Rollup Installation With DAG Maintenance Scripts In Exchange 2010 SP1

Installing update rollups on DAG members was never a straight forward task like clicking Next, Next. We had to make sure that all the active databases have been moved to a different DAG member, activation of all databases on the server to be patched is blocked, mailbox database copy is suspended etc. If we had Forefront running, it had to be disabled as well.

To make patching DAG members easier, Microsoft has two new scripts in the “Scripts” folder of Exchange 2010 SP1. StartDAGServerMaintenance.ps1 and StopDAGServerMaintenance.ps1.
The StartDAGServerMaintenance.ps1 script does the following:

• Run Suspend-MailboxDatabaseCopy for each database copy hosted on the DAG member.
• Pauses the node in the cluster, which prevents it from being and becoming the Primary Active Manager.
• Sets the value of the DatabaseCopyAutoActivationPolicy parameter on the DAG member to Blocked.
• Moves all active databases currently hosted on the DAG member to other DAG members.

The StopDAGServerMaintenance.ps1 script does the following:

• Run Resume-MailboxDatabaseCopy for each database copy hosted on the DAG member.
• Resume the node in the cluster, which will enables full cluster functionality for the DAG member.
• Sets the value of the DatabaseCopyAutoActivationPolicy parameter on the DAG member to Unrestricted.

In order to install a rollup on 2010 SP1 (UR1 at the time of writing), follow the steps below.

• Run the StartDAGServerMaintenance.ps1 script from the “Scripts” folder with the –ServerName switch before patching the DAG member. Forefront will have to be disabled manually.
• Use the -whatif switch to test the script



• Install update rollup, make sure that it is run from an elevated command prompt, read my article.
• Run the StopDAGServerMaintenance.ps1 script with the –ServerName switch after patching the DAG member. Enable forefront manually.

Enjoy....and patch your servers smoking a big cigarette

-Dario

Cannot add users to the BlackBerry Enterprise Server 5.0 in an environment that includes Microsoft Exchange 2010 SP1

Hi All,,
An issue may exist where users cannot be added to the BlackBerry Enterprise Server from the BlackBerry Administration Service console in an environment that includes Microsoft Exchange 2010. When attempting to add users, they will not appear in the console when searched and cannot be added using the SMTP email address either.
Cause:
The Microsoft Exchange 2010 SP1 Server in the organization does not include a public folder database and the BlackBerry Mail Store Service cannot connect to it. The BlackBerry Mail Store Service is designed to connect to the messaging servers in the organization's environment and retrieve the contact information that the BlackBerry Administration Service requires to search for user accounts.

BlackBerry service for existing users is not affected and they continue to operate normally.
There is a work around in order to fix that issue, please check the RIM article KB24470.

In another hand...check this RIM Compatibility Matrix for BES for Microsoft Exchange

The reference is for the KB mentioned earlier..

Be care , be happy...

-Dario

How to get the mailbox last logon user and the client in Exchange 2003 & Exchange 2010

Hi all,
here a simple script to get the user last logon information for Exchange 2003 and Exchange 2010:

Exchange 2003:

#$erroractionpreference = "SilentlyContinue"
$user=Import-CSV "c:\serviceMBX.csv"
$report="c:\\ReportSvcMBXLastLogon.csv"
Clear-Content $report
add-content $report "Handle,MailboxDisplayName,LoggedOnUserAccount,LogonTime,ClientMode,ClientVersion,ServerName"

foreach ($usr in $user)
{
$identity= $usr.handle

$script=get-mailbox -identity $identity | select-object legacyExchangeDN,servername
if($error.count -gt 0){
$string ="User " + $identity  + " doesn't exist in AD"
add-content $report -VALUE $string
write-host "User " $identity "  doesn't exist in AD"
$error.clear()
}
else
{
foreach ($u in $script)
{

