About Michel de Rooij

I'm a Microsoft Office Apps and Services MVP, with focus on Exchange Server, Office 365 and with a PowerShell affection. I'm is a consultant, publisher of EighTwOne, published author, and speaker. You can find me on Twitter, LinkedIn, Facebook.

Security Updates Exchange 2016 & 2019 (Sep2019)

Posted on September 13, 2019 by Michel de Rooij

Today, Microsoft published security fixes for Exchange Server 2016 and 2019. These fixes address the following vulnerabilities:

CVE-2019-1233: Microsoft Exchange Denial of Service Vulnerability
CVE-2019-1266: Microsoft Exchange Spoofing Vulnerability

The CVE documents contain more details on the vulnerabilities. These exploits can be fixed by single security updates; you can download them here:

Version	Links	Build	KB
2019 CU2	Download	15.2.397.6	KB4515832
2019 CU1	Download	15.2.330.10	KB4515832
2016 CU13	Download	15.1.1779.5	KB4515832
2016 CU12	Download	15.1.1713.9	KB4515832

Note: KB4515832 supersedes KB4509409 and KB4509408.

Be advised that these Security Updates are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the same update for Exchange 2016 CU13 to Exchange 2016 CU12. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4515832-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Teams Mobile & Account Switching

Posted on August 3, 2019 by Michel de Rooij

Update: Added note about Intune App Protection policies.

One of the most requested features for Microsoft Teams on UserVoice is the ability to switch accounts. When you are working in consulting like me, chances are you need to switch accounts very often. This means you need to log in and out of every account to interact with their or guest access teams. Meanwhile your company might also be sending you messages, so you have to log in there as well. Now, on desktops one can leverage browsers’ private mode to accomplish simultaneous logons, but for mobile clients such alternative does not exist. All in all, this situation is far from ideal.

Now, the mobile workforce can rejoice, as iOS and Android received a client update (1.0.8.0 on iOS, don’t have Android device at hand currently). The updated client allows them to add more than one account, and quickly (and I mean quickly) switch between these accounts and guest accounts.

To add an account, open the menu (), open Settings and select Add account at the bottom to add an existing account to your configuration.

After you finish adding accounts, you can switch between accounts by opening the menu, and selecting one of the accounts or guest access which are shown at the bottom, grouped with the account they belong to. Example is shown right (yes, this is dark mode).

To remove an account, activate the account (by selecting it or one guest access), open the menu, and select Settings and Sign Out.

Another benefit is when your tenant is Azure Information Protection enabled. After logging in, you get prompted and need to restart the Teams app. That annoyance doesn’t happen when switching accounts, as the app remains logged in when switching.

Note that at the moment, badges are only updated within the same account and guest access.

Note that you cannot configure more than one account which has Intune App Protection configured. If you already have an IAP-enabled account and another gets IAP enabled, Teams requires you to pick one of the IAP accounts to be removed from the Teams app configuration.

Now, the only thing left to do is hope this functionality will arrive for Teams Desktop soon.

Security Updates Exchange 2010-2019

Posted on July 11, 2019 by Michel de Rooij

A quick blog that rather silently, Microsoft published hotfixes for a number of products few days ago, including Exchange Server 2010 up to Exchange Server 2019. These fixes address the following vulnerabilities:

CVE-2019-1084: Microsoft Exchange Information Disclosure Vulnerability, allowing non-printable characters to be added to Display Names.
CVE-2019-1136: Microsoft Exchange Server Elevation of Privilege Vulnerability, allowing NTLM MITM elevation permissions or impersonation through Exchange Web Services. This sounds like a variation on the NTLM MITM exploit which was fixed earlier this year with the February update cycle.
CVE-2019-1137: Microsoft Exchange Server Spoofing Vulnerability, allowing for cross-site scripting (XSS).

