Volume Number: 25
Issue Number: 05
Column Tag: New Tools for Collaboration

New Tools for Collaboration: Supporting Entourage with Exchange

"Be prepared!" or, "What administrators need to know about installing, deploying, and maintaining Microsoft's Mac mail solution"

by William Smith

E-mail is the hub of business and Microsoft Exchange Server is the hub of E-mail for most large organizations and many educational institutions. While just about any E-mail application for Macintosh can connect to Exchange for mail, only Microsoft Entourage supports the majority of services Exchange provides.

Entourage, when connected to an Exchange Server, is an end-to-end solution providing Mac users access to their mail, calendars, contacts and more. Like Microsoft Office, Entourage is itself a suite of different applications that can work independently but become more productive when used together.

Connecting Entourage to Exchange can be confusing for end-users who are not technically inclined and supporting many of these end-users can indeed be an administrative challenge. This article will attempt to explain your options for providing Exchange support for your Mac folks using Entourage, even if your organization isn't currently running Exchange. While Mac OS X 10.6 (Snow Leopard) is reported to offer Exchange support when it is released, it is currently in beta and information about it is under non-disclosure agreement.

No one E-mail system is meant for everyone and money is a factor as well as support. Exchange isn't free like Postfix or Sendmail. It's also not simple to configure and set up for service like Mac OS X Server's Mail Services. Why would your organization want to consider using Exchange if it's not already doing so?

Exchange is meant for collaboration-it's meant to be used by people who need to work with each other. It's certainly not the only server solution for sharing calendars and address books but it is one of the most mature and full-featured systems available. Exchange is designed to integrate with existing Windows network systems such as Active Directory, which serves as the backend to a company address list, and Office Communications Server, which is Microsoft's instant messaging system.

Any mail client will work with Exchange. While it offers more complete support for Outlook for Windows and Entourage for Macintosh, it's also made to work with any mail client that supports standard POP and IMAP; Microsoft clients aren't required. However, Exchange's hallmark in today's on-the-go society, is its support for mobile devices using ActiveSync technology. ActiveSync enables Exchange to communicate with Internet-enabled smart phones, such as the iPhone, to push mail and other information across their wireless providers' networks.

Figure 1: Exchange Services

All of this takes a sizable investment in infrastructure, which is a huge disadvantage to smaller companies, but they have options too. Any individual, any small company or any organization with limited resources can still get access to Exchange.

For individuals and small organizations without a server budget, online service providers offer Exchange Server services over the Internet. This is known as "hosted Exchange". An office of three users can find online hosting deals for about $35.00 per month. This usually includes 24/7 support, spam filtering and access to Outlook Web Access (OWA), which is webmail that is accessible via a web browser. These accounts usually include free Microsoft E-mail software, Outlook for Windows and Entourage for Macintosh, but be sure that any service provider you choose says it will support Macs at the Help Desk and not just on their website. Mobile phone and Blackberry services will be extra.

For those larger organizations where IT has been brought in-house and is supported either full-time or part-time, then Microsoft Small Business Server (SBS) may fill their needs. SBS is an all-in-one Windows Server product that offers not only file and printer sharing but Exchange, remote connectivity and SharePoint. Full Exchange services are provided with SBS, however, enterprise-level options like secondary mail servers aren't available. This product really is intended for "small business".

Exchange Server can be virtualized. Mac shops that want the feature set of Exchange but want to utilize their existing XServe infrastructure may want to consider running Exchnage on VMWare Server or Parallels Server. A newer Intel XServe with beefy amounts of RAM and processing power can run multiple Mac OS X and Windows virtual machines. This is also an excellent way to evaluate the trial version of Exchange Server 2007.

Educational institutions may be interested in Exchange Labs offered directly from Microsoft. This service is provided through Windows Live and offers hosted Exchange mail services for schools interested in piloting or deploying Exchange.

Supporting dozens, hundreds or thousands of Entourage users can be a challenge for Mac administrators. Their role is to give their users the best possible experience so that they can do their jobs while keeping costs under control and Help Desk calls at a minimum. Fortunately, they have many tools available to do just that.

Exchange Server 2003's licensing allowed everyone who had a licensed account to be able to use either Outlook 2003 for Windows or Entourage 2004 for Macintosh for free. The client license was included. However, Exchange Server 2007 no longer includes clients with its account licenses. That means organizations moving to Exchange Server 2007 may incur extra costs for each workstation if they're not already running the Office for Mac suite.

