Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Exchange 2013 – How to add Relay Connector from PowerShell

Exchange 2013 – How to add Relay Connector from PowerShell
PowerShell Automating Administration
0
By Przemyslaw Klys Exchange PowerShell February 25, 2016

Adding new receiving connector is standard procedure available via GUI on Exchange 2010 / Exchange 2013 or Exchange 2016. However with special settings required for Relay Connector and lots of additional options that come useful it's often simpler to do it via PowerShell. Below method is showing how to create New Receive Connector with Relay options in PowerShell.

Solution

Following script allows quick creation of relay connector on Exchange Server based on couple of settings with relay hosts populated from the text file.

$ReceiveConnector = "SMTP Relay" # Name of the connector
$Server = "MAIL2" # Name of the server (if you have more than one you just rerun the script
$ReceiveConnectorFQDN = "relay.domain.pl" # FQDN of connector (must much available certificates for TLS to work)
$ServerReceiveConnector = "$Server\$ReceiveConnector"
$ReceiveConnectorBinding = "172.16.50.36:25" # Binding of Relay Connector
$ReceiveConnectorRange = "127.0.0.1" # Hosts allowed to relay. Will be overwritten by hosts from file
$ReceiveConnectorRangeFromFile = "C:\ExchangeScripts\Create-NewConnector.txt" # file with relay hosts

New-ReceiveConnector -Server $Server -Name $ReceiveConnector -Usage Custom -Bindings $ReceiveConnectorBinding -RemoteIPRanges $ReceiveConnectorRange

# Set required and useful settings for relay connector
Set-ReceiveConnector -Identity $ServerReceiveConnector -Bindings $ReceiveConnectorBinding
Set-ReceiveConnector -identity $ServerReceiveConnector -AuthMechanism "TLS","ExternalAuthoritative" -PermissionGroups AnonymousUsers,ExchangeServers
# The default "AnonymousUsers" permissions are as follows:
<# Ms-Exch-SMTP-Submit Ms-Exch-SMTP-Accept-Any-Sender Ms-Exch-SMTP-Accept-Authoritative-Domain-Sender Ms-Exch-Accept-Headers-Routing #>
# The default "Externally Secured" permissions are as follows:
<# MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Authoritative-Domain} MS Exchange\Externally Secured Servers {ms-Exch-Bypass-Anti-Spam} MS Exchange\Externally Secured Servers {ms-Exch-Bypass-Message-Size-Limit} MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Exch50} MS Exchange\Externally Secured Servers {ms-Exch-Accept-Headers-Routing} MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Submit} MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Any-Recipient} MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Authentication-Flag} MS Exchange\Externally Secured Servers {ms-Exch-SMTP-Accept-Any-Sender} This makes sure emails are treated as sent internally (secured, authenticated) and can be sent to internal groups only as well. #>
Set-ReceiveConnector -identity $ServerReceiveConnector -TarpitInterval 00:00:00
Set-ReceiveConnector -identity $ServerReceiveConnector -ConnectionTimeout 00:30:00
Set-ReceiveConnector -identity $ServerReceiveConnector -ConnectionInactivityTimeout 00:20:00
Set-ReceiveConnector -identity $ServerReceiveConnector -MaxAcknowledgementDelay 00:00:00
Set-ReceiveConnector -identity $ServerReceiveConnector -MaxInboundConnection 10000
Set-ReceiveConnector -identity $ServerReceiveConnector -MaxInboundConnectionPercentagePerSource 100
Set-ReceiveConnector -identity $ServerReceiveConnector -MaxInboundConnectionPerSource unlimited
Set-ReceiveConnector -Identity $ServerReceiveConnector -Fqdn $ReceiveConnectorFQDN
Set-ReceiveConnector -Identity $ServerReceiveConnector -ProtocolLoggingLevel Verbose

# Set true Relay options
Get-ReceiveConnector -Identity $ServerReceiveConnector | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"
Get-ReceiveConnector -Identity $ServerReceiveConnector | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-exch-bypass-anti-spam"

# Set ip addresses (overwrites current setup)
Get-ReceiveConnector -Identity $ServerReceiveConnector | Set-ReceiveConnector -RemoteIPRanges ($_.RemoteIPRanges+ (Get-Content $ReceiveConnectorRangeFromFile) | Sort -Unique)

Text file with hosts should consists of one entry per line (make sure no spaces before/after ip):

172.16.1.1

172.16.1.2

85.200.11.20-85.200.11.25

Since running the script in ISE causes issues with Get-AdPermission as described in one of our blog posts, make sure to run it in Exchange Management Shell.