$legDN=$u.legacyExchangeDN
$serverEx=$u.servername

$lastL=get-wmiobject -class Exchange_logon  -Namespace "root\MicrosoftexchangeV2"  -Computer $serverEx -Filter "MailboxLegacyDN='$legDN'"|select-object  MailboxDisplayName,LoggedOnUserAccount,LogonTime,ClientMode,ClientVersion,ServerName
write-host $legDN
write-host $serverEx
write-host $identity

foreach ($2k3 in $lastL) {
              
               $displN=$2k3.MailboxDisplayName
               $LOnUser=$2k3.LoggedOnUserAccount
               if ($2k3.LogonTime -ne $null) {
                 $LOnTime=[System.Management.ManagementDateTimeConverter]::ToDateTime($2k3.LogonTime)
  }else{
   $LOnTime=$2k3.LogonTime
  }
               $cliMode=$2k3.ClientMode
               $cliVer=$2k3.ClientVersion
              
                        
             
    }
}}
$string=$identity + "," + $displN + "," + $LOnUser + "," + $LOnTime + "," + $cliMode + "," + $cliVer + "," +$serverEx
add-content $report -VALUE $string


}
###### end code

Client Mode:

1=classic

2=Cached

Client Version:　

7.0 = Outlook 97
8.0 = Outlook 98
9.0 = Outlook 2000
10.0 = Outlook 2002
11.0 = Outlook 2003
12.0 = Outlook 2007
14.0 = Outlook 2010　

Exchange 2010:

For last logo user:

For last client connected on the mailbox:

Enjoy!

-Dario

Outlook 2003 Free/Busy issues in Exchange 2010 environmet

Hello everyone,

below is an extract from a great article
(see http://msexchangeteam.com/archive/2010/04/23/454711.aspx)

Public Folders, Offline Address Book and Free/Busy

Outlook 2003 uses the Public Folders free/busy messages to determine availability in the Calendar and as the source for Offline Address Book synchronization. If Public Folders are not configured during Exchange Server 2010 setup, Offline Address Book and Free/Busy will not be available to Outlook 2003 users. These users will encounter connection errors.
If free/busy Public Folders folder is not replicated to Exchange Server 2010, users will encounter the following:

Users who use Outlook 2003 cannot publish their free/busy data in Exchange Server 2010 or in Exchange Server 2007http://support.microsoft.com/kb/945602

If clients inside the organization or connected via VPN/RAS, and the organization uses a Proxy server, the Client Access Server should be listed in the "Bypass proxy server for local addresses" configuration.

Error message when Outlook synchronizes an offline address book with Exchange Server 2007 and Exchange Server 2010: "0x8004010F"http://support.microsoft.com/kb/939765

Also, if there are missing address book list objects or missing or incorrect address lists, the following may occur:

An error occurs when you try to synchronize the offline address list on an Exchange Server server while you are using Outlook 2003: "0x8004010F" http://support.microsoft.com/kb/905813

Opening Additional Mailboxes

Delegate Access issues, opening other user's folders or mailboxes are a common operation in the enterprise. Outlook 2003 users may encounter issues, if the environment is not properly prepared for their use:

Office Outlook 2003 does not connect to two or more additional mailboxes in a mixed Exchange Server 2007 and Exchange Server 2010 environment http://support.microsoft.com/kb/978777

An error occurs when an Exchange server 2003 user tries to open more than one delegate mailboxes of Exchange Server 2010 in Outlook 2003 http://support.microsoft.com/kb/979690

Enjoy!

-Dario

How to request a new certificate manually with certreq.exe tool ussing a INF file and a SAN

Once a time I was really lost regarding how to get a new cert request from command line and I've found  this command ....this is useful for Windows 2003 Server and Windows 2008 Server.

1.Open a notepad and save as policy.inf and copy the below lines:

Policy.INF file

[Version]
Signature= "$Windows NT$"
[NewRequest]
Subject= "CN =server1.mycompany.com;OU=MyCompany IT;O=My Company Inc;L=Saavedra;S=CABA;C=AR"
KeySpec = 1 
KeyLength = 1024  
Exportable = TRUE
MachineKeySet = TRUE
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE   
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA Schannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10 
KeyUsage = 0xa0   
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1   
[RequestAttributes]
SAN:DNS=name1.mycompany.com&DNS=name2.mycompany.com&DNS=name3.mycompany.com&DNS=name4.mycompany.com&DNS=name4.mycompany.com&DNS=name5.mycompany.com


2. From command line and with Local Administrator permissions, type:

certreq -new Policy.inf c:\certs\server1New.txt

3. Submit the request file to the Certificate Authority (CA) and have the CA generate the certificate

4.After receiving the certificate , accept it

certreq -accept c:\certs\cert.cer

 This will install the certificate in your certificate personal folder..