Entourage 2008 is not sold separately-it is sold only as part of Office 2008-and Exchange support in Entourage is only available with the premium versions of Office: Standard and Special Media Edition. Universities that have adopted Exchange Server for their students either need to work with their Microsoft representative to provide stand-alone versions of Entourage or make sure their students are aware that they cannot use the Home & Student version with their school accounts. Students who are responsible for their own software much purchase the "business" class version of Office for Mac.

Hosted Exchange services may provide a stand-alone version of Entourage 2008 for their customers at no charge; however, Microsoft does not support installing it on a machine with the Home & Student version of Office. This makes sense. Exchange is a business-class product but Home & Student is not licensed for business. Use of the Home & Student version for business purposes is a violation of the End User License Agreement. If you don't receive Entourage as part of your Exchange agreement then you must purchase Office Standard or Special Media Edition.

Office 2008 comes as a single Apple Installer .mpkg package. Apple Installer is scriptable and that means deploying Office for Mac can be scripted too. A basic script would call the installer command line tool, telling it simply the name and path to the package, where it's located and where to install it. Assuming the Office Installer.mpkg file is still on its DVD, the command to install it would simply be:

sudo installer -package "/Volumes/Microsoft Office 2008/Office Installer.mpkg" -target /

The –package switch denotes the package name, which conveniently includes its path, and the –target switch directs installer to install onto the current startup volume.

To customize an install-for example installing only Microsoft Entourage, eliminating unwanted proofing languages or preventing application icons from being placed in the Dock-create a simple answer file that can be used with the package. Answer files are the ideal choice for customizing installation because they don't require modifying the original package. Different answer files can be applied for different users' needs.

To create the answer file, paste the following into a plain text editor such as TextEdit or BBEdit:

<array>
   <string>word</string>
   <string>excel</string>
   <string>powerpoint</string>
   <string>entourage</string>
   <string>messenger</string>
   <string>proofing-tools</string>
      <string>danish</string>
      <string>dutch</string>
      <string>finnish</string>
      <string>french</string>
      <string>german</string>
      <string>italian</string>
      <string>japanese</string>
      <string>norwegian</string>
      <string>portuguese</string>
      <string>brazilian</string>
      <string>spanish</string>
      <string>swedish</string>
   <string>fonts</string>
   <string>automator</string>
   <string>dock</string>
</array>

Anyone familiar with creating a choices file for AFP548.com's InstaDMG may recognize this format. Each item between <string> and </string> corresponds with a choice that can be selected when installing Office manually. Compare the options above with the choices in the figure below.

Figure 2: Office 2008 for Mac options

By default, all installable options are enabled. All applications will be installed along with all proofing languages, fonts, Automator Actions and Dock icons. To disable or "uncheck" an option, include it in the answer file. If a string is included more than once in the file then the result is like toggling the option off and on again. Therefore, to install all applications, English proofing tools only and Automator Actions, the answer file would look like this:

<array>
   <string>proofing-tools</string>
      <string>english</string>
   <string>dock</string>
</array>

Because Word, Excel, PowerPoint, Entourage and Messenger are selected by default, they can be excluded from the answer file. The Proofing Tools option and all its sub-options will be unchecked by including the proofing-tools string in the answer file. To install just the English proofing tools, the english string is included below the proofing-tools string. It is getting re-enabled. Fonts and Automator Actions will be installed but the Dock icons will not.

Save this plain text file with a name like Office2008.answer and deploy it with the Office Installer.mpkg package. Copying it into the /tmp folder is a good idea so that it is automatically deleted the next time the Mac is restarted. To apply the file during installation will require just a slight modification of the command line above:

sudo installer -applyChoiceChangesXML /tmp/Office2008.answer -package "/Volumes/Microsoft Office 2008/Office Installer.mpkg" -target /

To verify the installation ran according to plan, check that the Microsoft Office 2008 folder and its contents exist in the /Applications folder, verify the Dock has no Office icons and check the Get Info window of any of the applications to examine installed languages.

Figure 3: Entourage Get Info window

Deployment can be as simple as copying the Office installer package to a network file share along with your answer file and then visiting machines, one by one, to install. That may be feasible for a group of 10 Macs or less but doesn't scale well for larger numbers. Mac OS X has a myriad of deployment tools available, ranging from open source products such as InstaDMG and Radmind to commercial products like Apple Remote Desktop (ARD) and The Casper Suite.

While these tools differ in their methods for deployment, they all have similar approaches: scripted installs to multiple machines. Again, Office 2008's Installer package lends itself very well to scripted installs and most of these deployment tools are ready to accept Installer packages without much, if any, need for modification.

