Security Update Exchange 2013-2019 (Apr2021)

15Apr2021: Added note about Pwn2Own vulnerabilities not being addressed by these updates.

A quick blog on April’s security updates for Exchange Server 2013 up to 2019. Details regarding these vulnerabilities are confidential, but organizations are recommended to install these updates based on their rating. With patching procedures still fresh in everyone’s memory, and every Exchange on-premises server being current after the Hafnium issues, that should not be a problem, right?

The fixes address the following Remote Code Execution vulnerabilities:

VulnerabilitySeverityRating
CVE-2021-28483CriticalCVSS:3.0 9.0 / 7.8
CVE-2021-28482HighCVSS:3.0 8.8 / 7.7
CVE-2021-28481CriticalCVSS:3.0 9.8 / 8.5
CVE-2021-28480CriticalCVSS:3.0 9.8 / 8.5

More detailed information can be found at the original blog post here. Note that the recently discovered at the Pwn2Own 2021 contest are not (yet) addressed by these updates, according to this blog by the contest organizers.

The exploit can be fixed by single security update, which you can find below.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU9Download15.2.858.10KB5001779
Exchange 2019 CU8Download15.2.792.13KB5001779
Exchange 2016 CU20Download15.1.2242.8KB5001779
Exchange 2016 CU19Download15.1.2176.12KB5001779
Exchange 2013 CU23Download15.0.1497.15KB5001779

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU20 to Exchange 2016 CU19. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU9-KB5001779-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation (other words: Do not just double-click on the .MSP file). And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates, and follow a more agile approach. The rating implies a form of urgency.

Exchange Updates – March 2021

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Be advised that both of these CUs include the March security update KB5000871. AExchange 2016 will receive its final CU in March, 2021.

Links to the updates as well as a description of changes and fixes are described below. The column Schema and AD indicate if the CU contains Schema (/PrepareSchema) and Active Directory (PrepareAD) changes compared to the previous CU.

VersionBuildKBDownloadUMLPSchemaAD
Exchange 2019 CU915.2.858.2KB4602570Download NY
Exchange 2016 CU2015.1.2242.4KB4602569DownloadUMLPNY

Exchange 2019 CU9 fixes:

  • 5001181 Certain search scenario can’t return expected result in Outlook online mode in Exchange Server 2019
  • 5001182 Can’t use keyword “TMM” in a special pattern to search email in Exchange Server 2019
  • 5001183 Attachment is treated as bad zip file on Edge Transport server in Exchange Server 2019 and 2016
  • 5001184 EAC has no option to select the correct tenant for an Office 365 mailbox in Exchange Server 2019 and 2016
  • 5001185 EAC has no option to select an archive domain for cloud-based archive in Exchange Server 2019 and 2016
  • 5001186 Encoding of special characters isn’t preserved which causes missing text in Outlook in Exchange Server 2019 and 2016
  • 5001188 Incorrect MRM properties stamped on mail item delivery when sending to multiple mailboxes on the same database in Exchange Server 2019 and 2016
  • 5001189 Mailbox Audit log searches and Outlook both tied to MaxHitsForFullTextIndexSearches in Exchange Server 2019 and 2016
  • 5001190 MonitoringGroup can’t control the placement of CAS monitoring mailboxes in Exchange Server 2019 and 2016
  • 5001192 Microsoft Teams fails to show calendar because Autodiscover v2 isn’t site-aware in Exchange Server 2019 and 2016
  • 5001193 New health mailboxes for databases are created every time Exchange Health Manager service is restarted
  • 5001194 RFC certificate timestamp validation in Exchange Server 2019 and 2016
  • 5001195 UPN specified when creating mailbox is overwritten automatically causing login failures in Exchange Server 2019 and 2016
  • 5000631 Event IDs 1003, 1309 and 4999 are logged after installing Exchange Server 2019 CU8
  • 4583558 PDF preview function in OWA leads to download action unexpectedly

Exchange 2016 CU20 fixes:

  • 5001183 Attachment is treated as bad zip file on Edge Transport server in Exchange Server 2019 and 2016
  • 5001184 EAC has no option to select the correct tenant for an Office 365 mailbox in Exchange Server 2019 and 2016
  • 5001185 EAC has no option to select an archive domain for cloud-based archive in Exchange Server 2019 and 2016
  • 5001186 Encoding of special characters isn’t preserved which causes missing text in Outlook in Exchange Server 2019 and 2016
  • 5001188 Incorrect MRM properties stamped on mail item delivery when sending to multiple mailboxes on the same database in Exchange Server 2019 and 2016
  • 5001189 Mailbox Audit log searches and Outlook both tied to MaxHitsForFullTextIndexSearches in Exchange Server 2019 and 2016
  • 5001190 MonitoringGroup can’t control the placement of CAS monitoring mailboxes in Exchange Server 2019 and 2016
  • 5001192 Microsoft Teams fails to show calendar due to Autodiscover v2 isn’t site aware in Exchange Server 2019 and 2016
  • 5001193 New health mailboxes for databases are created every time Exchange Health Manager service is restarted
  • 5001194 RFC certificate timestamp validation in Exchange Server 2019 and 2016
  • 5001195 UPN specified when creating mailbox is overwritten automatically causing login failures in Exchange Server 2019 and 2016
  • 4583558 PDF preview function in OWA leads to download action unexpectedly

Notes:

  • If these Cumulative Updates contain schema changes compared to the Cumulative Update you have deployed, you need to run Setup with /PrepareSchema. If they contain Active Directory changes, you need to run /PrepareAD. Alternatively, permissions permitting, you can let Setup perform this step. Consult the Exchange schema versions page for object version numbers.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), support requires you to trail at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once upgraded, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The recommended upgrade order is internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Security Update Exchange 2010-2019 (Mar2021)

Update 16Mar2021: Added One-Click tool reference.

Another month, another set of security updates for Exchange Server 2016 and 2019, including out-of-band updates for Exchange 2013 CU23 and Exchange 2010 SP3 (Rollup 32). Given the risk of this vulnerability, security updates for older out-of-support CUs (Ex2016 CU8 was released December 2017) were also made available. According to the related Exchange team blog, these exploits are seen being used as part of an attack chain. After publication of this vulnerability named Hafnium, proof of concept kits were published after which variations started to appear (e.g. DearCry). Needless to say, the security update is critical and deployment should not be postponed – intermediate mitigations (with consequences) are also available.

These fixes address the following Remote Code Execution vulnerabilities:

The exploit can be fixed by security update, or in case of Exchange 2010 SP3 by applying a Rollup, which you can find in the table below per current Exchange version. Microsoft published security updates for older CUs as well on March 8th; these have been added to the table below.

Exchange BuildDownloadBuildArticleSupersedes
Exchange 2019 CU8Download15.2.792.10KB5000871KB4602269
Exchange 2019 CU7Download15.2.721.13KB5000871KB4602269
Exchange 2016 CU19Download15.1.2176.9KB5000871KB4602269
Exchange 2016 CU18Download15.1.2106.13KB5000871KB4602269
Exchange 2013 CU23Download15.0.1497.12KB5000871KB4593466
Exchange 2010 SP3 RU32Download14.3.513.0KB5000978
Exchange 2019 CU6Download15.2.659.12KB5000871
Exchange 2019 CU5Download15.2.595.8KB5000871
Exchange 2019 CU4Download15.2.529.13KB5000871
Exchange 2019 CU3Download15.2.464.15KB5000871
Exchange 2019 CU2Download15.2.397.11KB5000871
Exchange 2019 CU1Download15.2.330.11KB5000871
Exchange 2019 RTMDownload15.2.221.18KB5000871
Exchange 2016 CU17Download15.1.2044.13KB5000871
Exchange 2016 CU16Download15.1.1979.8KB5000871
Exchange 2016 CU15Download15.1.1913.12KB5000871
Exchange 2016 CU14Download15.1.1847.12KB5000871
Exchange 2016 CU13Download15.1.1779.8KB5000871
Exchange 2016 CU12Download15.1.1713.10KB5000871
Exchange 2016 CU11Download15.1.1591.18KB5000871
Exchange 2016 CU10Download15.1.1531.12KB5000871
Exchange 2016 CU9Download15.1.1466.16KB5000871
Exchange 2016 CU8Download15.1.1415.10KB5000871
Exchange 2013 CU22Download15.0.1473.6KB5000871
Exchange 2013 CU21Download15.0.1395.12KB5000871

