Security Updates Exchange 2013-2019 (Jul2021)

Update July 20th: Added VC++2012 requirement to tip on running MT to prepare Exchange 2013 schema separately.

Another month, another Patch Tuesday! A quick blog on the July’s security updates for Exchange Server 2013 up to 2019.

The vulnerabilities addressed in these security updates are:

VulnerabilityCategorySeverityRating
CVE-2021-31196Remote Code Execution ImportantCVSS:3.0 7.2 / 6.3
CVE-2021-34470Elevation of PrivilegeImportantCVSS:3.0 8.0 / 7.0
CVE-2021-33768Elevation of PrivilegeImportantCVSS:3.0 8.0 / 7.0
CVE-2021-31206Remote Code ExecutionImportantCVSS:3.0 7.6 / 7.1

Note:

  • When looking at the MSRC information, you will notice 3 additional CVE issues addressed for July 13th. However, as far as I can see CVE-2021-34473, CVE-2021-34523 and CVE-2021-33766 were addressed in the April 2021 and eventually the May 2021 Security Updates, which also would explain MSRC’s mention of earlier CUs, such as Exchange 2019 CU8.
  • CVE-2021-31206 was the vulnerability discovered at the Pwn2Own 2021 contest.

Vulnerabilities mentioned in the table above are addressed in the following security updates:

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU10Download15.2.922.13KB5004780
Exchange 2019 CU9Download15.2.858.15KB5004780
Exchange 2016 CU21Download15.1.2308.14KB5004779
Exchange 2016 CU20Download15.1.2242.12KB5004779
Exchange 2013 CU23Download15.0.1497.23KB5004778

Notes:

  • CVE-2021-33768 does not seem applicable to Exchange 2019 CU9 or Exchange 2016 CU20.
  • CVE-2021-34470 is only addressed in the security update for Exchange 2013 CU23.

More detailed information can be found at the original blog post here, which mentions some specific post-deployment instructions:

  • When running n-1 CU of Exchange 2019 (CU9) or Exchange 2016 (CU20), and you do not plan to upgrade to the latest CU yet but do wish to install this Security Update, you must also update the AD Schema using the CU10 or CU21 installation files.
  • When you are running Exchange 2013 CU23 in your organization, and no later Exchange builds are present, you need to deploy a schema update immediately after deploying the Security Update. After deploying the SU, from an elevated CMD prompt, run Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms from Exchange’s bin folder. You you need to separate the update from deploying the update, see end of article for a tip.

The blog also mentions some issues, which are identical to the ones mentioned with the May 2021 Security Updates:

  • Accounts ending in ‘$’ cannot use EMS or access the ECP.
  • Cross-forest Free/Busy might stop working resulting in 400 Bad Request (solution).
  • Running cmdlets against EMC using invoked runspace might result in no-language mode error (info).

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU9 to Exchange 2019 CU8. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU9-KBXXXXXX-x64-en.msp.

On another note, after deploying the security updates Exchange will start reporting its version number in the HTTP response header.

As a reminder, run the Security Update from an elevated command prompt to prevent issues during installation. In other words: Do not just double-click on the .MSP file. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates, and follow a more agile approach. The rating implies a form of urgency.

OWA/ECP and HMAC errors
There are reports of the Security Update breaking OWA/ECP. Symptoms are browsers displaying an HMAC error:

Server Error in '/owa' Application.

ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
    
Exception Details: Microsoft.Exchange.Diagnostics.ExAssertException: ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1

It is likely related to “Microsoft Exchange Server Auth Certificate”, which can be expired, invalid or for other reasons not being picked up. The reported solution is renewing the “Microsoft Exchange Server Auth Certificate”. This procedure can be found here. Do note that it may take an hour for the certificate to become effective. Meanwhile, you can check the comments in the original Exchange Team post, which is lively with feedback and responses.

Exchange 2013 CU23 SU & Schema Updating
Because with Exchange 2013 CU23 schema preparation needs to occur immediately after deploying the SU on (the first) Exchange 2013 CU23 server, a tip might be that you could deploy Exchange 2013 CU23 Management Tools on a workstation, install the SU on that workstation, then run the PrepareSchema from there before deploying the SU on any Exchange 2013 CU23 server.

This might also be helpful in multi-domain organizations, or organizations where AD and Exchange are managed by different teams or require separate changes. Note that performing the schema update this way requires Visual C++ 2012 Runtime, otherwise you will run into a “Exchange Server setup didn’t complete the operation” and the ExchangeSetup.log will contain “Could not load file or assembly ‘Microsoft.Exchange.CabUtility.dll”.

Exchange Updates – June 2021

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 and Exchange 2016. Biggest change for both editions is support for Anti-Malware Scan Interface (AMSI) integration, available on Windows Server 2016 and Windows Server 2019. It allows real-time scanning of HTTP payloads, blocking known malicious content before it reaches Exchange.