Further information be free to contact me at dario.may@gmail.com

-Dario

How to install a Certificate in Exchange 2007 CAS Server

Gooood night for all...

A commercial certificate is only needed if the Client Access server will service client requests from the Internet or to facilitate un-trusted cross-forest communication between Client Access servers.

1.Connect to the server via Remote Desktop and log on with an account that has local administrative access and has been delegated the Exchange Server Administrator role (or higher).

Note:

For more information about using the certificate tasks, see the Exchange 2007 Online Help topic Creating a Certificate or Certificate Request for TLS .

 

 Note:

If generating a certificate that will use Subject Alternative Names, be sure that the certificate’s principal name will be the one that the clients (for example, Outlook) will use to connect (for example, mail.contoso.com). In other words, do not list the Autodiscover namespace as the principal name in the certificate.

2. Generate the certificate request by using the following Exchange Management Shell command. The DomainName parameter includes the principal URL, Autodiscover FQDN, and the server FQDN. The FriendlyName parameter matches the principal URL that is used by Outlook Web Access and Outlook Anywhere.

New-ExchangeCertificate -GenerateRequest -SubjectName “c=US,o=MyCompany,cn=<Primary Namespace>.mycompany.com” -DomainName =<Primary Namespace>, <Secondary Namespace(s)>, <ServerName>, <ServerName>.domain.mycompany.com, <Location Code>NLB.mycompany.com -FriendlyName <Primary Regional Namespace>.webmail.mycompany.com -privatekeyexportable:$true -path c:\cert.txt

 Note:
An example of [Full Subject Path] is "c=US, o=Company, cn=CAS01.contoso.com".

Note: In Windows Vista, the Windows RPC/HTTP client-side component required that the Subject Name (Common Name) on the certificate match the “Certificate Principal Name” configured for the Outlook Anywhere connection in the Outlook profile. This behavior was changed in Windows Vista Service Pack 1 (SP1). Therefore, as a best practice, make sure that the Subject Name (Common Name) on the certificate match the “Certificate Principal Name” configured for the Outlook Anywhere connection. 

3. Submit the request file to the Certificate Authority (CA) and have the CA generate the certificate.
4. After receiving the certificate, import and enable the certificate by running the following Exchange Management Shell command where [services] can be POP, IMAP, IIS, or a combination:

Import-ExchangeCertificate -path c:\newcert.cer | Enable-ExchangeCertificate -services "IIS,IMAP,SMTP"
5. You will prompted to “Confirm; Overwrite existing default SMTP certificate”. Respond “L” for “No to all”

6. Require SSL on the default Web site, do the following:

1.  Open Internet Information Services (IIS) Manager.
2. Expand the Server Node object and the Sites node.
3. Click the Default Web Site.
4. In the middle pane, double-click SSL Settings.
5. Verify Require secure channel (SSL) is enabled.

 Note:

If you require 128-bit encryption, also verify that Require 128-bit encryption is enabled.

How to modify the Users Storage Quota from CSV file and Database Quota Limits in Exchange 2010

Hi all,
may be you will need to adjust your Database's storage Quota Limits on the fly, but please think about your users limits first!!! in order to avoid hundred of helpdesk calls from crazy users (the end of the world!!!) first use one of my post to get the user mailbox size, then use the below code with the csv format:

For user side:
Copy/Paste the below format in a csv file

Identity,WQ,ProhSQ,ProhSRQ
user1,358400000,378880000,399360000

that means..
WQ= Warning Quota Limit ---> 358400000 bytes (350 MB)
ProhSQ = Prohibit Send Quota Limit ---> 378880000 bytes (370 MB)
ProhSRQ = Prohibit Send and Receive Quota Limit ---> 399360000 bytes (390 MB

Copy the code below in a ps1 file in order to set those storage limits to the user list

Import-csv users.csv | foreach {Set-Mailbox -Identity $_.identity -UseDatabaseQuotaDefaults $false  -ProhibitSendQuota $_.ProhSQ -ProhibitSendReceiveQuota $_.ProhSRQ  -IssueWarningQuota $_.WQ }

For Database side:

Set-MailboxDatabase  -IssueWarningQuota 378880000 -ProhibitSendQuota 399360000  -ProhibitSendReceiveQuota 436224000 -Identity 'DB01'

Bear in mind, the users always will use all the space or storage available...be tough

Enjoy,
-Dario

Move Request Exchange 2010 - Can we increase the number of simultaneous Remote/Local Move Request ?

