Exchange Updates – Sep. 2019

Posted on September 17, 2019 by Michel de Rooij

Exchange2019Logo Today, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. The fixes in each release, product downloads are described below:

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU3	15.2.464.5	KB4514141	VLSC		N
Exchange 2016 CU14	15.1.1847.3	KB4514140	Download	UMLP	N

Exchange 2019 CU3 fixes:

4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2019
4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2019 and 2016
4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2019 and 2016
4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2019 and 2016
4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2019 and 2016
4515269 SentToMemberOf shows every recipient type not distribution groups when you create transport rule in Exchange Server 2019 and 2016
4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2019 and 2016
4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2019 and 2016
4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2019 and 2016
4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2019 and 2016
4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2019 and 2016
4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2019 and 2016
4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2019 and 2016
4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2019 and 2016
4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2019 and 2016
4515273 Mailbox auditing fails when using SHA1Managed in Exchange Server 2019 and 2016
4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2019 and 2016
4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2019 and 2016
4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Exchange 2016 CU14 fixes:

4515255 “X-InnerException: Microsoft.Mapi.MapiExceptionRpcServerTooBusy” error when you try to use a mailbox in Exchange Server 2016
4515254 Event 1009 frequently occurs in application logs for lagged database copies in Exchange Server 2016
4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2016
4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2016
4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2016
4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2016
4515269 SentToMemberOf shows every recipient type not distribution groups when creating transport rule in Exchange Server 2016
4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2016
4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2016
4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2016
4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2016
4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2016
4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2016
4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2016
4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2016
4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2016
4515273 Mailbox auditing fails when you use SHA1Managed in Exchange Server 2016
4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2016
4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2016
4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

MVP’s around the World (2019)

Posted on July 3, 2019 by Michel de Rooij

Update: Updated statistics based on award categories (not people) due to the number of multi-category awardees.

In previous years, I performed some comparisons on the MVP population after every award cycle. So, time to get some fresh statistics after July 2019 award cycle.

For comparison, I had a look at the public MVP statistics of July 3rd, 2018 against those of July 3rd, 2019, as the public MVP site was closed the first two days. From the numbers, it is clear that this cycle the number of MVPs went down again, from 3.030 last year, to 2.634 now (-13%).

The following table contains the changes per award category from July 2018 to
July 2019:

Competence	Jul-18	Jul-19	Change
AI	58	84	45%
Business Applications	164	166	0%
Cloud and Datacenter Management	303	232	-23%
Data Platform	369	332	-10%
Enterprise Mobility	122	106	-13%
Microsoft Azure	444	409	-8%
Office Development	33	47	42%
Office Apps & Services	606	491	-19%
Developer Technologies	781	644	-17%
Windows and Devices for IT	87	57	-34%
Windows Development	186	119	-37%
Total MVPs	3066	2634	-14%

Few notes:

The total number of MVP’s doesn’t equal the total number of awards, as people can be awarded in more than one category; there are 52 MVP’s with multiple award categories (one even in 3 categories).
Former single product categories, such as Access or OneNote, were moved under the Office Apps & Services category (which was rebranded from Office Servers & Services). Those numbers are merged for the 2018 column.
When comparing to earlier years, the award categories were restructured in 2017, e.g. Visual Studio and Development Technologies became Developer Technologies.

When zooming in on the Office Apps & Services category, the awards per country are shown below. Be advised that 26 are anonymous MVP’s or have profiles without location.