The CVE documents contain more details on the vulnerabilities. These exploits can be fixed by single security updates; you can download them here:

Version	CVE 2019 1084	CVE 2019 1136	CVE 2019 1137	Download	Build	KB
2019 CU2	X		X	Link	15.2.397.5	4509408
2019 CU1	X		X	Link	15.2.330.9	4509408
2016 CU13	X	X	X	Link	15.1.1779.4	4509409
2016 CU12	X	X	X	Link	15.1.1713.8	4509409
2013 CU23	X	X	X	Link	15.0.1497.3	4509409
2010 SP3 RU29	X	X		Link	14.3.468.0	4509410

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU12 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4503027-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Exchange Hybrid Agent GA

Posted on July 4, 2019 by Michel de Rooij

In February, Microsoft released the initial public preview version of the Hybrid Agent. The purpose of the Hybrid Agent, also branded as the “Exchange Modern Hybrid Topology”, is to simplify the process of setting up and deploying Microsoft Exchange Hybrid for Exchange 2010 and later deployments, where full “classic” Exchange Hybrid is not an option.

It can also address scenarios where deploying the Hybrid Agent would satisfy organizational migration requirements. For example, moving mailboxes between Exchange Online and Exchange on-premises while providing rich-coexistence features, but without requiring (re)configuration of the publishing of Exchange services. Other functionality the Hybrid Agent doesn’t offer is mail transport. Future builds of the Hybrid Agent might introduce cross-premises functionality, such as Send As delegations as demonstrated at Microsoft Ignite last year.

This week, the Hybrid Agent Public reached General Availability status. In the following article for ENow, I discuss the major changes in the agent since the initial Preview release.

Read the full article on the ENow Software blog.

MVP’s around the World (2019)

Posted on July 3, 2019 by Michel de Rooij

Update: Updated statistics based on award categories (not people) due to the number of multi-category awardees.

In previous years, I performed some comparisons on the MVP population after every award cycle. So, time to get some fresh statistics after July 2019 award cycle.

For comparison, I had a look at the public MVP statistics of July 3rd, 2018 against those of July 3rd, 2019, as the public MVP site was closed the first two days. From the numbers, it is clear that this cycle the number of MVPs went down again, from 3.030 last year, to 2.634 now (-13%).

The following table contains the changes per award category from July 2018 to
July 2019:

Competence	Jul-18	Jul-19	Change
AI	58	84	45%
Business Applications	164	166	0%
Cloud and Datacenter Management	303	232	-23%
Data Platform	369	332	-10%
Enterprise Mobility	122	106	-13%
Microsoft Azure	444	409	-8%
Office Development	33	47	42%
Office Apps & Services	606	491	-19%
Developer Technologies	781	644	-17%
Windows and Devices for IT	87	57	-34%
Windows Development	186	119	-37%
Total MVPs	3066	2634	-14%

Few notes:

The total number of MVP’s doesn’t equal the total number of awards, as people can be awarded in more than one category; there are 52 MVP’s with multiple award categories (one even in 3 categories).
Former single product categories, such as Access or OneNote, were moved under the Office Apps & Services category (which was rebranded from Office Servers & Services). Those numbers are merged for the 2018 column.
When comparing to earlier years, the award categories were restructured in 2017, e.g. Visual Studio and Development Technologies became Developer Technologies.

When zooming in on the Office Apps & Services category, the awards per country are shown below. Be advised that 26 are anonymous MVP’s or have profiles without location.

Country	Jul’18	Jul’19	Country	Jul’18	Jul’19	Country	Jul’18	Jul’19
ARE	1	2	GBR	23	28	POL	2	4
AUS	17	20	HRV	5	4	PRK	6	12
AUT	2	3	HUN	2	2	PRT	3	2
BEL	8	8	IND	12	13	RUS	5	8
BGR	1	2	IRL	1	1	SAU	1	1
BIH	1	1	ISR		1	SGP	3	3
BRA	2	10	ITA	8	6	SLV		1
CAN	28	31	JOR	1	1	SRB	1	1
CHE	4	2	JPN	11	22	SVK	1	1
CHN	14	16	LKA	4	1	SVN	1	2
COL	2	4	MEX	2	5	SWE	6	5
CRI		1	MKD	2	2	THA	1	3
CZE	3	2	MYS	1	1	TUR	4	2
DEU	17	25	NGA	1	1	TWN		3
DNK	2	6	NLD	13	21	UKR	1	2
EGY	1	1	NOR	5	6	URY	1	1
ESP	5	8	NPL	1	1	USA	89	120
FIN	2	3	NZL	4	6	ZAF	4	5
FRA	16	20	PAK	2	2

The countries Argentina, Chile, Latvia, Peru, Romania and Greece are no longer represented in the Office Apps & Services category, while Costa Rica, Israel, Taiwan and El Salvador are new to the table.