The answer is yes..of course.. because:
The Mailbox Replication Service (MRS), which resides on all Microsoft Exchange Server 2010 Client Access servers, is the service responsible for moving mailboxes, importing and exporting .pst files, and restoring disabled and soft-deleted mailboxes.
Because MRS performs several tasks, you can throttle it to maintain the overall health of your Exchange organization. Although each instance of MRS has its own configuration settings, each instance of MRS is aware of the tasks that other instances of MRS are processing. MRS throttling is controlled by the configuration file MSExchangeMailboxReplication.exe.config. By default, this configuration file is located on all Client Access servers in the same folder where Exchange is installed:
 <Exchange Installation Path>\Program Files\Microsoft\Exchange Server\V14\Bin\MSExchangeMailboxReplication.exe.config.

Modify those values to have 25 move-request simultaneously.

MaxActiveMovesPerSourceMDB = "25"
MaxActiveMovesPerTargetMDB = "25"
MaxActiveMovesPerSourceServer = "50"
MaxActiveMovesPerTargetServer = "25"
MaxTotalMovesPerMRS = "100"

Do this change in all CAS servers in your environment and restart the Microsoft Exchange Mailbox ReplicationService.From PS (restart-service MSExchangeMailboxReplication)

Explanation:

• Navigate to <Exchange Installation Path>\Program Files\Microsoft\Exchange Server\V14\Bin
• Open the MSExchangeMailboxReplication.exe.config file using a text editor such as Notepad
• Navigate to the MRSConfiguration section. You can edit the following properties:
• MaxRetries    This property specifies the maximum number of times MRS will attempt to perform a task after encountering a transient failure. You can specify a value from 0 through 1000. The default value is 60.
• MaxCleanupRetries    This property specifies the number of times that MRS should attempt to clean up a task. If the maximum number of attempts is reached, the task fails. You can specify a value from 0 through 100. The default value is 5.
• MaxStallRetryPeriod    This property specifies the maximum duration for which MRS pauses while waiting for the Microsoft Exchange Information Store service to bring the target mailbox database into compliance with its configured data redundancy constraints. If the Microsoft Exchange Information Store service reports that the mailbox database is unhealthy, MRS will pause. If the maximum time is reached, the task fails. You can specify a value from 00:00:10 (10 seconds) through 05:00:00 (5 hours). The default value is 00:15:00 (15 minutes).
• RetryDelay    This property specifies the amount of time MRS will wait before it attempts to perform a task again after a transient failure. You can specify a value from 00:00:10 (10 seconds) through 00:30:00 (30 minutes). The default value is 00:00:30 (30 seconds).
• MaxMoveHistoryLength   This property specifies the maximum number of move histories to maintain in the mailbox. You can specify a value from 0 through 100. The default value is 2 move histories per mailbox.
• MaxActiveMovesPerSourceMDB   This property specifies the total number of tasks MRS can perform that involve the mailbox database as a data source. Types of tasks include moving mailboxes located on the database, exporting mailbox data from mailboxes located on the database, and restoring mailbox data from the database. You can specify a value from 0 through 100. The default value is 5 concurrent tasks.
• MaxActiveMovesPerTargetMDB   This property specifies the total number of tasks MRS can perform that involve the mailbox database as a data target. Types of tasks include moving mailboxes to the database, importing mailbox data into a mailbox located on the database, and restoring mailbox data to a mailbox located on the database. You can specify a value from 0 through 100. The default value is 5 concurrent tasks.
• MaxActiveMovesPerSourceServer    This property specifies the total number of tasks MRS can perform that include the server as a data source. You can specify a value from 0 through 1000. The default value is 50 concurrent moves.
• MaxActiveMovesPerTargetServer    This property specifies the total number of tasks MRS can perform that involve the server as a data target. You can specify a value from 0 through 1000. The default value is 5 concurrent moves.
• MaxTotalMovesPerMRS   This property specifies the total number of tasks that a single instance of MRS can perform at a time. You can specify a value from 0 through 1000. The default value is 100 concurrent moves.
• FullScanMoveJobsPollingPeriod   This property specifies how often each instance of MRS scans for new tasks. You can specify a value from 00:03:00 (3 minutes) through 1.00:00:00 (1 day). The default value is 00:10:00 (10 minutes).

