Category: Exchange

Exchange Online / Exchange Server On-Premise

March 2023 Exchange Server Security Updates

Yusuf Ustundag 2 Comments

Microsoft Exchange Servers security updates have been released for March 2023.

These updates are available for the following specific versions of Exchange Server:

Exchange Server 2013 CU23 SU21 (Microsoft Exchange Server 2013 will reach its end of support on April 11, 2023)
Exchange Server 2016 CU23 SU7
Exchange Server 2019 CU11 SU11 & CU12 SU7

The recommendation is to install these updates immediately to protect your environment.
In the scenario where you do a Cumulative Update(CU), you need to make security updates. Otherwise, remember that you have to do the Cumulative Update(CU) first and then the Security Update(SU).

Inventory your Exchange Servers to determine which updates –> “Exchange Server Health Checker”
Choose your current CU and your target CU to get directions –>  “Exchange Update Wizard”
If you encounter errors during or after installation of Exchange Server –> “Exchange Setup Assist”

Note: Don't double-click the 'MSP file' to run it. Run Command Prompt (not Powershell) as an Administrator.

Issues resolved with this update:

  • EWS web application pool stops after the February 2023 Security Update is installed .
    ⇒If you have applied a workaround for this issue, you should roll it back after the March security update.
  • Exchange Server 2016 or 2019 who have non-default applications installed through ECP add-ins, the ECP add-ins page might be broken after the February 2023 Security Update is installed
    ⇒The issue is expected to be resolved with the March security update.
  • The Get-App and GetAppManifests applications fail and return an exception, “MSExchangeServicesAppPool” application pool to repeat in the same order after the February 2023 Security Update is installed .
    ⇒The issue has been resolved with the March security update.
  • Exchange Toolbox and Queue Viewer fails after Certificate Signing of PowerShell Serialization Payload is enabled after the Janurary 2023 or the February 2023 Security Update is installed.
    ⇒The issue has been resolved with the March security update for servers running the Mailbox Role, but this issue persists on other servers with management console installed.

Have a nice day!

February 2023 Exchange Server Security Updates

Yusuf Ustundag 4 Comments

Microsoft Exchange Servers security updates have been released for February 2023.

These updates are available for the following specific versions of Exchange Server:

Exchange Server 2013 CU23 SU20 (Microsoft Exchange Server 2013 will reach its end of support on April 11, 2023)
Exchange Server 2016 CU23 SU6
Exchange Server 2019 CU11 SU10 & CU12 SU6

The recommendation is to install these updates immediately to protect your environment.
In the scenario where you do a Cumulative Update(CU), you need to make security updates. Otherwise, remember that you have to do the Cumulative Update(CU) first and then the Security Update(SU).

Inventory your Exchange Servers to determine which updates –> “Exchange Server Health Checker”
Choose your current CU and your target CU to get directions –>  “Exchange Update Wizard”
If you encounter errors during or after installation of Exchange Server –> “Exchange Setup Assist”

 

Note: Don't double-click the 'MSP file' to run it. Run Command Prompt (not Powershell) as an Administrator.

 

Have a nice day!

How to Fix TLS “SchUseStrongCryptoValue: Null

Yusuf Ustundag 2 Comments

If you are getting “StrongCrypto” error as below after configuring TLS on your Microsoft Exchange Servers;

v4.0.30319 SchUseStrongCryptoValue: NULL --- Error: Value should be defined in registry for consistent results.
v4.0.30319 WowSchUseStrongCryptoValue: NULL --- Error: Value should be defined in registry for consistent results.

The values you need to define for “StrongCrypto” are as follows:

Set “Strong Cryptography” on 32-bit .Net Framework

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord

 

Set “Strong Cryptography” on 64-bit .Net Framework

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord

 

Have a nice day!

Exchange Server 2013 End of Support Coming Soon – News !

Yusuf Ustundag 6 Comments

Microsoft Exchange Server 2013 will reach its end of support on April 11, 2023.

This means that Microsoft will no longer provide security updates, technical assistance, or online technical content updates for the product. It is highly recommended that organizations using Exchange Server 2013 upgrade to a newer version of Exchange.