Month	Oct 2016	Jan 2017	Jun 2017	Jul 2017	Jun 2018	Jul 2018	Mar 2019	Jul 2019
OSS	538	505 (-7%)	532 (+5%)	449 (-16%)	490 (+2%)	383 (-21%)	622 (+62%)	491 (-22%)
Total	N/A	N/A	4134	3490 (-16%)	3815 (+2%)	3030 (-21%)	3205 (+6%)	2635 (-18%)

Above are the number of Office Apps & Services and total number of MVP’s over the last years. Do note that for March and July 2019 the former product categories are included in the Office Apps & Services category, hence why I included March to have a sense of the changes in the July cycle.

If you have questions or comments, please send them in the comments below.

2019-2020 Microsoft MVP Award

Posted on July 1, 2019 by Michel de Rooij

With great honor and joy I can announce that I have been awarded the Microsoft Most Valuable Professional Award in the category Office Apps & Services.

Microsoft reports there are around 2.000 MVP awardees worldwide. Those awards are given to individuals in recognition of their contributions to the community, such as writing, speaking engagements, supporting people, code contributions or product feedback.

This is my 6th consecutive year as an MVP. Lots of kudos to the MVP leads and other involved in the monstrous task of reviewing and evaluating thousands of contributions for this award cycle.

Many thanks to the community, readers, followers, fellow MVP’s and friends, peers, product groups and other Microsoft employees for their encouragement, inspiration and support over all those years.

My MVP profile can be found here.

Exchange Updates – June 2019

Posted on June 18, 2019 by Michel de Rooij

Today, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019, Exchange 2016 and Exchange 2013.

The KB articles that describe the fixes in each release, and product downloads are available as follows:

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU2	15.2.397.3	KB4488401	VLSC		N
Exchange 2016 CU13	15.1.1779.2	KB4488406	Download	UMLP	N
Exchange 2013 CU23	15.0.1497.2	KB4489622	Download	UMLP	N

These updates contain the following important changes and notes (more information in the original article):

Reduced required permissions of Exchange in Active Directory.
Introduction of support for .NET Framework 4.8, with 4.7.2 becoming the minimum required version.
Introduction of Organization-level Authentication Policies.
Upcoming support for Modern Authentication for Exchange Hybrid deployments.
Controlled Public Folder visibility for Exchange 2019 & 2016.

Exchange 2019 CU2 fixes:

4502134 Can’t get all the emails when searching mailbox by using an end date that’s different from today in Exchange Server 2019
4502135 Correct the error message that you receive when installing Exchange Server 2019 in an organization that has Exchange Server 2010 installed
4502154 Providing information to administrators when auto forward limit is reached in Exchange Server 2019 and 2016
4502155 “The primary SMTP address must be specified when referencing a mailbox” error when you use impersonation in Exchange Server 2019 and 2016
4502156 Audit logs aren’t updated when “-WhatIf” is used as $false in the command in Exchange Server 2019 and 2016
4502157 The Find command not returning the HasAttachments element in Exchange Server 2019 and 2016
4502158 SyncFolderItems contains duplicated ReadFlagChange items in Exchange Server 2019 and 2016
4502131 “TLS negotiation failed with error UnknownCredentials” error after you update TLSCertificateName on Office 365 send connector in Exchange Server 2019 hybrid environment
4502132 Can’t reply to old emails after migration even though old legacyExchangeDN is set to migrated mailbox in Exchange Server 2019 and 2016
4502136 The response of FETCH (BODYSTRUCTURE) command of IMAP violates RFC 3501 in Exchange Server 2019 and 2016
4502140 Can’t preview an eDiscovery search when there are multiple domains in Exchange Server 2019 and 2016
4502141 Appointment that’s created by responding to an email message doesn’t show in any Outlook calendar views in Exchange Server 2019 and Exchange Server 2016
4502133 Can’t use Outlook on the web to reply a partner email through mutual TLS in Exchange Server 2019 and 2016
4488396 Can’t search any results in manually added shared mailbox in Outlook in Exchange Server 2019 and 2016
4488078 Public folder contact lists don’t show contact’s profile picture in Outlook on the web in Exchange Server 2019 and 2016
4499503 Heavy organizational forms traffic because of materialized restriction when organization forms library has more than 500 items in Exchange Server 2019 and 2016
4503027 Description of the security update for Microsoft Exchange Server 2019 and 2016: June 11, 2019