Just In Case ...default values are :

<MRSConfiguration

MaxRetries = "60"

RetryDelay = "00:00:30"

MaxMoveHistoryLength = "2"

MaxActiveMovesPerSourceMDB = "5"

MaxActiveMovesPerTargetMDB = "5"

MaxActiveMovesPerSourceServer = "50"

MaxActiveMovesPerTargetServer = "5"

MaxTotalMovesPerMRS = "100"

FullScanMoveJobsPollingPeriod = "00:10:00"

MinimumTimeBeforePickingJobsFromSameDatabase = "00:00:04"

ServerCountsNotOlderThan = "00:10:00"

MRSAbandonedMoveJobDetectionTime = "01:00:00"

BackoffIntervalForProxyConnectionLimitReached = "00:30:00"

DataGuaranteeCheckPeriod = "00:05:00"

EnableDataGuaranteeCheck = "true"

DisableMrsProxyCompression = "false"

DisableMrsProxyBuffering = "false"

MinBatchSize = "100"

MinBatchSizeKB = "256" />

 see http://technet.microsoft.com/en-us/library/ff963524.aspx

Move! Move! Move!! Thanks Andy!!

-Dario

Don't forget your BES Admin account !!!! - Migrate from Exchange 2007 or 2010 in BlackBerry 5.0 environment

Hey!!,
here an useful article with all to do task for migrate your BES admin mailbox from Exchange 2003 to 2007/2010...How to migrate from Microsoft Exchange Server 2003 or 2007 to Microsoft Exchange Server 2010 in a BlackBerry Enterprise Server 5.0 environment

Particularly for Exchange 2010 migrations take care with this setting

• New-ThrottlingPolicy BESPolicy -RCAMaxConcurrency $null.
• Set-ThrottlingPolicy BESPolicy -RCAMaxConcurrency $null -RCAPercentTimeInAD $null -RCAPercentTimeInCAS $null -RCAPercentTimeInMailboxRPC $null -EWSMaxConcurrency $null -EWSPercentTimeInAD $null -EWSPercentTimeInCAS $null -EWSPercentTimeInMailboxRPC $null -EWSMaxSubscriptions $null -EWSFastSearchTimeoutInSeconds $null -EWSFindCountLimit $null

 And for Sp1

• New-ThrottlingPolicy BESPolicy -RCAMaxConcurrency $null -EWSFindCountLimit $null -EWSMaxConcurrency $null.
• Set-Mailbox "BESAdmin" -ThrottlingPolicy BESPolicy

Because RCAMaxConcurrency, EWSFindCountLimit and the EWSMaxConcurrency has been disabled,

To check which throttling policy is applied to the BESAdmin account, follow these steps:

  

      get-mailbox besadmin | fl -property throttlingpolicy

Enjoy!

-Dario

DataBase's OnLine Defrag is silent as bad cholesterol - Exchange 2007

And is true...Before you know it, you have clogged arteries..and your databases ..broken .So the code below will check the events 700-701-702-703-704 see the table below.

As Microsoft states as best practices :
"Monitoring online defragmentation enables you to verify that defragmentation of every Exchange database is completing often enough (at least every two weeks, as a best practice). Monitoring online defragmentation may also enable you to decrease the online maintenance window, which has the following advantages:

• Allows more time for database backup.
• Validates that online checksumming and page zeroing can be introduced within the current online maintenance window.

Microsoft Exchange Server 2007 Service Pack 1 (SP1) introduces the following improvements to help you monitor online defragmentation:

• Extended information for Event 703 allows you to more easily monitor online defragmentation pass completions.
• Two extended Extensible Storage Engine (ESE) performance counters for monitoring the effectiveness and efficiency of online defragmentation have been added for use with Performance Monitor (which is called Reliability and Performance Monitor in Windows Server 2008)."