Patch management for Office 2008 also lends itself to scripted installs because the Macintosh Business Unit (MacBU) at Microsoft has taken a new approach to its patch management strategy. Rather than releasing multiple delta updates that each depend on a prior update to be installed, MacBU is now releasing mini-combo updates that greatly reduce the number of packages needed to install Office and bring it up to date. To date, only one or two updates need to be applied to an original install to have a fully patched set of applications..

When first released to the public, Office 2008's version number was 12.0.0. MacBU has since released updates 12.0.1, 12.1.0 (Service Pack 1), 12.1.1, 12.1.2, 12.1.3, 12.1.4 and 12.1.5. Additionally, when SP1 was released, MacBU also updated their DVD installers. Microsoft volume licensing customers should be able to request a 12.1.0 DVD to replace their 12.0.0 DVD or download it directly from Microsoft's volume licensing website. That 12.1.0 installer plus one more update will fully patch Office 2008.

Assuming that we're using ARD to deploy and patch Office 2008, we would need to copy the following three installer packages to a common location such as /tmp on every Mac:

• Office Installer.mpkg

• Office 2008 12.1.0 Update.mpkg (not necessary if using a 12.1.0 Office DVD)

• Office 2008 12.1.5 Update.mpkg

Plus we'd want to modify the installer script above to include the updates. To run multiple commands in ARD we'd just type the following into a Send Unix Command window:

installer -applyChoiceChangesXML /tmp/Office2008.answer -package "/tmp/Office Installer.mpkg" -target /
installer -package "/tmp/Office 2008 12.1.0 Update.mpkg" -target /
installer -package "/tmp/Office 2008 12.1.5 Update.mpkg" –target /

This would install our required applications and completely patch Office 2008 in one session. For detailed information about deploying Office be sure to visit Microsoft's Mactopia IT Pros website

So far, Office 2008 has been installed but it may not have yet been serialized. To avoid hassles with assigning and tracking serial numbers across multiple machines, administrators should contact their Microsoft representatives for a volume license version of Office for Mac. These licenses are available to organizations with five or more computers.

A volume license version will include an embedded serial number specific to the organization and will eliminate the need for tracking serial numbers across machines. Otherwise, administrators will need to visit each Mac and enter a specific serial number. Entering the same number twice on two machines is not only a license violation but will also prevent one of the Office installations from working while both are on the same network.

Now that the software has been installed, Entourage must be configured to connect to an Exchange account. It can be configured manually, via Autodiscover or using AppleScript. Determining which to use depends on the setup of the network and how much the administrator wants to simplify the end-user experience.

An Exchange account in Entourage has nearly two-dozen fields, checkboxes, drop down menus and radio buttons that may need to be set. Setting them consistently isn't always possible when users themselves must do it. Inconsistent configuration can lead to a non-working account or inconsistent appearance.

Figure 4: Exchange account settings

For example, Active Directory may be set to display names as "Last, First" and therefore mail from Outlook for Windows users will arrive in everyone's Inbox as "Last, First". Assume, however, the Entourage user is told to enter his name as "Moose, Mickey" but instead simply enters it as "Mickey Moose". When other users go to sort their mail and browse for "Moose, Mickey" they'll see no results. Everything from this user is elsewhere in the list. That can lead to some confusion.

Users aren't always technically inclined either. They probably don't know about SSL and port numbers. If they enter something incorrectly, such as using a capital "O" instead of a zero, they may not understand the difference. That will generate a Help Desk call and a little frustration on the user's part.

Even with good documentation, administrators can't guarantee 100% setup success from their users. The manual approach to configuration may be easy for the administrator but will be time-consuming and wasteful to the end-users. Avoid this method unless absolutely necessary.

A basic Exchange Server setup in a Windows-based network will support Exchange Server 2007's Autodiscover feature. This is a new service that's made possible by Exchange Web Services, the protocol replacing Outlook's MAPI and Entourage's WebDAV protocols. Because this service was designed to work with Outlook for Windows too, Mac administrators stand a better chance of finding it supported in their network.

The administrator tells the user to simply launch Entourage. When prompted, the user should put in their E-mail address and indicate that the account is on an Exchange server. Entourage will contact an Active Directory server for its service connection point (SCP), which is an authoritative list of URLs of Exchange Servers on the network. Active Directory returns the correct Exchange Server address to Entourage and then Entourage contacts its server to download the user's information.

