked you from your slumber). And as further assistance, this is from the Client Help database:

To specify forwarding of calendar entries:
You can forward meeting invitations you receive to a specified person or group. You can grant the person who receives your invitations access to work with them in your mail database, or no access.
You can also specify what to do with private details when calendar entries are forwarded. Private details refer to any entries in your calendar for which you selected "Mark Private" in personal settings.
1. Open your mail database.
2. Click the Tools button and choose Preferences.
3. Click the "Access & Delegation" tab.
4. On the "Access to Your Mail & Calendar" tab, select a listed person or group or add a new person or group.
5. Do any of the following to forward calendar entries to the specified person or group:
Forward notices of meetings to which you are invited
Forward notices of meetings which you chair
Specify what to do with private calendar entries. By default Notes does not forward private entries at all. You can set Notes to forward them without including private details in the forwarded message (for a meeting, this the Chair and the Subject), or forward them with full details as if they were not private.

May I point out that if you aren't taking advantage of the free help provided with your product, you are missing a good resource?

Technorati tag: Show-n-Tell Thursday

Worst Practices - Something to think about

Gregg Eldred — Thu, 1 Jun 2006 00:00:00 -0400

Right out, I have to tell you that I did not do this, I only experienced it first hand. I thought that this Show-n-Tell would be a good one for you on what not to do.

Trying to troubleshoot some messaging issues, one of the other Admins thought that there was an issue with name lookup/resolution in the Domino Directory as we were having what appeared to be issues with some mail-in databases. These mail-in database documents have internet addresses in them, and when an internal user would send to the internet address, it would always bounce back. But if the same user addressed the message to the Mail-in Database name, or picked the address out of the Domino Directory, the mail would route. And incoming mail, from the internet, would route properly. It was just addressing internally using an internet address that was giving us fits (and it still is, actually). So, since this has worked in the past, he added a debugging line to the Notes.INI:
Debug_NameLookup=6

I am not sure if the "6" has any effect on the parameter, since all of the documentation I have seen only shows "1."

Well, after adding that to the Notes.INI, we noticed that server performance was degrading at an alarming rate. This particular production mail server has about 2,800 mail files on it and a lot of message traffic. This command gives a lot of information, and the server was having a difficult time trying to send mail as it was performing the name lookups to the various views in the Domino Directory and writing the results to a Log. Too much was going on. We caught it in less than 10 minutes, and had to remove the line from the INI and restart the server.

While we did impact the mail server, this is a good command to use to troubleshoot Directory issues. But only use it when there isn't a lot of mail traffic, few users are on the system, or on a weekend. And then remember to remove the line. :-)

Link: Using Debug_Directory_Assistance and Debug_NameLookup to Troubleshoot MAB Issues

Technorati tag: Show-n-Tell Thursday Lotus Lotus Notes

Problems with the SnTT Post

Gregg Eldred — Fri, 31 Mar 2006 09:51:40 -0400

I had a few issues creating my Show-n-Tell Thursday post and have to try again. Apparently, there was a problem with the clipboard on my machine and I wasn't able to paste some pictures into the post. I'll get the post working today. I hope.

Any way, I want to point out that Andy has posted on using the InstallShield Tuner for Lotus Notes. Excellent tool and a wonderful post. Pop over to Andy's site and learn how to create silent installs for your Lotus Notes Client. It's a great tip and one that continues to baffle people on developerWorks:Lotus.

Show-n-Tell - Client Installs

Gregg Eldred — Thu, 16 Mar 2006 00:00:00 -0400

There are probably times when you are giving a user a new workstation and need to move all of the Notes data to the new machine. You have copied all of the NSF's to the new machine, but then wonder what else needs to be copied. The key to this whole process is that you have installed (but not yet configured) the Notes client to the exact location on the new one as was on the old workstation. That is, on the old machine, you see that Notes is installed to the lotus\notes folder. Install the Notes client on the new machine to the same folders.

After installing the client, but before configuring it, copy the following files to the same folders:
notes.ini
names.nsf
desktop5.dsk (if you are on R5)
desktop.ndk (if you are on R6/R7)
bookmarks.nsf
user.dic (if the user has added entries to the personal dictionary)

And, as I pointed out earlier, if there are local replicas of databases, be sure to copy those over as well. Doing that will reduce replication times and keep the Workspace error free. The Bookmarks file is used to keep track of the users bookmarks (go figure) on the bookmark bar.

Once the files have been copied over, you can then start Notes. You will see that it will launch without asking you to configure it (provided you did install the Notes software in the same folders). All the Location/Connection documents will be intact and the user will have all of their Contacts and Groups. Further, you will have saved yourself time and effort.

Technorati tag: Show-n-Tell Thursday

Show-N-Tell Thursday

Gregg Eldred — Thu, 9 Mar 2006 00:00:00 -0400

I had a couple of ideas for this week's edition of "Show-N-Tell" Thursday, so at least I should be prepared for next week's as well.

This week, for you Developers out there that have taken Jess up on spinning up your own server, I want to point out two little things that may make it so that agents don't run on your server. These are found in your Server Document. The first is the field "Fully qualified internet host name." It is on the Basics tab of the server document. Make sure that this field is the same name as your server in DNS. It can be different than the Domino Server name. For example, if the server (the actual Operating System server name) is in DNS as dominoserver1.company.com, that is what you enter in there.