Country	Jul’18	Jul’19	Country	Jul’18	Jul’19	Country	Jul’18	Jul’19
ARE	1	2	GBR	23	28	POL	2	4
AUS	17	20	HRV	5	4	PRK	6	12
AUT	2	3	HUN	2	2	PRT	3	2
BEL	8	8	IND	12	13	RUS	5	8
BGR	1	2	IRL	1	1	SAU	1	1
BIH	1	1	ISR		1	SGP	3	3
BRA	2	10	ITA	8	6	SLV		1
CAN	28	31	JOR	1	1	SRB	1	1
CHE	4	2	JPN	11	22	SVK	1	1
CHN	14	16	LKA	4	1	SVN	1	2
COL	2	4	MEX	2	5	SWE	6	5
CRI		1	MKD	2	2	THA	1	3
CZE	3	2	MYS	1	1	TUR	4	2
DEU	17	25	NGA	1	1	TWN		3
DNK	2	6	NLD	13	21	UKR	1	2
EGY	1	1	NOR	5	6	URY	1	1
ESP	5	8	NPL	1	1	USA	89	120
FIN	2	3	NZL	4	6	ZAF	4	5
FRA	16	20	PAK	2	2

The countries Argentina, Chile, Latvia, Peru, Romania and Greece are no longer represented in the Office Apps & Services category, while Costa Rica, Israel, Taiwan and El Salvador are new to the table.

Month	Oct 2016	Jan 2017	Jun 2017	Jul 2017	Jun 2018	Jul 2018	Mar 2019	Jul 2019
OSS	538	505 (-7%)	532 (+5%)	449 (-16%)	490 (+2%)	383 (-21%)	622 (+62%)	491 (-22%)
Total	N/A	N/A	4134	3490 (-16%)	3815 (+2%)	3030 (-21%)	3205 (+6%)	2635 (-18%)

Above are the number of Office Apps & Services and total number of MVP’s over the last years. Do note that for March and July 2019 the former product categories are included in the Office Apps & Services category, hence why I included March to have a sense of the changes in the July cycle.

If you have questions or comments, please send them in the comments below.

2019-2020 Microsoft MVP Award

Posted on July 1, 2019 by Michel de Rooij

With great honor and joy I can announce that I have been awarded the Microsoft Most Valuable Professional Award in the category Office Apps & Services.

Microsoft reports there are around 2.000 MVP awardees worldwide. Those awards are given to individuals in recognition of their contributions to the community, such as writing, speaking engagements, supporting people, code contributions or product feedback.

This is my 6th consecutive year as an MVP. Lots of kudos to the MVP leads and other involved in the monstrous task of reviewing and evaluating thousands of contributions for this award cycle.

Many thanks to the community, readers, followers, fellow MVP’s and friends, peers, product groups and other Microsoft employees for their encouragement, inspiration and support over all those years.

My MVP profile can be found here.

Exchange Updates – June 2019

Posted on June 18, 2019 by Michel de Rooij

Exchange2019Logo Today, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019, Exchange 2016 and Exchange 2013.

The KB articles that describe the fixes in each release, and product downloads are available as follows:

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU2	15.2.397.3	KB4488401	VLSC		N
Exchange 2016 CU13	15.1.1779.2	KB4488406	Download	UMLP	N
Exchange 2013 CU23	15.0.1497.2	KB4489622	Download	UMLP	N

These updates contain the following important changes and notes (more information in the original article):

Reduced required permissions of Exchange in Active Directory.
Introduction of support for .NET Framework 4.8, with 4.7.2 becoming the minimum required version.
Introduction of Organization-level Authentication Policies.
Upcoming support for Modern Authentication for Exchange Hybrid deployments.
Controlled Public Folder visibility for Exchange 2019 & 2016.

Exchange 2019 CU2 fixes:

4502134 Can’t get all the emails when searching mailbox by using an end date that’s different from today in Exchange Server 2019
4502135 Correct the error message that you receive when installing Exchange Server 2019 in an organization that has Exchange Server 2010 installed
4502154 Providing information to administrators when auto forward limit is reached in Exchange Server 2019 and 2016
4502155 “The primary SMTP address must be specified when referencing a mailbox” error when you use impersonation in Exchange Server 2019 and 2016
4502156 Audit logs aren’t updated when “-WhatIf” is used as $false in the command in Exchange Server 2019 and 2016
4502157 The Find command not returning the HasAttachments element in Exchange Server 2019 and 2016
4502158 SyncFolderItems contains duplicated ReadFlagChange items in Exchange Server 2019 and 2016
4502131 “TLS negotiation failed with error UnknownCredentials” error after you update TLSCertificateName on Office 365 send connector in Exchange Server 2019 hybrid environment
4502132 Can’t reply to old emails after migration even though old legacyExchangeDN is set to migrated mailbox in Exchange Server 2019 and 2016
4502136 The response of FETCH (BODYSTRUCTURE) command of IMAP violates RFC 3501 in Exchange Server 2019 and 2016
4502140 Can’t preview an eDiscovery search when there are multiple domains in Exchange Server 2019 and 2016
4502141 Appointment that’s created by responding to an email message doesn’t show in any Outlook calendar views in Exchange Server 2019 and Exchange Server 2016
4502133 Can’t use Outlook on the web to reply a partner email through mutual TLS in Exchange Server 2019 and 2016
4488396 Can’t search any results in manually added shared mailbox in Outlook in Exchange Server 2019 and 2016
4488078 Public folder contact lists don’t show contact’s profile picture in Outlook on the web in Exchange Server 2019 and 2016
4499503 Heavy organizational forms traffic because of materialized restriction when organization forms library has more than 500 items in Exchange Server 2019 and 2016
4503027 Description of the security update for Microsoft Exchange Server 2019 and 2016: June 11, 2019

Exchange 2016 CU13 fixes:

4502154 Providing information to administrators when auto forward limit is reached in Exchange Server 2016
4502155 “The primary SMTP address must be specified when referencing a mailbox” error when using impersonation in Exchange Server 2016
4502156 Audit logs aren’t updated when “-WhatIf” is used as $false in the command in Exchange Server 2016
4502157 The Find command not returning the HasAttachments element in Exchange Server 2016
4502158 SyncFolderItems contains duplicated ReadFlagChange items in Exchange Server 2016
4502131 “TLS negotiation failed with error UnknownCredentials” error after updating TLSCertificateName on Office 365 send connector in Exchange Server 2016 hybrid environment
4502132 Can’t reply to old emails after migration even though old legacyExchangeDN is set to migrated mailbox in Exchange Server 2016
4502136 The response of FETCH (BODYSTRUCTURE) command of IMAP violates RFC 3501 in Exchange Server 2016
4502140 Can’t preview an eDiscovery search when there are multiple domains in Exchange Server 2016
4502141 Appointment that’s created by responding to an email message doesn’t show in any of Outlook calendar views in Exchange Server 2016
4502133 Can’t use Outlook on the web to reply a partner email through mutual TLS in Exchange Server 2016
4488396 Can’t search any results in manually added shared mailbox in Outlook in Exchange Server 2016
4488078 Public folder contact lists don’t show contact’s profile picture in Outlook on the web in Exchange Server 2016
4499503 Heavy organizational forms traffic due to materialized restriction when organization forms library has more than 500 items in Exchange Server 2016
4503027 Description of the security update for Microsoft Exchange Server 2019 and 2016: June 11, 2019

Exchange 2013 CU23 fixes:

4502131 “TLS negotiation failed with error UnknownCredentials” error after updating TLSCertificateName on Office 365 send connector in Exchange Server 2013 hybrid environment
4503028 Description of the security update for Microsoft Exchange Server 2013 and 2010: June 11, 2019

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update. However, due to changes in the permissions architecture, you need to run setup /PrepareAD to implement these changes as well as apply any RBAC changes, before deploying or updating Exchange servers.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

Security Updates for Spoofing Vulnerability

Posted on April 9, 2019 by Michel de Rooij

Updated April 12th: Notice on KB4487563

Today, as part of patch Tuesday, supported Exchange versions received security updates to remediate the following issues:

CVE-2019-0817: Microsoft Exchange Spoofing Vulnerability
CVE-2019-0858: Microsoft Exchange Spoofing Vulnerability

Security updates are available for the following product levels, and fix the vulnerability mentioned:

	Build	KB	Download	CVE-2019-0817	CVE-2019-0858
Exchange 2019 CU1	15.2.330.7	KB4487563	Download	Yes	Yes
Exchange 2019	15.2.221.16	KB4487563	Download	Yes	Yes
Exchange 2016 CU12	15.1.1713.6	KB4487563	Download	Yes	Yes
Exchange 2016 CU11	15.1.1591.16	KB487563	Download	Yes	Yes
Exchange 2013 CU22	15.0.1473.4	KB487563	Download	Yes	Yes
Exchange 2010 SP3 RU27	14.3.452.0	KB4491413	Download	Yes	No

Notes:

CVS-2019-0858 does not apply to Exchange 2010.
Exchange 2010 is currently in Extended Support. Extended support for Exchange 2010 ends January 14, 2020.
Don’t forget to put the Exchange server in maintenance mode prior to updating.
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing first, followed by non-internet-facing servers, and finally Edge Transports.

Notice on KB4487563:
Apart from the known issues mentioned in KB4487563, there are reports the fix terminates while stopping services, and the following error is being logged:
[Error] System.Management.Automation.CommandNotFoundException: The term ‘Stop-SetupService’ is not recognized as the name of a cmdlet, function, script file, or operable program.

This Stop-SetupService isn’t a regular cmdlet, and I assume is an alias created by the update. However, there are reports this operation fails. In those circumstances, next to retrying installation of the update, a workaround might be opening up a PowerShell session and adding the alias yourself using New-Alias Stop-SetupService Stop-Service, followed by running the update. The alias isn’t persistent, so will be gone after you close your session.

Caution:
As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – February 2019

Posted on February 12, 2019 by Michel de Rooij

Update: Added note that Exchange 2010 SP3 RU26 adds support for Windows Server 2012 R2.

Today, the Exchange Team released the overdue quarterly Cumulative Updates for Exchange Server 2013, Exchange 2016 and Exchange 2019, as well as a Rollup for Exchange Server 2010.

The KB articles that describe the fixes in each release and product downloads are available as follows:

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU1	15.2.330.5	KB4471391	VLSC		N
Exchange 2016 CU12	15.1.1713.5	KB4471392	Download	UMLP	N
Exchange 2013 CU22	15.0.1473.3	KB4345836	Download	UMLP	N
Exchange 2010 SP3 RU26	14.3.442.0	KB4487052	Download		N

This update contain the following important changes and notes:

Due to issue CVE-2018-8581, the EWS architecture was changed, in particular push notifications. Details on the change are described in KB4490060; while the change has been tested against EWS clients such as Outlook for Mac and Skype for Business, organizations may need to test any applications leveraging EWS to estimate potential impact of installing these Cumulative Updates or Rollup. In addition, organizations are advised to password reset Exchange computer accounts.
These Exchange builds introduces a change in the shared permissions model (this does not apply to Split Permissions Model). Result is that Exchange no longer requires fargoing permissions in Active Directory (e.g. WriteDACL on root of domain). To makes these changes become effective:
- For Exchange 2013-2019 Cumulative Updates, run setup using /PrepareAD. In multi-forest environments, this needs to be done in every domain of the forest.
- For Exchange 2010, go through the instructions mentioned in KB4490059.
Organizations considering moving to the Split Permissions because of CVE-2018-8581 should know Microsoft fully supports both models. Switching can have serious consequences and therefor should be fully evaluated.
This build of Exchange 2019 introduces cmdlets to block usage of legacy authentication protocols for users through policies, e.g. Basic Authentication.
Prior to deploying Exchange 2016 CU12 or Exchange 2013 CU22 on Edge Transport servers, install Visual C++ 2012 Runtime.
These Cumulative Updates will remove the DisableLoopbackCheck key when present; removing this key was a mitigation for CVE-2018-8581.
Exchange 2010 SP3 RU26 adds support for Windows Server 2012 R2, to accommodate for the Hybrid Agent.

