A short blog on the EWS Managed API and using the latest version with scripts leveraging Exchange Web Services (EWS), such as my Remove-DuplicateItems script. The installable EWS Managed API library was last updated in 2014 (version 2.2, reports as v15.0.913.22), and there have been few enhancements since then. These are included in the EWS.WebServices.Managed.Api package, which carries version 2.2.1.2.
Although this library was last updated in 2019, you might still need it to successfully run EWS scripts. The EWS.WebServices.Managed.Api package supports some Exchange Web Services calls which are not supported in the 2.2 version, and may lead to error messages like Exception calling “FindFolders” with “2” argument(s) or other messages related to the (number of) arguments. This may be an indication a particular call was used to one of the EWS functions, but which is not supported by the installed EWS Managed API library. In those cases, installing this updated library might help.
The library is published on NUGet as a package. To install the package, we first need to register NuGet as a Package Source:
Next, install the package from the newly defined NuGet source:
Install-Package Exchange.WebServices.Managed.Api
The package installs by default under C:\Program Files\PackageManagement\NuGet\Packages. I have updated my scripts to include this location when searching for the required Microsoft.Exchange.WebServices.dll as well. Alternatively, you can copy this DLL from the ..\Exchange.WebServices.Managed.Api.<Version>\lib\net35 folder to the location where the script resides. When running my EWS-based scripts in Verbose mode, it will report as version 2.2.1.0.
Hopefully this blog will potentially save you some time troubleshooting, and myself answering some support messages. Enjoy!
Last Update: Added points from Exchange Online Transport – Manage Email, Optics, End User Experiences.
It shouldn’t come as a surprise that this year’s Ignite event is very different than previous years. However what is also different is that at this year’s digital experience, product groups lined up articles and pre-recorded sessions with deep-dive level 300-400 contents as well as articles to accompany those. The sessions, which are available through the Virtual Hub, were all launched right after the start of the event, including the prepared articles. Speaking of a flood flood of contents to digest.
To ease digesting all this information related to Exchange without going through all the videos and blogs, I prepared a summary of all the announcements made at and during Ignite for your reference. For reference, links to the original articles and sessions are at the bottom of this article. The list might not be conclusive; if you find something missing, let me know.
Exchange vNext
Exchange Server vNext is scheduled for H2/2021, and will be subscription-based.
Will support in-place upgrades from Exchange Server 2019, just like installing another Cumulative Update. Which makes you think, maybe it is just a CU with a high version offset to avoid clashing with its predecessor.
Support for this in-place upgrade process is limited to 2 years after release of vNext. If everything goes to plan, this means upgrades will be supported from Exchange 2019 CU11/12-CU19/20 to Exchange vNext RTM-CU8/9.
Will support co-existence with Exchange Server 2013, 2016 and 2019, which is 1 down-level more than previous editions (n-3 support instead of n-2).
Customers staying on-premises are recommended to upgrade to Exchange Server 2019 today, so they can benefit from an in-place upgrade to vNext when it gets released.
Exchange Online Management PowerShell module is now GA (v2.0.3). This module contains cmdlets leveraging Graph which can show significant performance enhancements in larger tenants, supports certificate-based authentication a.o.
Exchange Online Management PowerShell preview module (v2.0.4) supports Linux and PowerShell Core.
Cross-tenant migration of mailboxes is now in Public Preview. Separate programs for cross-tenant SharePoint Online and OneDrive for Business will also launched (register for private preview at aka.ms/SPOMnAPreview). An Azure Key Vault subscription is required on the target tenant. Management of these moves is done from PowerShell, after setting things up with some MSFT scripts which you can grab from GitHub here.
Message Recall to orchestrate recall of message in Exchange Online as announced at Ignite 2019 is expected later this year (Q4/2020).
Admins can toggle the new Exchange Admin Center (was already in preview). It will become the default in Q1/2021.
The new Exchange Admin Center is also tailored for use on mobile browsers.
Outbound mail flow now supports MTA-STS (MTA Strict Transport Security).
