In our Exchange 2010 org, we made a mistake when we've set it up - the CAS arrays were configured only after the mailbox databases were in place. Therefore, the Outlook client profiles were configured when the RpcClientAccesserver attribute stamped on each mailbox database was pointing to an actual CAS server. Now that the CAS arrays have been configured, an additional step must be taken - reconfiguring the client profiles so they're not using that original, explicit CAS. One solution to this, since we're at SP2 RU3 is to failover the DBs to an alternate site, and this will automatically reconfigure the profiles. What I'm really after is not really how to do this, but how to measure how many are currently affected and how many will still remain in this situation after the DBs will be up in the alternate datacenter for a specified duration of time (eg clients that are on holiday and whose profile won't be reconfigured since they'll be back after the DBs will be failed over to the original datacenter).
I've noticed that for an Outlook 2010 client, the first RPC bind for the MS Exchange Directory RFR interface will contain inside that packet the name of the server (inside the Kerberos ticket that's embedded there), as it's defined in the Outlook profile (those pointing to an explicit CAS will contain the name of that CAS, while the ones targeting the CAS array will contain that FQDN). Now this is a rather tricky way to get from this information (and how it should be gathered in an efficient manner - detecting the first RPC RFR bind for each client) to a final spreadsheet containing the client and its associated Exchange endpoint, as specified in its local profile. Is there a documented way to get this information, using a server-side method ?