Notes:

  • You may not be prompted for a reboot, but one is required.
  • When manually installing the update use an elevated command prompt, don’t just double-click the .msp. To apply an .msp from an elevated prompt, e.g. msiexec.exe /p <Full Path to File>.
  • When you need to update to a more current Cumulative Update first, update using an elevated command prompt, e.g. setup.exe /m:upgrade /IAcceptExchangeServerLicenseTerms
  • Per product group feedback, Exchange 2010 is not vulnerable to the same attack chain as Exchange 2013/2016/2019, hence the Rollup mentioning a single CVE.
  • When running product levels earlier than the ones patched, i.e. Exchange 2016 CU17, you are at risk. There are no patches for earlier product levels, so you need to update to a recent CU after which you can install the security update.
  • When installing a recent CU first in order to be able to install the security update, reboot after installing the CU, then install the security update. This prevents issues caused by files being locked or updating files pending replacement during reboot.
  • When you are significantly behind regarding keeping your Exchange servers up to date, the blog Upgrade Paths for CU’s and .NET might help in determining an update strategy.
  • The statement to stay up to date with at most CU n-1 is not some random adage; apart from features and fixes, it also allows you to quickly respond to these type of emergencies.
  • Make sure you have configured proper Anti-Virus/Malware exclusions for Exchange server, as documented here for Exchange 2016/2019. I’ve seen significant delays or even hangs during setup of Cumulative Updates because of paths and processes not being excluded. When running Exchange virtually, any I/O inspection running on top of your hypervisor is also considered anti-virus/malware software, such as Trend Micro Deep Inspection on VMWare.
  • When deploying CU(n) on top of CU(n-1) when an interim update already has been installed, it is recommended to uninstall the IU prior to deploying CU(n). While it might go through, an abort is likely with mention of detecting an IU (INTERIMUPDATEDETECTED) in Exchange Setup log.
  • Security Updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU18 to Exchange 2016 CU19. Note that the security update file has the same name for different Cumulative Updates; I would suggest tagging the file name with the CU level, e.g. Exchange2016-CU18-KB5000871-x64-en.msp.
  • The publication of security updates for some older CUs does not remove the necessity to update and patch with current CUs.

Indicators & Action
You may want to look for signs that your Exchange server might have been compromised (Indicators of Compromise or IOC). The article HAFNIUM targeting Exchange Servers with 0-day exploits explains this process. A tool is available to assist in scanning systems for indicators, the Microsoft Support Emergency Response Tool (MSERT).

There is also official communication to support this update, including steps to remediate issues with updates and steps to perform analysis (many people overlook the recommendation to run the update elevated for some reason). This deck can be found here: March 2021 Exchange Server Security Update – v1.2.65 – EN.pdf (thanks Chris Lehr).

Mitigations
I would also recommend the official follow-up post, which not only has been updated since the original post, but also includes mitigations for organizations which cannot deploy the update yet:

  • A script to configure IIS rewrite rules to block cookies used in the attack (mitigates CVE-2021-26855).
  • Disabling UM Services (mitigates CVE-2021-26857).
  • Disabling ECP application pool (mitigates CVE-2021-27065).
  • Disabling OAB application pool (addresses CVE-2021-26858).

Needless to say, steps like disabling ECP or OAB impacts client functionality.

MS published a One-Click Microsoft Exchange On-Premises Mitigation Tool for simplified one-click implementation of mitigation measures on Exchange 2013-2019.

Finally
Since some people are discovering artifacts of HAFNIUM dating before Microsoft’s official communication, people have been wondering how long this has been going on. For those interested, Krebson Security has published an article with a concise timeline of the events related to this attack.

Security Recommendation Exchange 2016-2019

A quick blog on an updated security publication for Exchange Server 2016 and 2019. This publication addresses the following vulnerability:

CVE-2021-1730: Microsoft Exchange Server Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.

As mentioned in the CVE report, this vulnerability can be mitigated in Exchange 2016 and Exchange 2019 by implementing a separate namespace for inline images. These images are served when using Outlook Web Access. Since I never see customers implementing this option, I will repeat these steps below to bring this to your attention.