Exchange 2019 CU1 fixes:

4487596 Emails are blocked in moderator mailbox Outbox folder when you send large volumes of emails in Exchange Server 2019
4487591 The recipient scope setting doesn’t work for sibling domains when including OUs in the scope in Exchange Server 2019
4487602 Outlook for Mac users can still expand a distribution group when hideDLMembership is set to true in Exchange Server 2019
4488076 Outlook on the Web can’t be loaded when users use an invalid Windows language in operating system in Exchange Server 2019
4488079 Exchange Server 2016 allows adding Exchange Server 2019 mailbox server into a same DAG and vice versa
4488263 X-MS-Exchange-Organization-BCC header isn’t encoded correctly in Exchange Server 2019
4488080 New-MigrationBatch doesn’t honor RBAC management scope in Exchange Server 2019
4488262 Delivery Reports exception when tracking a meeting request that’s sent with a room resource in Exchange Server 2019
4488268 Disable the irrelevant Query logs that’re created in Exchange Server 2019
4488267 Test-OAuthConnectivity always fails when Exchange Server uses proxy to connect to Internet in Exchange Server 2019
4488266 Client application doesn’t honor EwsAllowList in Exchange Server 2019
4488265 “There are problems with the signature” error occurs for digital signature message if attachment filtering is enabled in Exchange Server 2019
4488398 “The Microsoft Exchange Replication service may not be running on server” error when you add a mailbox database copy in Exchange Server 2019
4488264 Mailbox that has a bad move request can’t be cleaned up from destination mailbox database in Exchange Server 2019
4488261 Event ID 1002 when the store worker process crashes in Exchange Server 2019
4488260 New-MailboxExportRequest and New-MailboxImportRequest don’t honor RBAC management scope in Exchange Server 2019
4488259 MailTip shows wrong number of users for a distribution group if the users are in different domains in Exchange Server 2019
4488258 OAuth authentication is removed when saving MAPI virtual directory settings in EAC in Exchange Server 2019
4490060 Exchange Web Services Push Notifications can be used to gain unauthorized access
4490059 Reducing permissions required to run Exchange Server using Shared Permissions Model

Exchange 2016 CU12 fixes:

4487596 Emails are blocked in moderator mailbox Outbox folder when you send large volumes of emails in Exchange Server 2016
4456241 You receive a meeting request that has a “not supported calendar message.ics” attachment in Exchange Server 2016
4456239 New-MailboxRepairRequest doesn’t honor RBAC RecipientWriteScope restrictions in Exchange Server 2016
4487591 The recipient scope setting doesn’t work for sibling domains when including OUs in the scope in Exchange Server 2016
4468363 MRM does not work for mailboxes that have an online archive mailbox in Exchange Server
4487603 “The action cannot be completed” error when you select many recipients in the Address Book of Outlook in Exchange Server 2016
4487602 Outlook for Mac users can still expand a distribution group when hideDLMembership is set to true in Exchange Server 2016
4488076 Outlook on the Web can’t be loaded when users use an invalid Windows language in operating system in Exchange Server 2016
4488079 Exchange Server 2016 allows adding Exchange Server 2019 mailbox server into a same DAG and vice versa
4488077 Can’t configure voice mail options when user is in different domain in Exchange Server 2016
4488263 X-MS-Exchange-Organization-BCC header isn’t encoded correctly in Exchange Server 2016
4488080 New-MigrationBatch doesn’t honor RBAC management scope in Exchange Server 2016
4488262 Delivery Reports exception when tracking a meeting request that’s sent with a room resource in Exchange Server 2016
4488268 Disable the irrelevant Query logs that’re created in Exchange Server 2016
4488267 Test-OAuthConnectivity always fails when Exchange Server uses proxy to connect to Internet in Exchange Server 2016
4488266 Client application doesn’t honor EwsAllowList in Exchange Server 2016
4488265 “There are problems with the signature” error occurs for digital signature message if attachment filtering is enabled in Exchange Server 2016
4488264 Mailbox that has a bad move request can’t be cleaned up from destination mailbox database in Exchange Server 2016
4488261 Event ID 1002 when the store worker process crashes in Exchange Server 2016
4488260 New-MailboxExportRequest and New-MailboxImportRequest don’t honor RBAC management scope in Exchange Server 2016
4488259 MailTip shows wrong number of users for a distribution group if the users are in different domains in Exchange Server 2016
4488258 OAuth authentication is removed when saving MAPI virtual directory settings in EAC in Exchange Server 2016
4490060 Exchange Web Services Push Notifications can be used to gain unauthorized access
4490059 Reducing permissions required to run Exchange Server using Shared Permissions Model