Exchange 2016 CU13 fixes:

4502154 Providing information to administrators when auto forward limit is reached in Exchange Server 2016
4502155 “The primary SMTP address must be specified when referencing a mailbox” error when using impersonation in Exchange Server 2016
4502156 Audit logs aren’t updated when “-WhatIf” is used as $false in the command in Exchange Server 2016
4502157 The Find command not returning the HasAttachments element in Exchange Server 2016
4502158 SyncFolderItems contains duplicated ReadFlagChange items in Exchange Server 2016
4502131 “TLS negotiation failed with error UnknownCredentials” error after updating TLSCertificateName on Office 365 send connector in Exchange Server 2016 hybrid environment
4502132 Can’t reply to old emails after migration even though old legacyExchangeDN is set to migrated mailbox in Exchange Server 2016
4502136 The response of FETCH (BODYSTRUCTURE) command of IMAP violates RFC 3501 in Exchange Server 2016
4502140 Can’t preview an eDiscovery search when there are multiple domains in Exchange Server 2016
4502141 Appointment that’s created by responding to an email message doesn’t show in any of Outlook calendar views in Exchange Server 2016
4502133 Can’t use Outlook on the web to reply a partner email through mutual TLS in Exchange Server 2016
4488396 Can’t search any results in manually added shared mailbox in Outlook in Exchange Server 2016
4488078 Public folder contact lists don’t show contact’s profile picture in Outlook on the web in Exchange Server 2016
4499503 Heavy organizational forms traffic due to materialized restriction when organization forms library has more than 500 items in Exchange Server 2016
4503027 Description of the security update for Microsoft Exchange Server 2019 and 2016: June 11, 2019

Exchange 2013 CU23 fixes:

4502131 “TLS negotiation failed with error UnknownCredentials” error after updating TLSCertificateName on Office 365 send connector in Exchange Server 2013 hybrid environment
4503028 Description of the security update for Microsoft Exchange Server 2013 and 2010: June 11, 2019

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update. However, due to changes in the permissions architecture, you need to run setup /PrepareAD to implement these changes as well as apply any RBAC changes, before deploying or updating Exchange servers.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

ADV190018: Security Updates Exchange 2013-2019 & 2010

Posted on June 12, 2019 by Michel de Rooij

Updated Jun13: Corrected Ex2010SP3RU28 link

A quick note that an update was released for current Exchange versions as well as Exchange 2010 related to the following advisory:

ADV190018 Microsoft Exchange Server Defense in Depth Update

Unfortunately – or perhaps understandably – the advisory doesn’t present any more details than, ‘”Microsoft has released an update for Microsoft Exchange Server that provides enhanced security as a defense in depth measure.”.

You can download the security updates here:

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Turla LightNeuron: Facts from Fud

Posted on May 9, 2019 by Michel de Rooij

fud Yesterday, an article was published on ZDNet, where the author claims “Russian Cyberspies” are exploiting a backdoor in Exchange. The article is based on a report of Slovakian-based ESET Research, which is no stranger on the anti-virus/malware market. The report, titled “Turla LightNeuron, One email away from remote code execution”, claims the group – Turla – leverages LightNeuron to exploit Exchange Server for malicious usage, using instructions hidden in image attachments delivered through e-mail to control the backdoor. The news was quickly picked up by other media, and it didn’t take long for customers to start asking questions on the topic. Time for some fact checking.

Exchange Backdoor
The article claims the group using ‘one of the most complex backdoors’ ever spotted on an email server. While complexity is relative, it could very well be that this backdoor was indeed discovered on some improperly managed Exchange Servers in the wild.

However, the exploit leverages an installed malicious MTA (Message Transfer Agent, or Transport Agents in Exchange). An MTA is software handling incoming and outgoing e-mail messages using the Simple Mail Transfer Protocol (SMTP). A lot of legitimate 3rd party MTAs exist for Exchange Server, for example to add disclaimers to messages or for message hygiene purposes.

