About Michel de Rooij

Michel de Rooij, with over 25 years of mixed consulting and automation experience with Exchange and related technologies, is a consultant for Rapid Circle. He assists organizations in their journey to and using Microsoft 365, primarily focusing on Exchange and associated technologies and automating processes using PowerShell or Graph. Michel's authorship of several Exchange books and role in the Office 365 for IT Pros author team are a testament to his knowledge. Besides writing for Practical365.com, he maintains a blog on eightwone.com with supporting scripts on GitHub. Michel has been a Microsoft MVP since 2013.

Security Updates Exchange 2016-2019 (Mar2024)

Posted on March 13, 2024 by Michel de Rooij

The Exchange product group released March 2024 updates for Exchange Server 2016 and 2019.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2024-26198	Remote Code Execution	Important	CVSS:3.1 8.8 / 7.7

The Security Updates for each supported Exchange Server build are linked below:

Exchange	Download	Build	KB	Supersedes
Exchange 2019 CU14	Download	15.2.1544.9	KB5036401	KB5032146
Exchange 2019 CU13	Download	15.2.1258.32	KB5036402	KB5032146
Exchange 2016 CU23	Download	15.1.2507.37	KB5036386	KB5032147

OutsideInModule

Be advised that these security updates will disable Oracle Outside In Technology (OIT). Security issues have been discovered in this embedded third-party package (ADV24199947). The consequence of disabling these is that text can no longer be extracted from JPG, TIFF, and AutoCAD files for usage in Exchange Transport Rules or Data Loss Prevention rules. More information is here.

Fixed Issues

Apart from security fixes, these Security Updates also correct the following issues:

Issue Fixed	Exchange 2016	Exchange 2019
EWS search request displays inaccurate results	Yes	Yes

Notes

Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU14 to Exchange 2019 CU13. When downloading, the security update will carry the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level when archiving it, e.g., Exchange2019-CU13-KBXXXXXX-x64-en.msp.
Similar to Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
If you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removal of the Last Exchange Server for recipient management, it is recommended to apply the Security Update. Be aware of few cmdlet piping issues mentioned here.

On a final note, as with any patch or update, it is recommended to apply this in a test environment first prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates and follow a more agile approach; the ratings are an indication of the urgency.

Practical PowerShell Series

Posted on February 14, 2024 by Michel de Rooij

“How do I start using scripting?” or “How do I turn this piece of code into a fully working script?” These are just some of the questions that reach me through mail or during events. Even after 17 years since its introduction with Exchange Server 2007, there is still a gap regarding PowerShell. Not all administrators are natural developers, despite Microsoft expecting them in some ways. Some may need more help in this area.

To address this need, I am starting a series of PowerShell-related articles on Practical 365. I will be covering skills needed when going from a piece of code or concept to a script with all major bells and whistles. I will also throw in best practices and the occasional tip. The series aims to help this target audience improve their skills using practical examples. Note that practical is the keyword here, as I am trying to start theoretical or aesthetic discussions on code layout or which style is better.

Click here to read the full article on Practical 365.

Exchange 2019 CU14 (2024 H1)

Posted on February 13, 2024 by Michel de Rooij

The Exchange Team released Exchange Server 2019 Cumulative Update H1 2024, or CU14. Apart from the fixes, this Cumulative Update for Exchange 2019 contains the following changes:

.NET Framework 4.8.1 support on Windows Server 2022
Extended Protection will be enabled by default on the server where you installed CU14 (and later). You can override this behavior during setup or by specifying the DoNotEnableEP or DoNotEnableEPFEEWS when running setup unattended. More info on these switches, as well as the Extended Protection requirements and how to configure it, can be found here.

Unfortunately, TLS 1.3 support has been moved to CU15.

CVE-2024-21410
Enabling Extended Protection also addresses the just released CVE-2024-21410. This also applies to Exchange 2016 and even Exchange 2013 when you deployed the August 2022 Security Update on those servers and enabled Extended Protection on them.

Vulnerability	Category	Severity	Rating
CVE-2024-21410	Elevation of Privilege	Critical	CVSS:3.1 9.8 / 9.1

Download
Link to the update as well as a description of changes and fixes are below. The columns Schema and AD indicate if the CU contains Schema (/PrepareSchema) and Active Directory (PrepareAD) changes compared to the previous CU. Refer to the Exchange Schema page for schema and related versioning information. Also, to be able to manage Modern Authentication, administrators need to explicitly run /PrepareAD.

