Exchange Server 2010 : Managing User Accounts and Mail Features (part 1) - Accessing and Using the Exchange Control Panel

The Exchange Control Panel (ECP) is a Web application running on a Client Access server providing services for the Exchange organization. This application is installed automatically when you install a Client Access server. To perform Exchange management from just about anywhere, you simply need to enter the Uniform Resource Locator (URL) path for the application in your browser's Address field. You can then access the Exchange Control Panel. By default, the Exchange Control Panel URL is https://yourserver.yourdomain.com/ecp.

The Client Access server to which you connect processes your remote actions via the ECP application running on the default Web site. The physical directory for this application is %ExchangeInstallPath%\ClientAccess\Ecp. This application runs in the context of an application pool named MSExchangeECPAppPool. In the %ExchangeInstallPath%\ClientAccess\Ecp directory on your server, you'll find a web.config file that defines the settings for the ECP application.

When you install an Exchange server, the setup process creates a self-signed security certificate. Because this default certificate is not issued by a trusted authority, you see a related error message whenever you use HTTPS to access services hosted by your Client Access servers, including the Exchange Control Panel, the PowerShell application, and Microsoft Outlook Web App.

The best way to eliminate this error message is to install a certificate from a trusted authority on your Client Access servers. If you organization has a certification authority (CA), have your security administrator issue a certificate. Otherwise, you can purchase a certificate from a trusted third-party authority. Web browsers should already be configured to trust certificates issued by your organization's CA or by a trusted third-party authority. Typically, browsers need additional configuration only when you use your own CA with non-domain-joined machines.

In Exchange Management Console, you can view, install, and manage certificates by selecting the Server Configuration node in the left pane and then clicking the server you want to work with in the main pane. Certificates available on the server are listed in the lower pane. If you right-click in the lower pane, you can choose New Exchange Certificate to create a new certificate request, or choose Import Exchange Certificate to import a certificate issued by a CA from a file. After you import or create a certificate, right-click the certificate, and then select Assign Services To Certificate to permit the certificate to be used with designated Exchange services.

The services a certificate can be used with include Internet Message Access Protocol (IMAP), Post Office Protocol (POP), SMTP, Internet Information Services (IIS), and Unified Messaging (UM). The default self-signed certificate is assigned services automatically during setup based on the roles installed on the Exchange server.

You access the Exchange Control Panel by following these steps:

In your browser, you use the Select What To Manage list to choose whether you want to manage the Exchange organization on your mailbox or another user's mailbox. If you choose your mailbox, you are redirected to the virtual directory for Outlook Web App. When you are managing your organization, you have several management categories available, including Users & Groups and Reporting. When you are managing your organization, you can switch between these management categories by clicking the links provided in the left pane.

When Users & Groups is selected in the left pane, the Mailboxes view is displayed by default. As shown in Figure 1 the Mailboxes view lists mail-enabled user accounts according to their display name and e-mail address. While working with this view, you can do the following:

By clicking Users & Groups and then clicking External Contacts, you can display mail-enabled contacts in the organization, as shown in Figure 2. The External Contacts view lists mail-enabled contacts according to their display name and e-mail address. While working with this view, you can do the following:

By clicking Users & Groups and then clicking Groups, you can display distribution groups in the organization, as shown in Figure 3. The Groups view lists distribution groups according to their display name and e-mail address. While working with this view, you can do the following:

You can configure the Exchange Control Panel for single-server and multiserver environments. In a single-server environment, you use one Client Access server for all your remote management needs. In a multiple-server environment, you can instruct administrators to use different URLs to access different Client Access servers, or you can use Client Access arrays with multiple, load-balanced servers and give all administrators the same access URL.

You can manage the Exchange Control Panel application using Internet Information Services (IIS) Manager or the Exchange Management Shell. The related commands for the Exchange Management Shell are as follows:

At the Exchange Management Shell prompt, you can confirm the location of the Exchange Control Panel application by typing get-ecpvirtualdirectory .

Get-ECPVirtualDirectory lists the name of the application, the associated Web site, and the server on which the application is running, as shown in the following example:

Name                             Server
-------                          -------
ecp (Default Web Site)          CorpServer45

In this example, a standard configuration is being used on which the application named ECP is running on the Default Web Site on CorpServer45. You can use Set-ECPVirtualDirectory to specify the internal and external URL to use as well as the permitted authentication types. Authentication types you can enable or disable include basic authentication, Windows authentication, and Live ID basic authentication. You can use New-ECPVirtualDirectory to create an ECP application on the Web server providing services for Exchange and Remove-ECPVirtualDirectory to remove an ECP application.