After that date, Microsoft will no longer provide:

  • Security fixes for vulnerabilities that are discovered and that may make the server vulnerable to security breaches
  • Bug fixes for issues that are discovered and that may impact the stability and usability of the server
  • Technical support for problems that may occur
  • Time zone updates
  • Even if the product continues to work after this date, It’s recommended to start “Exchange Server 2013” to “Exchange Online” or “Exchange Server 2019” migration as soon as possible.

 

 

Have a nice day!

 

January 2023 Exchange Server Security Updates

Yusuf Ustundag 4 Comments

Microsoft Exchange Servers security updates have been released for January 2023.

These updates are available for the following specific versions of Exchange Server:

Exchange Server 2013 CU23 SU19
Exchange Server 2016 CU23 SU5
Exchange Server 2019 CU11 SU9 & CU12 SU5

The recommendation is to install these updates immediately to protect your environment.
In the scenario where you do a Cumulative Update(CU), you need to make security updates. Otherwise, remember that you have to do the Cumulative Update(CU) first and then the Security Update(SU).

Inventory your Exchange Servers to determine which updates –> “Exchange Server Health Checker”
Choose your current CU and your target CU to get directions –>  “Exchange Update Wizard”
If you encounter errors during or after installation of Exchange Server –> “Exchange Setup Assist”

Recommended Action :

  • Enable certificate signing of Powershell serialization payload
  • To defend Exchange Servers against attacks on serialized data, added certificate-based signing of PowerShell serialization payloads.
  • If you have a server running Microsoft Exchange Server 2013 in your environment, we recommend that you don’t turn on serialization payload signing for now.
  • In the first stage of rollout, this new feature must be manually enabled by an Exchange Server admin due to feature dependencies.
  • You can use to validate/create the required auth certificate

 

Note: Don't double-click the 'MSP file' to run it. Run Command Prompt (not Powershell) as an Administrator.

 

Have a nice day!

Basic Authentication Deprecation in Exchange Online – News !

Yusuf Ustundag 6 Comments

As you know, the “Basic Authentication” configuration was turned off last month.
Organizations using Exchange Online are now protected from the vulnerabilities of legacy authentication.

However, this closure process will continue On December 31, 2022, with exemptions.

Microsoft says ;
Once Basic auth for Outlook, Exchange ActiveSync and Exchange Web Services has been permanently disabled in your tenant, there’s really no reason to keep Autodiscover enabled for Basic auth. So, we’re turning off Autodiscover next.

For more details ; Basic Authentication Deprecation in Exchange Online – What’s Next

Have a nice day !

October 2022 Exchange Server Security Updates

Yusuf Ustundag Leave a comment

Microsoft Exchange Servers security updates have been released for October 2022.

These updates are available for the following specific versions of Exchange Server:

Exchange Server 2013 CU23
Exchange Server 2016 CU22 and CU23
Exchange Server 2019 CU11 and CU12

The recommendation is to install these updates immediately to protect your environment.
In the scenario where you do a Cumulative Update(CU), you need to make security updates. Otherwise, remember that you have to do the Cumulative Update(CU) first and then the Security Update(SU).

The following update paths are available:

 

These vulnerabilities only affect Exchange Server.
Exchange Online customers are already protected from the vulnerabilities addressed.

Note: Don't double-click the 'MSP file' to run it. Run Command Prompt (not Powershell) as an Administrator.

 

Additional Action Require!

As you know, we were doing /PrepareSchema and /PrepareAD operations before CU operations.
There is a new difference in the updates released in May.

The following actions should be taken in addition to the application of May 2022 security updates:

After doing cumulative update and security update then run the following Command Prompt command once using Setup.exe in your Exchange Server installation path "\Program Files\Microsoft\Exchange Server\v15\Bin"

"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /P"

Microsoft says that the step is necessary “because of additional security hardening work for CVE-2022-21978,” which is one of the vulnerabilities addressed by the updates.

When running a Database Availability Group, do not forget to put the Exchange Server Cluster(DAG) in maintenance mode.

 

Have a nice day!

Exchange Server 2019 ECP/OWA Not Working

Yusuf Ustundag 2 Comments

Study this article if you can’t access Exchange Server 2019 ECP(Exchange Control Panel) or OWA(Outlook Web Access).

In your Exchange Server Infrastructure, if your ECP/OWA console doesn’t open and you encounter EventID:1309 in the Application Log, the root cause of the problem is the missing SharedWebConfig file.
You can see this in the “Application Virtual Path” – “Application Path” in Event ID 1309.