First, pick a namespace to serve these images from, e.g. img.mail.contoso.com. Create a CNAME for this entry in the DNS, and point it to your OWA namespace, for example img.mail.contoso.com. Add this namespace to your existing SSL certificate (SAN) unless you are using a wildcard certificate and the chosen namespace is covered by it.

Next, configure the InternalDownloadHostName and ExternalDownloadHostName properties from OWAVirtualDirectory configuration, e.g.

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -ExternalDownloadHostName img.mail.contoso.com -InternalDownloadHostName img.mail.contoso.com

Configure the Exchange organization to use download domains:

Set-OrganizationConfig -EnableDownloadDomains $true

Finally, restart IIS or recycle the OWA application pool using Restart-WebAppPool MSExchangeOWAAppPool.

Security Update Exchange 2016-2019 (Feb2021)

A quick blog on security updates for Exchange Server 2016 and 2019. These fixes address the following vulnerability:

CVE-2021-24085: Microsoft Exchange Server Spoofing Vulnerability

The exploit can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU8Download15.2.792.5KB4602269KB4593465
Exchange 2019 CU7Download15.2.721.8KB4602269KB4593465
Exchange 2016 CU19Download15.1.2176.4KB4602269KB4593465
Exchange 2016 CU18Download15.1.2106.8KB4602269KB4593465

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Exchange Updates – December 2020

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Be advised that Exchange 2016 will receive its final CU in March, 2021.

Links to the updates as well as a description of changes and fixes are described below.

VersionBuildKBDownloadUMLPSchemaPrepareAD
Exchange 2019 CU815.2.792.3KB4588885VLSC NY
Exchange 2016 CU1915.1.2176.2KB4588884DownloadUMLPNY

Exchange 2019 CU8 fixes:

  • 4588297 Attachments can’t be downloaded or previewed from Outlook Web App
  • 4583531 Design change about inline images will be forced to download but not open in a new tab of OWA in Exchange Server 2019
  • 4583532 ELC MRM archiving fails due to DomainName in AuthServer in Exchange Server 2019
  • 4583533 Exchange Server 2019 installation fails with error “The user has insufficient access rights” 
  • 4583534 Event ID 65535 System.Runtime.Serialization errors in Application log in Exchange Server 2019
  • 4583535 New-Moverequest, Resume-Moverequest, and Remove-Moverequest not logged in Audit logs in Exchange Server 2019
  • 4583536 Set-MailboxFolderPermission is included in Mail Recipient Creation in Exchange Server 2019
  • 4583537 Update Korean word breaker in Exchange Server 2019
  • 4583538 Microsoft Teams REST calls exceed the default value of maxQueryStringLength in Exchange Server 2019
  • 4583539 Non-breaking space is visible in message body in Outlook in Exchange Server 2019
  • 4583542 Server assisted search in Outlook doesn’t return more than 175 items in Exchange Server 2019
  • 4583544 Lots of LDAP requests for FE MAPI w3wp lead to DDoS on DCs in Exchange Server 2019
  • 4583545 Make DomainName in Authserver a multivalued parameter in Exchange Server 2019
  • 4593465 Description of the security update for Microsoft Exchange Server 2019 and 2016: December 8, 2020

Exchange 2016 CU19 fixes:

  • 4588297 Attachments can’t be downloaded or previewed from Outlook Web App
  • 4583531 Design change about inline images will be forced to download but not open in a new tab of OWA in Exchange Server 2016
  • 4583532 ELC MRM archiving fails due to DomainName in AuthServer in Exchange Server 2016
  • 4583533 Exchange Server 2016 installation fails with error “The user has insufficient access rights” 
  • 4583534 Event ID 65535 System.Runtime.Serialization errors in Application log in Exchange Server 2016
  • 4583535 New-Moverequest, Resume-Moverequest, and Remove-Moverequest not logged in Audit logs in Exchange Server 2016
  • 4583536 Set-MailboxFolderPermission is included in Mail Recipient Creation in Exchange Server 2016
  • 4583537 Update Korean word breaker in Exchange Server 2016
  • 4583538 Microsoft Teams REST calls exceed the default value of maxQueryStringLength in Exchange Server 2016
  • 4583539 Non-breaking space is visible in message body in Outlook in Exchange Server 2016
  • 4583545 Make DomainName in Authserver a multivalued parameter in Exchange Server 2016
  • 4593465 Description of the security update for Microsoft Exchange Server 2019 and 2016: December 8, 2020