The new Exchange Admin Center will host all mail flow related management options, which will be consolidated from the earlier Admin Center as well as the Security & Compliance Center.
The new Exchange Admin Center will get new mail flow insights and notifications, such as early certificate expiration notifications or detected reply-to-all storms.
Option to reduce message expiration timeout interval from the current default of 24 hours.
Administrators get the option to block users from moving groups (distribution groups as well as Microsoft 365 Groups) to the BCC line, which might break receivers’ inbox rules (Q1/2021).
Entitled organizations can appoint Priority Users. Priority Users are critical mailboxes that are monitored for mail flow issues. Requires minimum of 10,000 Office 365 E3 or E5 or Microsoft 365 E3 or E5 licenses with at least 50 monthly active Exchange Online users.
Microsoft 365 Network Connectivity functionality goes into preview, which is accessible via the admin portal (Health > Network Connectivity).
The stand-alone Network Connectivity test tool also goes in preview, and is available from connectivity.office.com.
Notifications for expired or soon to expire SSL certificates and Domains (Q4/2020).
Exchange Server 2019 Server Role Requirements Calculator or just Capacity Calculator is now available as separate download (v10.5, link).
Exchange Hybrid
New Exchange Hybrid Configuration Wizard, which will become available later month, will support connecting your Exchange on-premises environment to multiple tenants. Note that multiple Exchange organizations connecting to a single tenant was already an option, as mentioned in the supported Azure AD Connect topologies document (link).
A quick blog on security updates for Exchange Server 2016 and Exchange Server 2019 released September 8th. These fixes address the following vulnerability:
CVE-2020-16875: Exchange Memory Corruption Vulnerability A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised. The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.
The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.
Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2016-CU17-KB4577352-x64-en.msp.
Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.
With the emergency to facilitate working from home due to the Corona pandemic, many organizations were faced with a dilemma. When running Exchange 2013 or some even Exchange 2010 on-premises, and a desire to start using Microsoft Teams, organizations were confronted with the following requirements for integrating Microsoft Teams with Exchange on-premises (source):
Users with mailboxes hosted on-premises must be synchronized to Azure Active Directory.
Running Exchange 2016 Cumulative Update 3 or later on-premises.
OAuth needs to be configured (via Hybrid Configuration Wizard, or manual as MVP fellow Jaap blogged about here).
Recently, an additional requirement was added to explain that for delegates to schedule calendar meetings on behalf of another person, some additional steps are required (steps 2-3 mentioned here).
Now as you might know, Exchange 2010 does not support OAuth authentication. But, by putting Exchange 2016 in front of Exchange 2010, Exchange 2016 can be used for dealing with OAuth authentication, as well as dealing with client traffic as it can down-level proxy to Exchange 2010 for mailboxes hosted on those servers. Looking at these requirements, organizations might conclude that putting Exchange 2016 CU3 in front of their Exchange environment, and configuring OAuth would suffice the requirement to integrate Teams with their Exchange on-premises environment.
Alas, the additional requirement for full Teams integration is that the mailbox server hosting the mailbox should support REST API. Teams leverages Graph REST API calls to interact with mailboxes. In an Hybrid Exchange setup, on-premises mailboxes are identified, and related REST API calls will be directed at the on-premises REST endpoint, landing on your Exchange environment. The requirement for REST API support is something which is not explicitly stated in the Teams integration article, despite my earlier pull request.
It is however stated implicitly in an article on REST support in Hybrid Exchange or the original publication on REST API support in Exchange 2016 CU3 by the Exchange PG, two articles which you might easily have missed or forgotten about. Either way, it states that “All on-premises mailboxes that will use the REST APIs must be located on databases located on Exchange 2016 CU3 servers”.