ECP Not Working

To resolve this issue follow these steps:

  • Access the server with the problem.
  • Generate the missing file:
    • Run cd %ExchangeInstallPath%\bin to change the current directory to the bin folder that’s under the Exchange installation path.
    • Use the DependentAssemblyGenerator.exe tool
    • If the file is missing from C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy, run the following command:
      • DependentAssemblyGenerator.exe -exchangePath "%ExchangeInstallPath%\bin" -exchangePath "%ExchangeInstallPath%\FrontEnd\HttpProxy" -configFile "%ExchangeInstallPath%\FrontEnd\HttpProxy\SharedWebConfig.config"

 

  • IISReset

 

You can now access ECP!

P.S: If you encounter EventID:1309, carefully check its contents.
Because in the problem I mentioned above, the issue was related to the ECP.
EventID contents; “Application Virtual Path: /ecp” and “Application Path: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp“

If these contents are as follows;

  • Application Virtual Path: /owa
  • Application Path: C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\

To resolve this issue follow these steps:

  • Access the server with the problem.
  • Generate the missing file:
    • Run cd %ExchangeInstallPath%\bin to change the current directory to the bin folder that’s under the Exchange installation path.
    • Use the DependentAssemblyGenerator.exe tool
    • If the file is missing from C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess, run the following command:
      • DependentAssemblyGenerator.exe -exchangePath "%ExchangeInstallPath%\bin" -exchangePath "%ExchangeInstallPath%\ClientAccess" -configFile "%ExchangeInstallPath%\ClientAccess\SharedWebConfig.config"
  • IISReset

 

You can now access OWA!

Have a nice day !

Microsoft Exchange Community (MEC) Technical Airlift 2022

Yusuf Ustundag 2 Comments

MEC is Back !

What is MEC ?

MEC has been known as the Microsoft Exchange Conference but this year it was renamed the Microsoft Exchange Community. As the name suggests, it is a Microsoft Exchange Family specific event. MEC features experts from Microsoft and elsewhere talking about Exchange Online, Exchange Hybrid, and Exchange Server.

The first MEC was held in San Diego, California in 1997.
After San Diego, in Boston (1998), Atlanta, Hamburg, and Tokyo (1999), Dallas, Singapore, Nice, and Tokyo (2000), Orlando and Nice (2001), and Anaheim (2002).

This is a free, digital event for IT professionals who work with Exchange Online and/or Exchange Server day-to-day, and ISVs and developers who make solutions that integrate with Exchange, which will take place Sept 13-14, 2022!

The Exchange Online and Exchange Server engineering teams have a lot of great content for customers and partners.

Register now for this free digital event to:

Exchange Server Roadmap

Exchange Server Feature Review

Delighting Exchange Online Admins

Expanding Usage and Security of Email in Exchange Online

Exchange Online Transport Future Initiatives: Bulk Mail and Exchange Transport Rules

Basic Auth Deprecation in Exchange Online

Exchange Online Support for Continuous Access Evaluation

Customer Key in Exchange Online

Prepare yourself for two days jam-packed with networking, unparalleled access to Exchange engineers and MVPs and, of course, the most in-depth information on Exchange you’ll find anywhere.

Thanks for bringing these MEC back !

How to Fix Exchange Server “421 4.3.2 Service not available”

Yusuf Ustundag 2 Comments

When I examined the receive connector logs to identify the problem with the mail traffic I was experiencing on one of my Exchange servers, I saw that the error “421 4.3.2 Service not available” was constantly repeated.

When I followed the mail flow in the log, I observed that the steps continued successfully, but at the last stage it gave the error “421 4.3.2 Service not available“.

auth login,
334 authentication response,
SMTPSubmit SMTAccept,
235 2.7.0 Authentication Successful,
Mail From : <…@…>,
421 4.3.2 Service not available,
Remote(SocketError)

I checked the ServerComponentState of the server, and saw that the HubTransport was Draining.

Get-ServerComponentState (hostname)

To fix this situation, we need to use the following command.

Set-ServerComponentState ExchServerName -Component HubTransport -State Active -Requester Maintenance

Check again Get-ServerComponentState (hostname)

Have a nice day !