Figure 5: Account Setup Assistant

This is a mostly complete solution for setup. It's mostly complete because it doesn't handle Kerberos setups. If a Mac is bound to Active Directory and a user is logged in with his network account then Entourage can take advantage of single sign-on authentication. The user shouldn't have to enter his password a second time just to access E-mail. However, Entourage doesn't handle the final step of switching a user from NTLM authentication to Kerberos. That has to be done manually by each user. Still, this is far better than manual setup.

Complete Exchange settings can be configured using AppleScript. Don't know AppleScript? Don't worry.

Writer's note: I'm very partial to using AppleScript to configure Exchange accounts in Entourage. I wrote the scripts I'm about to mention. My scripts are probably not the only ones available but I do have a couple of years invested in writing my own and using them at work. More information is at the end of this article.

Although Autodiscover is built into Exchange and Entourage, that doesn't mean the rest of the network is properly configured. Setup stands a good chance of working in an Exchange 2007 and Entourage 2008 environment but won't work the same way if using Exchange 2003 or Entourage 2004. Entourage 2004 supports automatic setup but that's based on querying multiple servers for information rather than just the Exchange Server. It could work or partially work or not work at all. Everything has to be perfect.

For those administrators needing automatic setup but don't have Autodiscover as an option then AppleScript is an excellent choice. Every setting for an Exchange account can be set via a script. The functional part of the script is this:

tell application "Microsoft Entourage"
      make new Exchange account with properties¬
{name:"Mailbox – Moose,
      Mickey", Exchange ID:"mmoose", domain: ¬ "TALKINGMOOSE", full
      name:"Moose, Mickey", email ¬ address:"mmoose@talkingmoose.pvt",
      search base:"", Exchange server
      settings:{address:"tmserver.talkingmoose.pvt", ¬ requires SSL:true,
      port:443}, public folder server 
      settings:{address:¬ "tmserver.talkingmoose.pvt/public", requires
      SSL:true, port:443}, LDAP server
      settings:{address:"globalcatalog.example.com",¬
 LDAP requires
      authentication:true, requires SSL:false,¬
 port:3268, maximum
      entries:100}}
end tell

Go ahead and open the Script Editor application found in /Applications/AppleScript and enter the above code. The instructions between the first "tell" and last "end tell" lines are all just one line. Altogether this script is really just two short lines and one very long line.

Figure 6: Exchange setup AppleScript

The setup script is chock full of "application keyword" and "value" pairs, which are separated by colons. For example, the user's name appears as:

full name:"Moose, Mickey"

The "full name" keyword is the Entourage term that describes the Name field his Exchange account and "Moose, Mickey" is his actual full name. Note that text items are surrounded by quotes. Replace the values with those specific to your network and click the Run button while Entourage is open and in less than a couple of seconds a new Exchange account with a name of "Mailbox – Moose, Mickey" will appear under Tools --> Accounts.

With a little more logic and smarts added to the AppleScript, it can pull the user's short name and full name from Mac OS X's system settings. It works especially well if the Mac is bound to Active Directory. With some additional work on the administrator's part, he can set the script to run under a schedule "At Startup" so that the user gets the experience of launching Entourage for the first time and simply entering his password to log in to his account. A full script is freely available on The Entourage Help Page.

E-mail stores change. Messages are constantly being received, sent, sorted and deleted. This can lead to problems if not properly maintained. Users may go over their quotas, their local Entourage Databases may get corrupt or performance may just be very, very slow. Exchange accounts in Entourage are different from POP and IMAP accounts and need specific attention.

These few tips and tricks will help you resolve probably 90% of your Entourage and Exchange performance problems.

Entourage can connect directly to a back-end server, which is an Exchange Server that actually hosts user accounts, or it can connect to an OWA front-end server, which allows the user to access his Exchange account from the Internet. The server address plays an important part of Entourage's perceived performance.

Laptop users often like to use the OWA address because they find that it allows them to access their E-mail from inside the company network as well as at home or while traveling. Using an outside address while inside the company network may severely decrease performance because data is probably traveling through a proxy server, a firewall, an OWA server and then to the user's back-end server. Teach your users to connect to an internal address while inside the company network and connect to an external address while outside. Writer's note: I have a script listed at the end of this article that will dynamically change addresses for the laptop user.

Encourage users should keep their Inboxes as small as possible. This folder is special and gets synchronized more frequently than other folders. A few hundred messages will probably be fine but several thousand, even in sub-folders, can slow entourage to a crawl. Users will notice they are not receiving mail immediately but rather several minutes or hours later.

