Issues with Splunk App for Microsoft Exchange and MS Exchange 2010 SP2

Overview

The Splunk App for Microsoft Exchange is incompatible with Microsoft Exchange 2010 Service Pack 2 (SP2), owing to the fact that Microsoft removed Registry entries for PowerShell support in the SP2 update.

Important: This problem is not caused by the Splunk App for Microsoft Exchange in any way. It occurs because the SP2 update removes critical Registry entries and extensions for PowerShell during the update process. As such, the workaround described below is not supported by Splunk. Questions and concerns about the problem should be directed to Microsoft's support team.

You might experience the following symptoms with the Splunk App for Microsoft Exchange if you run MS Exchange 2010 SP2:

• Some Exchange servers might not be listed in the System overview.
• Exchange servers with the Mailbox Server role do not provide information about a user (for example, folder and/or mailbox information is missing).
• You might see the following in splunkd.log on the server that is collecting the logs:

WARNING: The following errors occurred when loading console 
C:\Program Files\Microsoft\Exchange Server\V14\bin\exshell.psc1: Cannot load 
Windows Powershell snap-in Microsoft.Exchange.Management.Powershell.E2010
because of the following error:
The Windows Powershell snap-in 'Microsoft.Exchange.Management.Powershell.E2010' is
not installed on this machine

Workaround

If you run Exchange Server 2010 Service Pack 1 or earlier in your environment and need full functionality for the Splunk App for Microsoft Exchange, then do not upgrade to SP2.

If you have already upgraded to SP2, then review the following article to work around the problem.

http://joetrombley.wordpress.com/2011/03/12/the-windows-powershell-snap-n-microsoft-exchange-management-powershell-e2010-is-not-installed-on-this-machine/

Once you have completed the workaround, confirm that the PowerShell script runs properly by running the following commands in a command prompt (not a PowerShell window):

cd "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-2010-MailboxStore
"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd exchangepowershell.cmd get-hoststats.ps1

Note: When you run the command, replace "TA-Exchange-2010-MailboxStore" with the TA that is installed on the Exchange host. If it is working then the script will emit an event and display it in white text. If it is not working then the script will display the error shown above in red and yellow text.