This code will generate two types fo outputs:

With errors (not completed)
Name                    : DATABASE1-SG04
Identity                : SERVER\STORAGEGROUP\DATABASE1-SG04
EdbFilePath             : N:\STORAGEGROUP\DATABASE1-SG04
.edb
DefragStart             :
DefragEnd               :
DefragDuration          :
DefragInvocations       :
DefragDays              :
DefragInterrupts        :
DefragError             : unexpected error :-327.--> this is a critical error, you shold repair the DB (http://technet.microsoft.com/en-us/library/bb218265(EXCHG.80).aspx)DefragStillRunningSince : 20/01/2011
DefragStillRunningDays  : 13  ----> 13 days running

Without errors (completed)
Name                    : DATABASE-SG05
Identity                : SERVER\STORAGEGROUP\DATABASE-SG05
EdbFilePath             : P:\DATABASE\DATABASE-SG05.edb
DefragStart             : 03/02/2011 04:54 
DefragEnd               : 03/02/2011 04:54
DefragDuration          : 28976 seconds.
DefragInvocations       : 2 time[s].
DefragDays              : 1
DefragInterrupts        : 03/02/2011 09:59  ---> Backup interruptions
DefragError             :
DefragStillRunningSince :
DefragStillRunningDays  :

The event 705 is preceded for the event 447 , this issue indicates that a corrupt page link was detected in a B-Tree.

Explanation:
Online defragmentation has failed because of some issues in this tree. Event 447 suggests that a B-tree consists a corrupt page link. The most common reasons for this problem to occur are:

• Hardware failure
• Antivirus software scanning of Exchange database directory (Antivirus's Exclisions for Exchange 2007)

Note: It is not safe to continue using such corrupted database as a bad page link indicates logical database corruption at ESE level. Also, you should ensure that no antivirus software is scanning the Exchange database files.

Solution:

• Check the Application log carefully for related events and patterns that may relate to this event. Check the System log carefully for related events and patterns including any errors related to hardware, drives, controllers, or the file system. If there are any such errors, replace the hardware, update the hardware system files, or repair the file system to prevent any future errors. Do this before proceeding to the next step
• If the Exchange store database is running, use ExMerge to merge your data to .pst files, delete the database, create a blank database, and then run ExMerge t databases to a blank database.
• If the database is running, you may also move all the mailboxes to another store, delete the affected database, create a new database, and then move all the mailboxes back.
• If the Exchange store database will not mount, the suggested remedy is to restore from online backup before the errors appear in the Application log.
• If the Exchange store database will not mount and there is no backup, the last resort is to repair the database by running eseutil /p and then repeatedly running isinteg -fix until there are no fixes reported. Finally, run ExMerge, create a blank store, and use ExMerge to move the data back in.

-----------------------begin code
$srv = Get-ExchangeServer |where {$_.IsMailboxServer -eq 'True'}


$output = @()
$dmtf = [System.Management.ManagementDateTimeconverter]
$Startdate = $dmtf::ToDmtfDateTime( (Get-Date).AddDays(-1).Date )
$free = @{Name="WhiteSpace(MB)";Expression={[int]$_.InsertionStrings[0]}}


foreach ($dbserver in $srv){


# Get the mailbox databases from the server
$mbdatabases = Get-MailboxDatabase -Server $dbserver.name | Sort-Object -Property Name


# Get the public folder databases from the server
$pfdatabases = Get-PublicFolderDatabase -Server $dbserver.name | Sort-Object -Property Name


# Create an array for the databases
$databases = @()


# Check if mailbox databases were found on the server
If ($mbdatabases) {
      # Loop through the databases
      ForEach ($mdb in $mbdatabases) {
            # Create an object to store information about the database
            $db = "" | Select-Object Name,Identity,EdbFilePath,DefragStart,DefragEnd,DefragDuration,DefragInvocations,DefragDays,DefragInterrupts,DefragError,DefragStillRunningSince,DefragStillRunningDays
           
            # Populate the object
            $db.Name = $mdb.Name.ToString()
            $db.Identity = $mdb.Identity.ToString()
            $db.EdbFilePath = $mdb.EdbFilePath.ToString()
           
            # Add this database to the array
            $databases = $databases + $db
      }
}


# Check if public folder databases were found on the server
If ($pfdatabases) {
      # Loop through the databases
      ForEach ($pfdb in $pfdatabases) {
            # Create an object to store information about the database
            $db = "" | Select-Object Name,Identity,EdbFilePath,DefragStart,DefragEnd, DefragDuration,DefragInvocations,DefragDays,DefragInterrupts,DefragError,DefragStillRunningSince,DefragStillRunningDays
           