Exchange 2013 CU22 fixes:

4487603 “The action cannot be completed” error when you select many recipients in the Address Book of Outlook in Exchange Server 2013
4490060 Exchange Web Services Push Notifications can be used to gain unauthorized access
4490059 Reducing permissions required to run Exchange Server using Shared Permissions Model

Exchange 2010 SP3 RU26 fixes:

4490060 Exchange Web Services Push Notifications can be used to gain unauthorized access

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update. However, due to changes in the permissions architecture, you need to run setup /PrepareAD to implement these changes as well as apply any RBAC changes, before deploying or updating Exchange servers.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

CVE-2018-8581: Exchange Vulnerability

Posted on January 29, 2019 by Michel de Rooij

Update Feb6: Added MSRC security advisory ADV190007 .
Update Feb13: February updates comment.

A short notice on the zero-day vulnerability in the Exchange ecosystem as reported by researcher Mollema last week. Through a man-in-the-middle setup, one can exploit the permissions Exchange has with regards to Active Directory in conjunction with NTLM as well as Exchange Web Services (EWS). This 3-stage missile allows one to elevate their privileges in Active Directory, and thus to grant themselves administrative access.

The issue was already logged at 13 november in the Microsoft Security Response Center (MSRC) as CVE-2018-8581, Microsoft Exchange Server Elevation of Privilege Vulnerability. An uptake on the public attention for the issue was generated after the Mollema article, and media like The Register started publishing about it. Meanwhile Exchange fellow Tony Redmond also wrote a short note on the issue as well.

At this moment, Microsoft is fully aware of the issue, and is actively working on resolving the issue as soon as possible. Meanwhile, the mitigation mentioned in CVE-2018-8581 can be considered, which is to remove the DisableLoopbackCheck key from HKLM:\SYSTEM\CurrentControlSet\Control\Lsa. The effect of removing this key is that it’s no longer possible to make NTLM connections on the loopback adapter (localhost), which should be OK for Kerberos authenticated sessions as they are name-based. Again, test this as for example platforms like SharePoint will break when setting this key, but nobody runs SharePoint on the same box, so for Exchange this is a valid mitigation.

Organizations are advised not to blindly implement mitigations mentioned in Mollema’s article or elsewhere in the field, as they might not be applicable to every deployment out there, or have unforseen side-effects. Then again, organizations might already have things deployed SMB signing, in which case the exploit does not apply.

Update (Feb6): Meanwhile, Microsoft Security Response Center published an advisory (ADV190007) containing guidance on how to deal with the issue at this moment. MSRC takes the EWS Throttling Policy route to block EWS Subscriptions at the original level, which of course breaks Outlook for Mac functionality (e.g. new mail notifications as the client can no longer subscribe to receive updates), or other applications which rely on this mechanism (e.g. meeting room systems). This can be mitigated by explicitly allowing EWS subscriptions for trusted users and applications.

Update (Feb13): Today the quarterly cumulative updates for Exchange 2019/2016/2013 were released, which will remove the DisableLoopbackCheck key (when present).

Security Updates Exchange 2013, 2016 & 2019

Posted on January 14, 2019 by Michel de Rooij

Update 14jan: Added Exchange 2010 SP3 RU25

A quick heads-up as during my vacation Microsoft released security updates for supported releases of Exchange Server 2013, 2016 as well as Exchange Server 2019. In addition, a new Rollup was released for Exchange 2010 as well, containing one of the security updates.