If users are connected over a slow WAN link then they may want to put their Exchange account into Headers only mode. This is the closest equivalent of "online" viewing that Outlook for Windows users enjoy. It prevents the entire message from being downloaded until the user decides to preview or open the message. To put the Exchange account into Headers only mode, edit the account in Entourage and set it to partially receive messages over 9999 KB. That sounds counter-intuitive but that's how it works. The account name will appear in the folders list with "(Headers only)" appended to the end of the name.

Figure 7: Headers only settings

Users will run over server storage limits if allowed but may not understand that they have reached their quota or what's consuming their space. To help them learn where the bulk of their mail is stored within their account, direct them to right-click or Control-click their Exchange account in the Folder List at the left of the Entourage main window and select Folder Properties. Under the Storage tab they'll find a breakdown of their folders and how much space each is consuming.

Figure 8: Folder Properties: Storage

Archiving is a weak area for Entourage because, unlike Outlook, it has no archiving feature per se nor does it use Personal Storage files (PSTs). It does have the folders On My Computer, which can't be deleted and these are the ideal location to move messages offline. To copy messages from an Exchange account to archive folders under On My Computer, simply select one or more and drag them over. To move messages, in other words copy to the folders On My Computer and delete from the Exchange Server, hold the Command key while dragging. This too can be automated with AppleScript. The Entourage Help Page has one available for download.

Every once in a while a user may notice that messages in a mail folder or his calendar events aren't syncing to the Exchange Server. This certainly makes using Exchange from multiple locations difficult. Entourage synchronizes with Exchange and therefore it's creating a local copy of everything in the account. When mail messages, calendars, contacts, tasks or notes aren't syncing then the local cache may need to be cleared and synchronized again.

Caches can be cleared for the entire account or just the problematic folder. Similar to checking storage usage, direct users to right-click or Control-click their Exchange account in the Folder List at the left of the Entourage main window and select Folder Properties. Under the General tab have them click the Empty button. Local messages will be deleted and then server-side messages will be synchronized. Depending on the size of the folder before emptying the cache, synchronization may take a while.

Figure 9: Folder Properties: General

The Sent Items folder must be handled with care! Remember, when clearing caches local messages are deleted and then restored from the server and that means your user could potentially lose messages if he empties the cache for this folder. Be sure that he creates a local backup by copying messages from the Sent Items folder to a folder under On My Computer first.

Entourage and Exchange are a powerful set of tools for collaboration and are relatively easy to use. Supporting them isn't difficult most of the time and for the most part they just work. The end-user experience, however, is affected by the administrator's preparedness.

Deployment and configuration can be as intrusive as having to sit in front of the user's machine, installing the software, configuring it and asking the user to test. It can be as unobtrusive as simply telling him to launch Entourage and start working. Support can be aggravating for both the user and the administrator when the administrator doesn't invest time in how Entourage works. The pain can be mitigated, however, with a basic understanding of Entourage's features and tools.

No one method of deployment, setup and support will fit all environments but you have a plethora of options available to you. Pick and choose what works best not only for you but also your users. Time spent upfront preparing your environment and understanding how Entourage works will be well rewarded in the time saved supporting it.

Microsoft Windows Small Business Server

http://www.microsoft.com/smallbusiness/products/server/

Hosted Business E-mail and Collaboration Catalog

http://www.microsoft.com/hosting/catalogredirect.aspx?catalogID=3

About Exchange Labs

http://technet.microsoft.com/en-us/exchangelabshelp/cc511381.aspx

Evaluate Exchange Server 2007 Service Pack 1

http://technet.microsoft.com/en-us/exchange/bb330851.aspx

InstaDMG

http://www.afp548.com/article.php?story=ImageCreationRevolution&query=instaDMG

Radmind

http://rsug.itd.umich.edu/software/radmind/

Apple Remote Desktop

http://www.apple.com/remotedesktop/

The Casper Suite

http://www.jamfsoftware.com/

Mactopia IT Pros

http://www.microsoft.com/mac/itpros/default.mspx

Entourage Exchange Setup 3.0 AppleScript

http://www.entourage.mvps.org/exchange/exchangesetupv3.html

Automatically switch Exchange addresses

http://blog.entourage.mvps.org/2007/06/testers_needed_for_script.html

AutoArchive Exchange Account to "On My Computer"

http://www.entourage.mvps.org/exchange/autoarchive.html

William Smith is a technical analyst supporting Macs in a Windows world in the Twin Cities, a six-year Microsoft MVP and is co-founder of the Entourage Help Blog http://blog.entourage.mvps.org. He can be reached at bill@talkingmoose.net.