Links to the updates as well as a description of changes and fixes are described below. The column Schema and AD indicate if the CU contains Schema (/PrepareSchema) and Active Directory (PrepareAD) changes compared to the previous CU.

VersionBuildKBDownloadUMLPSchemaAD
Exchange 2019 CU1015.2.922.7KB5003612 Download YY
Exchange 2016 CU21 15.1.2308.8 KB5003611 DownloadUMLPYY

Exchange 2019 CU10 fixes:

  • 5004612 Message body not displayed in OWA if the message was added in Outlook to a new mailbox
  • 5004613 OutOfMemory exception when moving a public folder that has a large ICS sync state
  • 5004614 Korean text is garbled in calendar invitation to a user with a Chinese display name
  • 5004615 “InvalidOperationException” and Store Worker process crashes during mailbox move
  • 5004616 Changing the email address in EAC doesn’t work in modern browsers
  • 5004617 TLS 1.2 is not set as default after you install Exchange 2019 with Edge Transport role
  • 5004618 MSExchangeMailboxAssistants 4999 Crash in ELCAssistant.InvokeInternalAssistant with System.NullReferenceException
  • 5004619 Mailbox creation through ECP fails after installing Exchange Server 2019 or 2016 April update
  • 5004622 “Cannot Send Mail – Your mailbox is full” error when you use iPhone mail to send very large attachments
  • 5004623 PrepareADSchema required because of Active Directory schema change

Exchange 2016 CU21 fixes:

  • 5004612 Message body not displayed in OWA if the message was added in Outlook to a new mailbox
  • 5004613 OutOfMemory exception when moving a public folder that has a large ICS sync state
  • 5004614 Korean text is garbled in calendar invitation to a user with a Chinese display name
  • 5004615 “InvalidOperationException” and Store Worker process crashes during mailbox move
  • 5004616 Changing the email address in EAC doesn’t work in modern browsers
  • 5004618 MSExchangeMailboxAssistants 4999 Crash in ELCAssistant.InvokeInternalAssistant with System.NullReferenceException
  • 5004619 Mailbox creation through ECP fails after installing Exchange Server 2019 or 2016 April update
  • 5004622 “Cannot Send Mail – Your mailbox is full” error when you use iPhone mail to send very large attachments
  • 5004623 PrepareADSchema required because of Active Directory schema change
  • 5004629 No version updating after you install Exchange Server 2016

Notes:

  • If these Cumulative Updates contain schema changes compared to the Cumulative Update you have deployed, you need to run Setup with /PrepareSchema. If they contain Active Directory changes, you need to run /PrepareAD. Alternatively, permissions permitting, you can let Setup perform this step. Consult the Exchange schema versions page for version number comparison.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), support requires you to trail at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once upgraded, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The recommended upgrade order is internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – March 2021

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Be advised that both of these CUs include the March security update KB5000871. AExchange 2016 will receive its final CU in March, 2021.

Links to the updates as well as a description of changes and fixes are described below. The column Schema and AD indicate if the CU contains Schema (/PrepareSchema) and Active Directory (PrepareAD) changes compared to the previous CU.

VersionBuildKBDownloadUMLPSchemaAD
Exchange 2019 CU915.2.858.2KB4602570Download NY
Exchange 2016 CU2015.1.2242.4KB4602569DownloadUMLPNY

Exchange 2019 CU9 fixes:

  • 5001181 Certain search scenario can’t return expected result in Outlook online mode in Exchange Server 2019
  • 5001182 Can’t use keyword “TMM” in a special pattern to search email in Exchange Server 2019
  • 5001183 Attachment is treated as bad zip file on Edge Transport server in Exchange Server 2019 and 2016
  • 5001184 EAC has no option to select the correct tenant for an Office 365 mailbox in Exchange Server 2019 and 2016
  • 5001185 EAC has no option to select an archive domain for cloud-based archive in Exchange Server 2019 and 2016
  • 5001186 Encoding of special characters isn’t preserved which causes missing text in Outlook in Exchange Server 2019 and 2016
  • 5001188 Incorrect MRM properties stamped on mail item delivery when sending to multiple mailboxes on the same database in Exchange Server 2019 and 2016
  • 5001189 Mailbox Audit log searches and Outlook both tied to MaxHitsForFullTextIndexSearches in Exchange Server 2019 and 2016
  • 5001190 MonitoringGroup can’t control the placement of CAS monitoring mailboxes in Exchange Server 2019 and 2016
  • 5001192 Microsoft Teams fails to show calendar because Autodiscover v2 isn’t site-aware in Exchange Server 2019 and 2016
  • 5001193 New health mailboxes for databases are created every time Exchange Health Manager service is restarted
  • 5001194 RFC certificate timestamp validation in Exchange Server 2019 and 2016
  • 5001195 UPN specified when creating mailbox is overwritten automatically causing login failures in Exchange Server 2019 and 2016
  • 5000631 Event IDs 1003, 1309 and 4999 are logged after installing Exchange Server 2019 CU8
  • 4583558 PDF preview function in OWA leads to download action unexpectedly