Version	Build	KB	Download	UMLP	Schema	AD
Exchange 2019 CU14	15.2.1544.4	KB5035606	Download		N	Y

Exchange 2019 CU14 fixes:

5035442 Exchange Mitigation Service does not log incremental updates
5035443 Read receipts are returned if ActiveSyncSuppressReadReceipt is “True” in Exchange Server 2019
5035444 System.argumentnullexception when you try to run an eDiscovery search
5035446 OAB shadow distribution fails if legacy authorization is blocked
5035448 MCDB fails and leads to lagged copy activation
5035450 Exchange 2019 setup installs an outdated JQuery library
5035452 Usernames are not displayed in Event ID 23 and 258
5035453 Issues in Exchange or Teams when you try to delegate information
5035455 MSExchangeIS stops responding and returns “System.NullReferenceExceptions” multiple times per day
5035456 “Deserialization blocked at location HaRpcError” error and Exchange replication stops responding
5035493 FIP-FS Proxy Customizations are disabled after a CU or an SU update
5035494 Modern attachment doesn’t work when web proxy is used in Exchange Server 2019
5035495 OWA displays junk operations even if junk mail reporting is disabled
5035497 Edit permissions option in the ECP can’t be edited
5035542 Remote equipment and room mailboxes can now be managed through EAC
5035616 Logon events failure after updating Windows Server
5035617 Transport rules aren’t applied to multipart or alternative messages
5035689 “High %Time in GC” and EWS doesn’t respond

Notes

If Cumulative Updates contain schema changes compared to the Cumulative Update you currently have deployed, you need to run Setup with /PrepareSchema. If they contain Active Directory changes, you need to run /PrepareAD. Alternatively, permissions permitting, you can let Setup perform this step. Consult the Exchange schema versions page for schema and related versioning information.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), support requires you to trail at most one version (n-1).
Ensure the Windows PowerShell Script Execution Policy is set to Unrestricted during deployment. This to prevent installation failures due to the inability to validate script signatures.
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable the publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once upgraded, you can’t uninstall a Cumulative Update or any of the installed Exchange server roles.
The recommended upgrade order is internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution
As for any updates, I recommend thoroughly testing updates in a test environment before implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Security Updates Exchange 2016-2019 (Nov2023)

Posted on November 14, 2023 by Michel de Rooij

The Exchange product group released November updates for Exchange Server 2016 and 2019.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2023-36439	Remote Code Execution	Important	CVSS:3.1 8.0 / 7.0
CVE-2023-36050	Spoofing	Important	CVSS:3.1 8.0 / 7.0
CVE-2023-36039	Spoofing	Important	CVSS:3.1 8.0 / 7.0
CVE-2023-36035	Spoofing	Important	CVSS:3.1 8.0 / 7.0

The Security Updates for each supported Exchange Server build are linked below:

Exchange	Download	Build	KB	Supersedes
Exchange 2019 CU13	Download	15.2.1258.28	KB 5032146	KB5030877
Exchange 2019 CU12	Download	15.2.1118.40	KB 5032146	KB5030877
Exchange 2016 CU23	Download	15.1.2507.35	KB5032147	KB5030877

Payload Serialization Signing

Be advised that these updates will enable payload signing by default. Payload serialization signing signs PowerShell payloads to identify possible tampering. Support for certificate-based signing of PowerShell serialization payloads got added with January security updates and is a per-server configuration. In other words, make sure you have deployed the January security updates before implementing these security updates, so your Exchange servers support payload signing before you can enable it one server at a time.

More info on the topic here. The process is explained at https://aka.ms/HC-SerializedDataSigning. To verify or configure signing, use the script published here or follow the manual steps. Signing leverages the organization-wide available Exchange Auth Certificate, which needs to be present and valid; the MonitorExchangeAuthCertificate.ps1 script can help you verify this.

Fixed Issues

Apart from security fixes, these Security Updates also correct the following issues:

Issue Fixed	Exchange 2016	Exchange 2019
Signing of the serialisation payload fails to run the few cmdlets	Yes	Yes
Unable to migrate mailbox as communication error parameter exception occurs	Yes	Yes
InvalidResponseException when you try to run Export-UMPrompt	Yes

Notes

Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU13 to Exchange 2019 CU12. When downloading, the security update will carry the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level when archiving it, e.g., Exchange2019-CU13-KBXXXXXX-x64-en.msp.
Similar to Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
If you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removal of the Last Exchange Server for recipient management, it is recommended to apply the Security Update. Be aware of few cmdlet piping issues mentioned here.

Challenges of PowerShell Scripting with Microsoft 365

Posted on October 16, 2023 by Michel de Rooij

If you are looking for a way to automate and simplify your Microsoft 365 administration tasks, PowerShell is a great option. However, PowerShell scripting is not without its challenges. Not proactively maintaining code can quickly become an issue because of the changes made to dependencies such as modules, as well as the cmdlets you use.

In an article I wrote for Practical 365, related to the presentation of the same name held at the The Experts Conference 2023 in Atlanta this year, I discuss some of the challenges administrators might encounter with PowerShell scripts. Also, I provide some guidance and point out a few tools that can assist with rewriting or refactoring code, i.e., updating code while keeping its external functionality.

Click here to read the full article on Practical 365.