Notes:

  • These Cumulative Updates contain schema changes compared to the previous Cumulative Update. This requires you to run /PrepareSchema. Also, Active Directory changes require you to run PrepareAD (which also can perform the schema update, depending permissions). Consult the Exchange schema versions page for object version numbers.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are allowed to trail at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Security Updates Exchange 2010-2019 (Dec2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released December 8th. These fixes address the following vulnerability:

Exchange 2016 / 2019

  • CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17141: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17143: Microsoft Exchange Information Disclosure Vulnerability

Exchange 2013

  • CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17143: Microsoft Exchange Information Disclosure Vulnerability

Exchange 2010

  • CVE-2020-17144: Microsoft Exchange Remote Code Execution Vulnerability

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.6KB4593465KB4588741
Exchange 2019 CU6Download15.2.659.11KB4593465KB4588741
Exchange 2016 CU18Download15.1.2106.6KB4593465KB4588741
Exchange 2016 CU17Download15.1.2044.12KB4593465KB4588741
Exchange 2013 CU23Download15.0.1497.10KB4593466
Exchange 2010 SP3 RU31 Download14.3.509.0KB4593467

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013-2019 (Nov2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released November 10th. These fixes address the following vulnerability:

  • CVE-2020-17085: Microsoft Exchange Server Denial of Service Vulnerability
  • CVE-2020-17084: Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2020-17083: Microsoft Exchange Server Remote Code Execution Vulnerability

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.4KB4588741KB4581424
Exchange 2019 CU6Download15.2.659.8KB4588741KB4581424
Exchange 2016 CU18Download15.1.2106.4KB4588741KB4581424
Exchange 2016 CU17Download15.1.2044.8KB4588741KB4581424
Exchange 2013 CU23Download15.0.1497.8KB4588741KB4581424

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013-2019 (Oct2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released October 13th. These fixes address the following vulnerability:

  • CVE-2020-16969: Microsoft Exchange Information Disclosure Vulnerability
    An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.

    To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.

    The security update corrects the way that Exchange handles these token validations.

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.3KB4581424KB4577352
Exchange 2019 CU6Download15.2.659.7KB4581424KB4577352
Exchange 2016 CU18Download15.1.2106.3KB4581424KB4577352
Exchange 2016 CU17Download15.1.2044.7KB4581424KB4577352
Exchange 2013 CU23Download15.0.1497.7KB4581424KB4536988

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2016-CU17-KB4581424-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

EWS.WebServices.Managed.Api

A short blog on the EWS Managed API and using the latest version with scripts leveraging Exchange Web Services (EWS), such as my Remove-DuplicateItems script. The installable EWS Managed API library was last updated in 2014 (version 2.2, reports as v15.0.913.22), and there have been few enhancements since then. These are included in the EWS.WebServices.Managed.Api package, which carries version 2.2.1.2.

Although this library was last updated in 2019, you might still need it to successfully run EWS scripts. The EWS.WebServices.Managed.Api package supports some Exchange Web Services calls which are not supported in the 2.2 version, and may lead to error messages like Exception calling “FindFolders” with “2” argument(s) or other messages related to the (number of) arguments. This may be an indication a particular call was used to one of the EWS functions, but which is not supported by the installed EWS Managed API library. In those cases, installing this updated library might help.

The library is published on NUGet as a package. To install the package, we first need to register NuGet as a Package Source:

Register-PackageSource -provider NuGet -name nugetRepository -location https://www.nuget.org/api/v2

Next, install the package from the newly defined NuGet source:

Install-Package Exchange.WebServices.Managed.Api

The package installs by default under C:\Program Files\PackageManagement\NuGet\Packages. I have updated my scripts to include this location when searching for the required Microsoft.Exchange.WebServices.dll as well. Alternatively, you can copy this DLL from the ..\Exchange.WebServices.Managed.Api.<Version>\lib\net35 folder to the location where the script resides. When running my EWS-based scripts in Verbose mode, it will report as version 2.2.1.0.

Hopefully this blog will potentially save you some time troubleshooting, and myself answering some support messages. Enjoy!