The way native Microsoft technologies (i.e. Explorer, Exchange System Manager, etc.) traverse Firewalls, would be similar to the way MessageStats would communicate.
Also confirm that the Firewall is allowing multiple ports to be open at a given time. Sometimes there are limits on firewalls to only allow a couple ports to be open at one time.
The following ports need to be opened to allow for dynamic RPC communication:
To access file shares to read and copy Message tracking logs the following Ports are required for SMB:
Further Communication from MessageStats to retrieve Active Directory Information, and for name resolution the following ports will need to be open to the appropriate Servers:
Ports required for Remote Powershell:
Note: Host Headers defined in IIS can restrict access to IIS and any virtual directories.
According to Microsoft KB 929851 (http://support.microsoft.com/kb/929851), installing Microsoft Exchange on a Windows 2008 computer can expand the range of dynamic RPC TCP/UDP ports from the range 49,152 – 65,535 to the range 1,024 – 60,000. This greatly increases the range of possible dynamic ports used by the WMI and MAPI access that MessageStats requires to the Exchange CAS and mailbox servers.
If this is not acceptable there are ways of configuring Exchange to use static ports:
Here is how to configure WMI and the MAPI interface to the Microsoft Exchange Information Store service to use fixed ports:
WMI, on Windows Server 2008 and later, can be configured to use a fixed port by opening a command prompt and typing
winmgmt /standalonehost
and restarting the Windows Management Instrumentation service. That will configure WMI to use port 24158.
One can change that port 24158 to a different port by editing the properties of DCOM object "Windows Management and Instrumentation" in
Administrative Tools -> Component Services -> Computer -> My Computer -> DCOM Config
The fixed port for WMI is in the properties of the "Connection-oriented TCP/IP" endpoint listed in Endpoints property page of the DCOM object.
Subsequently that port (either 24158 or the one set in the DCOM settings would also need to be opened in the Firewall).
MAPI interface to Microsoft Exchange Information Store service on Exchange mailbox servers can be configured to use a fixed port.
According to Microsoft KB article 270836, the DWORD value "TCP/IP Port" under registry key
HKLM\SYSTEM\CurrentControlSet\services\MSExchangeIS\ParametersSystem
specifies the fixed port for the service.
The KB article was written for Exchange 2000 and Exchange 2003. However we were able to confirm in our lab that information about that particular key also applies to Exchange 2010.
Additionally, some more recent "intelligent" firewalls are able to handle MAPI or WMI traffic and open ports dynamically as and when requested. This however would depend on the particular feature to exist on the firewall.