The security updates patch issues as reported in the following Microsoft Common Vulnerabilities and Exposures:

CVE-2019-0586: Microsoft Exchange Memory Corruption Vulnerability
CVE-2019-0588: Microsoft Exchange Information Disclosure Vulnerability

You can download the security updates here:

Security Update For Exchange Server 2013 CU21 (v15.0.1395.10, KB4471389)
Security Update For Exchange Server 2016 CU10 (v15.1.1531.10, KB4471389)
Security Update For Exchange Server 2016 CU11 (v15.1.1591.13, KB4471389)
Security Update For Exchange Server 2019 (v15.2.221.14, KB4471389)
Exchange Server 2010 SP3 Rollup 25 (v14.3.435.0, KB4468742)

Notes:

Exchange 2010 SP3 RU25 addresses CVE-2019-0588 only.
KB4471389 supersedes KB4468741 and KB4459266; KB4468742 supersedes KB4458321.

Be advised that the Security Updates for Exchange 2013 and 2016 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU10 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you archive it, e.g. Exchange2016-KB4471389-x64-en-CU10.msp.

As with any patch or update, I’d recommend to thoroughly test this in a test and acceptance environment first, prior to implementing it in production.

Security Updates for Exchange 2016, 2013 and 2010

Posted on August 20, 2018 by Michel de Rooij

A quick heads-up as during my vacation Microsoft released security updates for supported releases of Exchange Server 2016 and 2013 as well as Exchange Server 2010.

The security updates patch issues as reported in the following Microsoft Common Vulnerabilities and Exposures:

CVE-2018-8302 Microsoft Exchange Memory Corruption Vulnerability
CVE-2018-8374 Microsoft Exchange Server Tampering Vulnerability (Exchange 2016 only)

You can download the security updates here:

Security Update for Exchange Server 2016 CU10 (v15.1.1531.6, KB4340731)
Security Update for Exchange Server 2016 CU9 (v15.1.1466.10, KB4340731)
Security Update for Exchange Server 2013 CU21 (v15.0.1395.7, KB4340731)
Security Update for Exchange Server 2013 CU20 (v15.0.1367.9, KB4340731)
Exchange 2010 SP3 Rollup 23 (v14.3.417.1, KB4340733)

Notes:

Be advised that Exchange 2010 SP3 Rollup 23, like recent Cumulative Updates of Exchange 2016 and 2013, requires Visual C++ Redistributable Packages for Visual Studio 2013 (download).
KB4340731 supersedes the previous security update KB4092041 for Exchange 2016 and Exchange 2013.

Be advised that for Exchange 2013 and 2016, Security Updates are Cumulative Update level specific. While the downloaded security updates may carry the same name, the files are different and you cannot apply the downloaded security update file for Exchange 2016 CU8 to Exchange 2016 CU9. I suggest adding some form of identification of the Cumulative Update to the file name when you archive it, e.g. Exchange2016-KB4340731-x64-en-CU10.msp.

As with any patch or update, I’d recommend to thoroughly test this in a test and acceptance environment first, prior to implementing it in production.

MVP’s around the World

Posted on July 2, 2018 by Michel de Rooij

Updated July 3rd: Includes newly registered awardees and awardees who changed category. Added overview of Office Servers and Services numbers over last couple of years.

With the latest annual award cycle, one might be curious which impact it had on the MVP population. I performed a similar exercise last year to compare the impact of the start of the new award cycle. This year, all the MVP’s previously on the January and October cycles were also included in the reviews, making this year the first one where MVP leads and others had to perform the dauntless task of reviewing community contributions of over 3,500 people.

For comparison, I had a look at the public MVP statistics of July 1st against those of June 26th, to exclude significant noise from the monthly awardees. To start, let us first have a look at the total population of MVP’s. From the numbers, it is clear some type of correction took place, as the total number of MVP’s went down from 3,815 last month to 3,025 now (-21%).

As big changes might be a result of change of focus, the following table contains the changes per award category from June 2018 to July 2018. Note that the total number of MVP’s doesn’t equal the total number of awardees, as people can be awarded in more than one category; there are 50 MVP’s with multiple award categories.