The other field, on the Ports - Notes Network Ports tab, is the Net Address. This can be either the IP Address of the server or the Domino server name as it appears in DNS. In the example above, you may also have a DNS entry for the Domino server name. Let's call the Domino server DOMSERV1. In DNS, DOMSERV1 may have an IP Address of 10.10.10.100. You can enter either in that field, but I prefer the DNS entry, DOMSERV1. That way, if the server changes IP Addresses, you don't have to go hunting through Server Documents, Connection Documents, etc., changing IP Addresses.

These changes do not require a reboot of the Domino server to take effect.

So, if you have a new server, and notice that agents aren't running, start troubleshooting by looking at these two fields in the Server Document.

Technorati tag: Show-n-Tell Thursday

Cleaning up the Domino Directory

Gregg Eldred — Thu, 23 Feb 2006 00:00:00 -0400

We noticed that the Domino Directory had way more documents than we thought that it should. Also, when creating a new server, the following day, the Directory ballooned in size after a replication. Very strange. A little poking around on developerWorks:Lotus didn't really help, but there was an excellent hit on the Lotus Support page. So, today's Show-n-Tell Thursday will be the result of that search.

You may notice (at least I hope that you do) that your Domino Directory seems to be gathering documents like a magnet. The problem may be wayward Profile Documents. But how do you delete them if you can't see them? Lotus Support has the answer, and it solved our issue - we even had the $Topology Profile issue that was shown in the TechNote. I think that this will work with most Profile documents in the Domino Directory, as long as you can figure out which ones to get a handle on. There are two agents in the TechNote that you can run, one that doesn't do any reporting, and a larger, more complete agent. To whet your appetite, here is the smaller code:

Sub Initialize
Dim session As New NotesSession
Dim db as NotesDatabase
Dim profile as NotesDocument
Dim strServer As String

strServer = Inputbox("Which server do you want to remove the $Topology profile?", "Lotus Notes", "")

Set db = New NotesDatabase(strServer, "names.nsf")
If Not(db.IsOpen) Then
db.Open "", ""
End If
Set profile = db.GetProfileDocument("$Topology")
Call profile.remove(True)
Msgbox "The $Topology profile document was removed!"
End Sub

For the TechNote and the code choices, click on the link below.

Link: NAMES.NSF Grows from 45 MB to 400 MB Every Time the Database is Replicated

Technorati tag: Show-n-Tell Thursday

Adding a Disclaimer to Internet Mail

Gregg Eldred — Thu, 16 Feb 2006 00:00:00 -0400

"Show-n-Tell Thursday" is a tough assignment. As a Domino Admin, I don't usually have really "cool apps" or code. So, as I continue to slog through my stuff, I will provide you with a tip that I have used many times. That is, how to add a disclaimer to outbound mail from a Notes client.

If you are using iNotes, you can make the change to the Configuration Document and be done with it. But if you are using Notes (pre-R7), this doesn't work so well. Okay, doesn't work at all. To that end, this is my tip of the week, lifted from developerWorks:Lotus and the author "michael b."

This code will go in the Mail template, CoreEMailClasses of the Script Library, Function QuerySaveExtension. Add it after QuerySaveExtenstion="Yes" and before "End Function"

 
REM {Start - added following lines for DISCLAIMER]; 
Call Source.Refresh 
Dim session As New NotesSession 
Dim InternetMail, SendTo, CopyTo, BdyText As Variant 
InternetMail=False 

SendTo=Source.FieldGetText("SendTo") 
If Instr(SendTo,".") >0 And Instr(SendTo,"@") Then InternetMail=True 
CopyTo=Source.FieldGetText("CopyTo") 
If Instr(CopyTo,".") >0 And Instr(CopyTo,"@") Then InternetMail=True 

If InternetMail Then 
BdyText = Source.FieldGetText( "Body" ) 
If Instr(BdyText,"This email is intended") = 0 And Instr(BdyText,"We accept no") =0 Then 
Call Source.FieldAppendText ("Body",Chr(10)) 
Call Source.FieldAppendText ("Body","-- ") 
Call Source.FieldAppendText ("Body",Chr(10)) 
Call Source.FieldAppendText ("Body","This email is intended blah blah blah") 
Call Source.FieldAppendText("Body","confidential or privileged information blah blah blah") 
Call Source.FieldAppendText("Body","the person responsible for blah blah blah") 
Call Source.FieldAppendText("Body","blah blah blah") 
Call Source.FieldAppendText("Body","If you contact us by email ...") 
Call Source.FieldAppendText("Body","blah blah blah") 
Call Source.FieldAppendText("Body","blah blah blah") 
Call Source.FieldAppendText("Body","get the idea?") 
Call Source.FieldAppendText("Body","last line! blah blah blah.") 

End If 
End If 
REM {End - added following lines for DISCLAIMER];

This LotusScript was converted to HTML using the ls2html routine,
provided by Julian Robichaux at nsftools.com.

Link: developerWorks:Lotus Disclaimer working-R6

Technorati tag: Show-n-Tell Thursday