Thus, with REST API support only being available per Exchange 2016 CU3, Teams will not fully integrate with mailboxes hosted on earlier versions of Exchange. Exchange 2016 can be used to offload OAuth when your mailbox is still on Exchange 2010 (which works fine for Exchange Web Services for Free/Busy, for example), but Exchange 2010 does not support REST API, and thus will never understand those ‘weird’ (proxied) requests landing on /api virtual directory, typical of REST API calls. Consequently, you will see AutodiscoverV2 and REST API calls greeted with a 404:
Typically, first thing users usually will notice missing is the Calendar integration:
Knowing this, the assumption could be that this combination doesn’t work at all, but as often the truth lies somewhere in the middle. You can use Teams when mailboxes are still hosted on pre-Exchange 2016 CU3, if you can live with the limitations. Below I have included a short overview of these, or other noteworthy items. The information is complementary to the How Exchange and Teams interact article. I hope it may help in discussions on what works and what doesn’t.
Disclaimer: Validated with mailbox hosted on Exchange 2010 with Exchange 2016 in front, OAuth and SkypeOnline AppId configured, and using Outlook 2016 C2R. Information may be subject to change. The list may not be conclusive; if you have any additional observations, please leave them in the comments.
Actions
Works
Comment
Create & View Meetings in Teams
No
No Calendar integration as this requires Outlook Calendar REST API. Visual clue is absence of the Calendar button.
Modify User Photo in Teams (client)
No
Doesn’t work when mailbox is hosted in Exchange on-premises.
Call History
Yes
History propagates to mailboxes hosted in Exchange on-premises in ‘Teams Calls’ folder.
Access Outlook Contacts
No
Works only with Exchange Online mailboxes.
Voicemail
Yes
May use & receive voice-mail, but can’t play from Teams.
Free/Busy status
Yes
Uses EWS.
Create & View/Update Teams Meetings from Outlook
Yes
Using default Teams Meeting add-in.
Create Teams Meetings from Outlook as Delegate
No
Teams Scheduler uses AutodiscoverV2 to discover delegate EWS endpoint, and fails. Outlook will display “Sorry, but we can’t connect to the server right now. Please try again later.”
View/Update Teams Meetings from Outlook as Delegate
Yes
EWS is used to fetch and update the calendar item.
MailTips in Teams
No
MailTips like Out of Office are not shown in Teams. MailTips work for Exchange 2016 CU3+.
Create & View Channel Meetings in Teams
No
Doesn’t work when mailbox is hosted in Exchange on-premises.
Share to Teams
No
Doesn’t work when mailbox is hosted in Exchange on-premises.
Of course, the better experience is to be had when your mailbox is hosted on Exchange 2016 CU3 or later (including Exchange 2019), or best when you simply host them in Exchange Online. However, given the circumstances and pressure from the organization to use Teams, that route might not be an option for everyone. Organizations may look at substantial investments in time and resources. In those cases, it might be good to know of alternative less preferable scenarios, and more important, any possible limitations you might encounter when taking a shortcut.
A quick blog on recently published security updates for Exchange Server 2013 up to Exchange Server 2019 and Exchange Server 2010 as well. These fixes address the following vulnerabilities:
CVE-2020-0692: Microsoft Exchange Server Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could gain the same rights as any other user of the Exchange server. This could allow the attacker to perform activities such as accessing the mailboxes of other users. Exploitation of this vulnerability requires Exchange Web Services (EWS) to be enabled and in use in an affected environment. To exploit the vulnerability, an attacker would need to change parameters in the Security Access Token and forward it to a Microsoft Exchange Server, thereby allowing impersonation of another Exchange user. To address this vulnerability, Microsoft has changed the way EWS handles these tokens. This vulnerability does not apply to Exchange 2010.
CVE-2020-0688: Microsoft Exchange Memory Corruption Vulnerability
A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM. The security update addresses the vulnerability by correcting how Microsoft Exchange creates the keys during install.
The CVE documents contain more details on the vulnerabilities. In addition, KB4536989 (Rollup 30) for Exchange 2010 and KB4536988 for Exchange 2013 also fixes the following issue:
KB4540267 MSExchangeDelivery.exe or EdgeTransport.exe crashes in Exchange Server 2013 and Exchange Server 2010
The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.
Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CUs, and you cannot apply the update for Exchange 2016 CU15 to Exchange 2016 CU14. I would suggest tagging the Cumulative Update in the file name used, e.g. Exchange2016-CU15-KB4536987-x64-en.msp.
Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.
The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. One significant change with these updates is the requirement for .NET Framework 4.8, as announced earlier. Also, Exchange 2019 CU4 comes with an updated Exchange calculator. Links to the updates as well as a description of changes and fixes are described below.
4528696 Exchange PowerShell cmdlets take longer time to run in Exchange Server 2019
4528695 Event ID 4009 when using SubjectOrBodyMatchesPatterns on Edge server in Exchange Server 2019
4528694 Can’t open .ics file in Outlook on the web in Exchange Server 2019
4528692 “A parameter was specified that isn’t valid” error when creating transport rule in Exchange Server 2019
4523519 Set-SendConnector doesn’t work for Exchange Server in hybrid scenarios with Edge Server installed
4528688 Only one recipient shows when saving draft by using Exchange ActiveSync version 16.0 in Exchange Server 2019
4528693 Get-CalendarDiagnosticLog is proxied for queries within the same forest in Exchange Server 2019
4528687 NotificationClient logs aren’t purged and consume lots of disk in Exchange Server 2019
4528689 Outlook on the web shows MailTip when recipients equal the large audience size in Exchange Server 2019
4528690 Can’t move or delete folder in Outlook online mode if the destination has a folder with the same name in Exchange Server 2019
4532744 System.ArgumentNullException when you use Set-user to assign block legacy auth policy in Exchange Server 2019
4532747 Address list separation not working for a user without a mailbox in Exchange Server 2019
4523171 Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 12, 2019
Exchange 2016 CU15 fixes:
4515256 “The function cannot be performed…” error when you send a message that’s open for a long time in Exchange Server 2016
4528693 Get-CalendarDiagnosticLog is proxied for queries within the same forest in Exchange Server 2016
4523519 Set-SendConnector doesn’t work for Exchange Server in hybrid scenarios with Edge Server installed
4528690 Can’t move or delete folder in Outlook online mode if the destination has a folder with the same name in Exchange Server 2016
4528687 NotificationClient logs aren’t purged and consume lots of disk in Exchange Server 2016
4528689 Outlook on the web shows MailTip when recipients equal the large audience size in Exchange Server 2016
4528688 Only one recipient shows when saving draft by using Exchange ActiveSync version 16.0 in Exchange Server 2016
4528695 Event ID 4009 when using SubjectOrBodyMatchesPatterns on Edge server in Exchange Server 2016
4528694 Can’t open .ics file in Outlook on the web in Exchange Server 2016
4528692 “A parameter was specified that isn’t valid” error when creating transport rule in Exchange Server 2016
4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2016
4528696 Exchange PowerShell cmdlets take longer time to run in Exchange Server 2016
4532747 Address list separation not working for a user without a mailbox in Exchange Server 2016
4523171 Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: November 12, 2019
Notes:
These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.
Caution:
As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.
Note: KB4515832 supersedes KB4509409 and KB4509408.
Be advised that these Security Updates are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the same update for Exchange 2016 CU13 to Exchange 2016 CU12. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4515832-x64-en_CU11.msp.
As with any patch or update, I’d recommend to apply this in a
acceptance environment first, prior to implementing it in production.
In February, Microsoft released the initial public preview version of the Hybrid Agent. The purpose of the Hybrid Agent, also branded as the “Exchange Modern Hybrid Topology”, is to simplify the process of setting up and deploying Microsoft Exchange Hybrid for Exchange 2010 and later deployments, where full “classic” Exchange Hybrid is not an option.
It can also address scenarios where deploying the Hybrid Agent would satisfy organizational migration requirements. For example, moving mailboxes between Exchange Online and Exchange on-premises while providing rich-coexistence features, but without requiring (re)configuration of the publishing of Exchange services. Other functionality the Hybrid Agent doesn’t offer is mail transport. Future builds of the Hybrid Agent might introduce cross-premises functionality, such as Send As delegations as demonstrated at Microsoft Ignite last year.