This LightNeuron is the actual backdoor, so there is no backdoor in Exchange. A totally different conclusion than one could read from the article’s title, and a totally different attack vector:

How did this Transport Agent get installed on Exchange server in the first place?
How was it possible to store the DLLs required by the Transport Agents, and which are likely to get caught by AV products, on Exchange Server?
How was it possible to perform these tasks using administrative access, which is required to install such components in the first place?

The ESET report mentions this requirement; the ZDNET article and all other media simply omit this. Note that developing your own Transport Agent isn’t rocket science; Microsoft provides instructions on how to write your own custom Transport Agent for Exchange Server on-premises.

Hidden Instructions
Sending instructions hidden in images isn’t new. Steganography became famous to public in the last decade, where Osama Bin Laden was claimed to be embedding instructions for his followers in images posted on the internet. Little messages can also easily be embedded in the structure of an image file format, with places to store custom data or instructions.

Remote Control
As the installed malicious MTA runs under administrative permissions, it is no surprise that whoever (remotely) controls the MTA, in principle controls the Exchange Server as it runs in the context of the Exchange Trusted Subsystem.

Remote Controlled malicious code is not new; it is what drives zombie computers, and it is what made some prank tools popular in the mid-90’s, when you could prank your coworkers by opening their CD trays (anyone remember those?).

Impact
ESET claims that Turla has been leveraging LightNeuron for nearly 5 years, “which shows the tool’s advanced capabilities, being able to avoid detection for so many years”. In my opinion, this shows how many organizations have more bigger issues, such as an improperly managed mail environment.

SendMail
The report also mentions LightNeuron being ported to *NIX as well, e.g. SendMail. This shows perfectly that any communications system, when compromised, can be used for man-in-the-middle attacks. However, mentioning leaks in SendMail might not drive traffic as much as mentioning ‘Backdoor in Exchange’ for media, which is a driver when you depend on advertisements.

Detection
The article claims the hidden messages make LightNeuron hard to detect. Of course, this depends. The backdoor requires installation and presence of two malicious DLL files. Any respectable AV product should catch those. Windows Server 2016+ comes with Windows Defender, which according to its encyclopaedia should be able to detect Turla variants.

Removal
Finally, the article claims that, “removing this backdoor is quite problematic”. This is utter nonsense, as any weathered Exchange administrator should be able to install or uninstall Transport Agents as part of their skill set.

Conclusion
In summary and concluding:

This is not a backdoor in Exchange Server.
The backdoor is a malicious Transport Agent which needs to be installed on the Exchange Server
Installing this backdoor requires administrative permissions.
Well-managed Exchange environments should be OK.
Removal is simple, and a task any Exchange admin should be able to perform.
Windows Defender detects Turla variants.

And last but not least:

Media should do proper fact-checking as opposed to blindly copying articles.
Media should use titles which reflect the contents, and refrain from click-bait titles.
ESET is a vendor selling e-mail hygiene and security-related products, which always is a potential red flag when these kinds of reports are published.

Outlook Connection Status Details

Posted on May 6, 2019 by Michel de Rooij

Outlook 2016 New Icon A little notice on a potential helpful feature which was introduced to Outlook at some point, but I wasn’t aware of before (or it’s just new). At least the option is available in Outlook v1905 build 11629.20008 C2R; it might also be available in standalone.

Many people are familiar with the Outlook Connection Status window, which you can summon by right-clicking the Outlook icon in the system tray while holding CTRL. This will show a dialog containing the connections Outlook is managing for every configured account, together with valuable information like endpoint, response times, etc.

One of the columns, Req/Fail, is showing the number of Requests and Failed requests. To check the headers of the last failing response for a particular connection, double-click the Req/Fail number. This will open up a popup window similar to this one:

Apart from essentials like the http result code, it will show which front-end and back-end servers processed the request. This might help to quickly determine if clients are connecting to unfavorable public endpoints, or when failed requests are coming from specific in case of Exchange on-premises. Of course, this information can also be retrieved using additional tools like Fiddler, but with this shortcut you don’t need to install additional software, as well as that you can ask end users to open up this window and send you the information.

Again, another little gem which might come in handy when troubleshooting.