GFI MailEssentials 20 - How to count licenses for users?

By Przemyslaw Klys Exchange GFI February 29, 2016

Recently one of our Clients bought 750 licenses for GFI MailEssentials 20. As GFI on their websites claims that only Active Mailboxes are counted it was safe to assume that all Shared Mailboxes wouldn't count for the license limit. This allowed us to not have to delete old users mailboxes and simply make sure those mailboxes are either Shared Mailboxes or Disabled.

Problem Description

However the GFI Licensing interface was showing quite different story.

This wasn't good. Having double checked the count number in the Licensing section confirmed the information.

We've first tried to check things using standard method that makes a lot of sense in this scenario. Counting all mailboxes, counting all disabled mailboxes and getting all active mailboxes that way.

function GetUsersCount() {
    # Option 1
    $usersAll = (Get-Mailbox -ResultSize Unlimited).Count
    $usersDisabled = (Get-Mailbox -ResultSize Unlimited  | ?{$_.ExchangeUserAccountControl -eq 'AccountDisabled'}).Count
    write-host "Total Mailboxes = $usersAll"
    write-host "Total Disabled Mailboxes = $usersDisabled "
    write-host "Total Active Mailboxes = $($usersAll-$usersDisabled)"
}

However the result was a bit different then the one provided by GFI Interface

PS C:\Windows\system32> C:\ExchangeScripts\Manual\MailboxCount.ps1
Total Mailboxes = 1314
Total Disabled Mailboxes = 578 
Total Active Mailboxes = 736

Not knowing what it is we've actually asked GFI to provide information how they count the licenses. After a lot of going back and forth with GFI support there seems there is bad information on their website how it's counted along with bad counting in the product itself. It would seem the way they count the product licenses is by using LDAP query.

Solution

It seems the information which query is used for gathering the licenses is stored in C:\Program Files (x86)\GFI\MailEssentials\Attendant\debuglogs\usercntvsapi.txt

There are multiple queries used inside so we've created a simple way to check them

function GetUsersCountGFI () {
    # Option 2
    $strFilter = "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*))",
                 "(&(objectClass=msExchPrivateMDB)(msExchOwningServer=CN=MAIL1,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=LOCAL,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL))",
                 "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))",
                 "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(homeMDB=CN=MailboxDatabase1,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=LOCAL,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))",
                 "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(homeMDB=CN=MailboxDatabase2,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=LOCAL,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))"
    foreach ($filter in $strFilter) {
        $objDomain = New-Object System.DirectoryServices.DirectoryEntry
        $objSearcher = New-Object System.DirectoryServices.DirectorySearcher
        $objSearcher.SearchRoot = $objDomain
        $objSearcher.PageSize = 1000
        $objSearcher.Filter = $filter
        $objSearcher.SearchScope = "Subtree"
        $colResultsOption2 = $objSearcher.FindAll()
        write-host "Testing filter - $filter"
        write-host "Total License Count needed by GFI $($colResultsOption2.Count)"
    }
}

GetUsersCountGFI

After running the query the results were really weird. It would seem that depending on position of the databases the query would return different results on each server. So while on one server the query was showing over 750 user limit, on other server it was showing 361 users only.

Due to how the databases in Exchange were distributed server MAIL1 was reporting only Active Database users from MailboxDatabase1, server MAIL2 from MailboxDatabase2 and MAIL3 and MAIL4 were reporting over limit even thou the total count by 2 queries for MAIL1 and MAIL2 is giving 366 and 362 respectively.

Due to how the Mailbox Databases are spread across the servers it seems that GFI licensing counting is loosing it's count.

function GetUsersCount() {
    # Option 1
    $usersAll = (Get-Mailbox -ResultSize Unlimited).Count
    $usersDisabled = (Get-Mailbox -ResultSize Unlimited  | ?{$_.ExchangeUserAccountControl -eq 'AccountDisabled'}).Count
    write-host "Total Mailboxes = $usersAll"
    write-host "Total Disabled Mailboxes = $usersDisabled "
    write-host "Total Active Mailboxes = $($usersAll-$usersDisabled)"
}

function GetUsersCountGFI () {
    # Option 2
    $strFilter  = "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*))"
    $strFilter1 = "(&(objectClass=msExchPrivateMDB)(msExchOwningServer=CN=MAIL1,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=LOCAL,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL))"
    $strFilter2 = "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))"
    $strFilter3 = "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(homeMDB=CN=MailboxDatabase1,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=LOCAL,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))"
    $strFilter4 = "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(homeMDB=CN=MailboxDatabase2,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=LOCAL,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))"  
    $strFilter5 = "(&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*)(samAccountName=*)(!(msExchRecipientTypeDetails:1.2.840.113556.1.4.803:=549755813888)))"

        $objDomain = New-Object System.DirectoryServices.DirectoryEntry
        $objSearcher = New-Object System.DirectoryServices.DirectorySearcher
        $objSearcher.SearchRoot = $objDomain
        $objSearcher.PageSize = 1000       
        $objSearcher.SearchScope = "Subtree"

        $objSearcher.Filter = $strFilter
        $colResultsOption = $objSearcher.FindAll()
        write-host "Total License Count needed according to GFI KB $($colResultsOption.Count)"

        $objSearcher.Filter = $strFilter1       
        $colResultsOption = $objSearcher.FindAll()
        write-host "Total License Count needed according to GFI Logs MAIL1 $($colResultsOption.Count)"

        $objSearcher.Filter = $strFilter2
        $colResultsOption = $objSearcher.FindAll()
        write-host "Total License Count needed according to GFI Logs MAIL1 Next Query $($colResultsOption.Count)"

        $objSearcher.Filter = $strFilter3
        $colResultsOption = $objSearcher.FindAll()
        write-host "Total License Count needed according to GFI Logs MAIL2 Query $($colResultsOption.Count)"
        
        $objSearcher.Filter = $strFilter4
        $colResultsOption = $objSearcher.FindAll()
        write-host "Total License Count needed according to GFI Logs MAIL2 Query $($colResultsOption.Count)"
        
        $objSearcher.Filter = $strFilter5
        $colResultsOption = $objSearcher.FindAll()
        write-host "Total License Count needed according to GFI Logs MAIL3 Query $($colResultsOption.Count)"

}

#ConnectExchange
GetUsersCount
GetUsersCountGFI

And the result:

Total Mailboxes = 1315
Total Disabled Mailboxes = 578 
Total Active Mailboxes = 737
Total License Count needed according to GFI KB 1102
Total License Count needed according to GFI Logs MAIL1 0
Total License Count needed according to GFI Logs MAIL1 Next Query 1050
Total License Count needed according to GFI Logs MAIL2 Query 366
Total License Count needed according to GFI Logs MAIL2 Query 362
Total License Count needed according to GFI Logs MAIL3 Query 1050

The total count of mailboxes should be 727 according to own GFI queries, yet it's quite different depending where you look. We've reported this to GFI as bug, but for now your results may vary depending on which server you ask for the license count.