            # Populate the object
            $db.Name = $pfdb.Name.ToString()
            $db.Identity = $pfdb.Identity.ToString()
            $db.EdbFilePath = $pfdb.EdbFilePath.ToString()
           
            # Add this database to the array
            $databases = $databases + $db
      }
}


# Retrieve the events from the local Application log, filter them for ESE messages
$logs = Get-WMIObject Win32_NTLogEvent -ComputerName $dbserver.name  -Filter "LogFile='Application' AND Timewritten>='$startdate' AND sourceName='ESE' AND CategoryString='Online Defragmentation'  "
 


# Loop through each of the databases and search the event logs for relevant messages
ForEach ($db in $databases) {


      # Create the search string to look for in the Message property of each log entry
      $s = "*" + $db.EdbFilePath + "*"


      # Search for an event 701 or 703, meaning that online defragmentation finished
      $end = $logs | where {
            $_.Message -like "$s" -and ($_.eventcode -eq 701 -or $_.eventcode -eq 703)
      } | select-object -First 1


      # Search for the first event 700 which preceeds the finished event
      $start = $logs | where {
            $_.Message -like "$s" -and $_.eventcode -eq 700 -and $_.Index -le $end.Index
      } | select-object -First 1
  $interr = $logs | where {
            $_.Message -like "$s" -and $_.eventcode -eq 704
      } | select-object -First 1
 $defError = $logs | where {
            $_.Message -like "$s" -and $_.eventcode -eq 705
      } | select-object -First 1

 $defStillRun = $logs | where {
            $_.Message -like "$s" -and $_.eventcode -eq 702
      } | select-object -First 1


      # Make sure we found both a start and an end message
      if ($start -and $end  ) {


            # Get the start and end times
  $st= $start.TimeGenerated
  $stY=$st.substring(0,4)
  $stM=$st.substring(4,2)
  $stD=$st.substring(6,2)
  $stH=$st.substring(8,2)
  $stMs=$st.substring(10,2)
  $et= $end.TimeGenerated
  $etY=$et.substring(0,4)
  $etM=$et.substring(4,2)
  $etD=$et.substring(6,2)
  $etH=$et.substring(8,2)
  $etMs=$et.substring(10,2)
  


           $db.DefragStart = $stD + "/" + $stM + "/" +  $stY + " " + $stH + ":"  + $stMs
            $db.DefragEnd = $etD  + "/" + $etM + "/" + $etY  + " " + $etH + ":" + $etMs


            # Parse the end event message for the number of seconds defragmentation ran for
            $end.Message -match "This pass started on .* and ran for a total of .* seconds" >$null
     #$db.DefragStart = $Matches[0].Split(" ")[4] + " restarted."
            $db.DefragDuration = $Matches[0].Split(" ")[11] + " seconds."
        
            # Parse the end event message for the number of invocations and days
            $end.Message -match "requiring .* invocations over .* days" > $null
            $db.DefragInvocations = $Matches[0].Split(" ")[1] + " time[s]."
            $db.DefragDays = $Matches[0].Split(" ")[4]


  
  #$interr.Message -match "was interrupted and terminated." >$null
  if ($interr) {
  $it= [string]$interr.TimeGenerated
  $itY=$it.substring(0,4)
  $itM=$it.substring(4,2)
  $itD=$it.substring(6,2)
  $itH=$it.substring(8,2)
  $itMs=$it.substring(10,2)
       $db.DefragInterrupts=$itD  + "/" + $itM + "/" + $itY  + " " + $itH + ":" + $itMs
     
  }
          } else {
            if ($defError -and $defStillRun) {


            $defError.Message -match "after encountering unexpected error .*" >$null
    
            $db.DefragError = "unexpected error :" + $Matches[0].Split(" ")[4]


     $defStillRun.Message -match "pass started on .* and has been running for .* days" >$null 
     $db.DefragStillRunningSince = $Matches[0].Split(" ")[3]
     $db.DefragStillRunningDays = $Matches[0].Split(" ")[9]


            }
           
      }
      # Add the data for this database to the output
      $output = $output + $db
}
 }
# Print the output
$output

------end code

Don't worry...be happy.

-Dario