Competence	Jun2018	July2018	Change
Access	39	29	-26%
AI	28	58	107%
Business Solutions	221	184	-17%
Cloud and Datacenter Management	410	302	-26%
Data Platform	442	366	-17%
Enterprise Mobility	159	122	-23%
Excel	103	84	-18%
Microsoft Azure	370	368	-1%
Office Development	44	33	-25%
Office Servers and Services	490	383	-22%
OneNote	15	12	-20%
Outlook	14	11	-21%
PowerPoint	40	34	-15%
Visio	15	10	-33%
Visual Studio and Development Technologies	1043	780	-25%
Windows and Devices for IT	136	87	-36%
Windows Development	273	186	-32%
Word	23	19	-17%
Total	3865	3066	-21%

Except for the AI MVP’s, all the numbers are down. Way down. Word is quite a number of long-standing MVP’s have not been re-awarded this cycle. One could only guess for the motivation (only Microsoft knows), but it could be due to the ongoing shift from on-premises technology to cloud-based technology.

When zooming in on the Office Servers and Services MVP’s category, the awards per country is shown in the following heath map and table. Be advised that MVP’s that are anonymous or have profiles without location (~23 for Office Servers and Services), are not taken into account since their location is unknown.

Country	Number	Country	Number	Country	Number
Argentina	0 (-100%)	Ireland	1 (0%)	Saudi Arabia	1 (0%)
Australia	17 (-40%)	Israel	0 (-100%)	Serbia	1 (0%)
Austria	2 (0%)	Italy	8 (-20%)	Singapore	3 (-25%)
Belgium	8 (0%)	Japan	11 (-45%)	Slovakia	1 (0%)
Bosnia-Herzegovina	2 (0%)	Jordan	1 (0%)	Slovenia	1 (-50%)
Brazil	2 (-34%)	Korea	6 (-15%)	South Africa	4 (-20%)
Bulgaria	1 (0%)	Latvia	1 (0%)	Spain	5 (-17%)
Canada	29 (-24%)	Macedonia F.Y.R.O	2 (0%)	Sri Lanka	4 (-43%)
Chile	1 (0%)	Malaysia	1 (-50%)	Sweden	6 (-25%)
China	14 (-13%)	Mexico	2 (-50%)	Switzerland	5 (0%)
Colombia	2 (0%)	Nepal	1 (0%)	Thailand	1 (0%)
Croatia	5 (-17%)	New Zealand	4 (-20%)	The Netherlands	13 (-8%)
Czech Republic	3 (-25%)	Norway	5 (-17%)	Turkey	4 (-20%)
Denmark	2 (-50%)	Pakistan	2 (0%)	Ukraine	1 (-50%)
Egypt	1 (-50%)	Peru	1 (-50%)	United Arab Emirates	1 (-50%)
Finland	2 (0%)	Poland	2 (0%)	United Kingdom	23 (-15%)
France	15 (-12%)	Portugal	3 (-25%)	United States	90 (-19%)
Germany	16 (-20%)	Romania	1 (-50%)	Uruguay	1 (0%)
Greece	1 (0%)	Russia	5 (-50%)	Vietnam	0 (-100%)
Hungary	2 (-50%)			TOTAL	383 (-22%)
India	12 (-8%)

As shown, some countries have lost their Office Servers and Service MVP’s completely. Looking at the total number of Office Servers and Services MVP’s over the year, the number went a little up again due to monthly awardees, but with the July cycle, the number of Office Servers and Services MVP’s went from 490 to 383 (-22%).

The number of Office Servers and Services and total number of MVP’s over the last years (since award restructuring).

Month	oct2016	jan2017	jun2017	jul2017	jan2018	jun2018	jul2018
OSS	538	505 (-7%)	532 (+5%)	449 (-16%)	480 (+6%)	490 (+2%)	383 (-21%)
Total	N/A	N/A	4134	3490 (-16%)	3747 (+7%)	3815 (+2%)	3030 (-21%)