This week, the Hybrid Agent Public reached General Availability status. In the following article for ENow, I discuss the major changes in the agent since the initial Preview release.
Today, the Exchange Team released the March updates for Exchange Server 2013 and 2016, as well as Exchange Server 2010 and 2007. The latter will receive its last update, as Exchange 2007 will reach end-of-life April 11, 2017.
As announced in December updates, Exchange 2013 CU16 and Exchange 2016 CU5 require .NET 4.6.2. The recommended upgrade paths:
If you are still on .NET 4.6.1, you can upgrade to .NET 4.6.2 prior of after installing the latest Cumulative Update.
If you are on .NET 4.52, upgrade to Exchange 2016 CU4 or Exchange 2013 CU15 if you are not already on that level, then upgrade to .NET 4.6.2, and finally upgrade to the the latest Cumulative Update.
The Cumulative Updates also include DST changes, which is also contained in the latest Rollups published for Exchange 2010 and 2007.
KB4015665 SyncDelivery logging folders and files are created in wrong location in Exchange Server 2016
KB4015664 A category name that has different case-sensitivity than an existing name is not created in Exchange Server 2016
KB4015663 “The message content has become corrupted” exception when email contains a UUE-encoded attachment in Exchange Server 2016
KB4015662 Deleted inline picture is displayed as attachment after you switch the message to plain text in Exchange Server 2016
KB4015213 Email is still sent to Inbox when the sender is deleted from the Trusted Contacts list in Exchange Server 2016
KB4013606 Search fails on Exchange Server 2016 or Exchange Server 2013
KB4012994 PostalAddressIndex element isn’t returning the correct value in Exchange Server 2016
Exchange 2013 CU16 fixes:
KB4013606 Search fails on Exchange Server 2016 or Exchange Server 2013
Exchange 2010 SP3 RU17 fixes:
KB4014076 Migration ends and errors reported when you on-board or off-board a mailbox through Exchange Online in an Exchange Server 2010 hybrid environment
KB4014075 UNC path does not open in OWA when the path contains non-ASCII characters in an Exchange Server 2010 environment
KB4013917 You cannot search in a shared mailbox through OWA in an Exchange Server 2010 Service Pack 3 (Update Rollup 15 or 16) environment
KB4012911 Culture element is added in the wrong order when you use the ResolveNames operation in EWS in Exchange Server 2010
Notes:
Exchange 2016 CU5 doesn’t include schema changes, however, Exchange 2016 CU5 as well as Exchange 2013 CU16 may introduce RBAC changes in your environment. Where applicable, use setup /PrepareSchema to update the schema or /PrepareAD to apply RBAC changes, before deploying or updating Exchange servers. To verify this step has been performed, consult the Exchange schema overview.
When upgrading your Exchange 2013 or 2016 installation, don’t forget to put the server in maintenance mode when required. Do note that upgrading, before installing the Exchange binaries, setup will put the server in server-wide offline-mode.
Using Windows Management Framework (WMF)/PowerShell version 5 on anything earlier than Windows Server 2016 is not supported. Don’t install WMF5 on your Exchange servers running on Windows Server 2012 R2 or earlier.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are allowed to stay at least one version behind (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly, i.e. no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of upgrading servers with Cumulative Updates is irrelevant.
Caution: As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.
You are reading it correctly: the later Cumulative Updates are not affected. Earlier builds will not receive a security fix, as support is provided up to N-2 generation builds. Reason for Exchange 2013 SP1 being in there is that Service Packs are on a different support scheme.
Note that this Rollup or security fix replaces MS16-108 (kb3184736) – you can install MS13-105 over installations containing this security fix (no need to uninstall it first).
In February, Microsoft released the initial public preview version of the Hybrid Agent. The purpose of the Hybrid Agent, also branded as the “Exchange Modern Hybrid Topology”, is to simplify the process of setting up and deploying Microsoft Exchange Hybrid for Exchange 2010 and later deployments, where full “classic” Exchange Hybrid is not an option.
EighTwOne (821) 