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

PowerShellGallery disables support for TLS 1.0 breaking Install-Module
A few days ago, I tried to use Install-Module on the old Windows 2008R2 system that I use for specific tasks.
09 Apr 2020
Virus Total Analyzer - PowerShell Module
Working with VirusTotal from PowerShell
Virus Total is an excellent service. It’s a single place where hundreds of antivirus engines can verify if the file, URL, domain name, or IP Address is trusted or not. Of course, it’s not a silver bullet, but it brings tremendous value, and I often verify files I download before executing. Since I release a lot of new or updated PowerShell modules on a weekly/monthly basis, I thought it would be great to send newly released versions straight to Virus Total so I can have them checked before anyone executes them. I also hope to prevent false positives from some antivirus vendors that may tag my modules as malware because they haven’t seen the DLL or PowerShell module in this form before. I’ve seen it happen to DBATools, so why not try and push my modules before users even use them?
10 Aug 2022
AzureAD – Enable Password Expiration with Password Hash Synchronization
Azure AD Connect allows three ways to make sure the user password is the same in Active Directory and Office 365. Those are Password Hash Sync, Pass-Thru Authentication, and ADFS. While my preferred option to go with would be Pass-Thru Authentication, only Password Hash Synchronization is the easiest and least resource-intensive. It synchronizes user password to Office 365, and even if your Active Directory is down, you can still log in to Office 365. It’s perfect for small and even more significant companies that don’t have resources or can’t guarantee that their infrastructure will stay 100% time online so users can authenticate based on their Active Directory.
24 Feb 2020
PowerShell Automating Administration
Microsoft Exchange – Set address book policy based on group membership
0
04 Mar 2016
Update-Module : Module ‘PowershellGet’ was not installed by using Install-Module, so it cannot be updated.
22 Aug 2018
Fixing Active Directory PasswordNotRequired with PowerShell
There was I, deploying PSPasswordExpiryNotifications for one of my Clients when I started getting complaints that some users are not getting their Password Expiry Notifications. Well, that’s a new one. I’ve tested this script multiple times, and it worked just fine. So I dive into the details of my script to see what I did in there (I don’t even remember anymore – it just works) to find out this little line:
25 Jun 2019
Dashimo
Meet Dashimo – PowerShell Generated Dashboard
Today I wanted to introduce a little product that I’ve created in the last few weeks called Dashimo. It doesn’t cover everything I wanted from it (feature wise), but it already can be used in production. Therefore, I thought it would be a good idea to get some feedback on whether I should spend some more time on it or throw it in the dumpster. Dashimo joins it’s older brother Statusimo of PowerShell modules allowing an easy way to build HTML output. If it will feel familiar, it’s because it was inspired with Bradley Wyatt PowerShell script he did. It gave me the idea of how I would like to build something similar but in a bit different way then he did, with much more flexibility. Still, if it wasn’t for him, the idea wouldn’t be there, therefore you should send him your thanks.
01 Apr 2019
SFTP/FTPS using PowerShell
Easy way to connect to FTPS and SFTP using PowerShell
FTPS and SFTP are two ways to send and receive files from remote sources. While the name suggests both do the same thing, those are different protocols, in the end, having the same goal. A few weeks back, I had to make sure I can reliably download files from FTPS server using PowerShell, and since I couldn’t find anything straightforward to use, I decided to write my own. Transfertto is a new PowerShell module that supports both FTPS and SFTP protocols. Its goal is to be the only module that you need to transfer files to and from FTP/SFTP servers.
29 Aug 2021
Making PowerShellGallery modules Portable
I’m a big fan of PowerShellGallery. It’s easy to use, Microsoft owned, a place to host your PowerShell modules. Every time I release a new PowerShell module, it’s readily available for me or anyone with a single command Install-Module. No need to host it yourself, no need to prepare anything – plug & play. Additionally, if your PowerShell module has any dependencies, it will download and install them, so it directly works out of the box. But what if you can’t use PowerShellGallery? What if you don’t want to use Install-Module on 100 computers, but you prefer to do it in a more controlled way? What if your servers do not have internet connectivity?
08 Sep 2019
Working with Windows Events with PowerShell
28 May 2018
PowerShell – Returning one object from a function as an Array
Few weeks had passed since I’ve initially written PowerShell – Few tricks about HashTables and Arrays I wish I knew when I started. I was happily using my tips and tricks myself till today when I noticed a strange problem. Do you know how I showed you that you could use a comma to return Array with just one member (that otherwise would be unwrapped and end up a string)?
08 Mar 2019
PowerShell
Get-AdPermission – The operation couldn’t be performed because object couldn’t be found
0
25 Feb 2016
Remove Protect Object setting from Organizational Unit via PowerShell
0
13 Dec 2017
Exchange Server 2010 – Service Pack 3 Update Rollup 11 (SP3 RU11) Released
On September 15th Microsoft has released Exchange Server 2010 Service Pack 3 Update Rollup 11 (SP3 RU11). Rollup Update 11 contains…
0
16 Sep 2015
The only command you will ever need to understand and fix your Group Policies (GPO)
The only command you will ever need to understand and fix your Group Policies (GPO)
I’ve been working on cleaning up Group Policies for a couple of months. While it may seem trivial, things get complicated when you’re tasked with managing 5000 GPOs created over 15 years by multiple teams without any best practices in mind. While working on GPOZaurr (my new PowerShell module), I’ve noticed that the more code I wrote to manage those GPOs, the more I knew passing this knowledge to admins who will be executing this on a weekly/monthly basis is going to be a challenge. That’s why I’ve decided to follow a similar approach as my other Active Directory testing module called Testimo. I’ve created a single command that analyses Group Policies using different methods and shows views from different angles to deliver the full picture. On top of that, it provides a solution (or it tries to) so that it’s fairly easy to fix – as long as you agree with what it proposes.
24 Jan 2021

Leave a comment

You must be logged in to post a comment.