Exchange 2016 CU20 fixes:

  • 5001183 Attachment is treated as bad zip file on Edge Transport server in Exchange Server 2019 and 2016
  • 5001184 EAC has no option to select the correct tenant for an Office 365 mailbox in Exchange Server 2019 and 2016
  • 5001185 EAC has no option to select an archive domain for cloud-based archive in Exchange Server 2019 and 2016
  • 5001186 Encoding of special characters isn’t preserved which causes missing text in Outlook in Exchange Server 2019 and 2016
  • 5001188 Incorrect MRM properties stamped on mail item delivery when sending to multiple mailboxes on the same database in Exchange Server 2019 and 2016
  • 5001189 Mailbox Audit log searches and Outlook both tied to MaxHitsForFullTextIndexSearches in Exchange Server 2019 and 2016
  • 5001190 MonitoringGroup can’t control the placement of CAS monitoring mailboxes in Exchange Server 2019 and 2016
  • 5001192 Microsoft Teams fails to show calendar due to Autodiscover v2 isn’t site aware in Exchange Server 2019 and 2016
  • 5001193 New health mailboxes for databases are created every time Exchange Health Manager service is restarted
  • 5001194 RFC certificate timestamp validation in Exchange Server 2019 and 2016
  • 5001195 UPN specified when creating mailbox is overwritten automatically causing login failures in Exchange Server 2019 and 2016
  • 4583558 PDF preview function in OWA leads to download action unexpectedly

Notes:

  • If these Cumulative Updates contain schema changes compared to the Cumulative Update you have deployed, you need to run Setup with /PrepareSchema. If they contain Active Directory changes, you need to run /PrepareAD. Alternatively, permissions permitting, you can let Setup perform this step. Consult the Exchange schema versions page for object version numbers.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), support requires you to trail at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once upgraded, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The recommended upgrade order is internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – December 2020

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Be advised that Exchange 2016 will receive its final CU in March, 2021.

Links to the updates as well as a description of changes and fixes are described below.

VersionBuildKBDownloadUMLPSchemaPrepareAD
Exchange 2019 CU815.2.792.3KB4588885VLSC NY
Exchange 2016 CU1915.1.2176.2KB4588884DownloadUMLPNY

Exchange 2019 CU8 fixes:

  • 4588297 Attachments can’t be downloaded or previewed from Outlook Web App
  • 4583531 Design change about inline images will be forced to download but not open in a new tab of OWA in Exchange Server 2019
  • 4583532 ELC MRM archiving fails due to DomainName in AuthServer in Exchange Server 2019
  • 4583533 Exchange Server 2019 installation fails with error “The user has insufficient access rights” 
  • 4583534 Event ID 65535 System.Runtime.Serialization errors in Application log in Exchange Server 2019
  • 4583535 New-Moverequest, Resume-Moverequest, and Remove-Moverequest not logged in Audit logs in Exchange Server 2019
  • 4583536 Set-MailboxFolderPermission is included in Mail Recipient Creation in Exchange Server 2019
  • 4583537 Update Korean word breaker in Exchange Server 2019
  • 4583538 Microsoft Teams REST calls exceed the default value of maxQueryStringLength in Exchange Server 2019
  • 4583539 Non-breaking space is visible in message body in Outlook in Exchange Server 2019
  • 4583542 Server assisted search in Outlook doesn’t return more than 175 items in Exchange Server 2019
  • 4583544 Lots of LDAP requests for FE MAPI w3wp lead to DDoS on DCs in Exchange Server 2019
  • 4583545 Make DomainName in Authserver a multivalued parameter in Exchange Server 2019
  • 4593465 Description of the security update for Microsoft Exchange Server 2019 and 2016: December 8, 2020

Exchange 2016 CU19 fixes:

  • 4588297 Attachments can’t be downloaded or previewed from Outlook Web App
  • 4583531 Design change about inline images will be forced to download but not open in a new tab of OWA in Exchange Server 2016
  • 4583532 ELC MRM archiving fails due to DomainName in AuthServer in Exchange Server 2016
  • 4583533 Exchange Server 2016 installation fails with error “The user has insufficient access rights” 
  • 4583534 Event ID 65535 System.Runtime.Serialization errors in Application log in Exchange Server 2016
  • 4583535 New-Moverequest, Resume-Moverequest, and Remove-Moverequest not logged in Audit logs in Exchange Server 2016
  • 4583536 Set-MailboxFolderPermission is included in Mail Recipient Creation in Exchange Server 2016
  • 4583537 Update Korean word breaker in Exchange Server 2016
  • 4583538 Microsoft Teams REST calls exceed the default value of maxQueryStringLength in Exchange Server 2016
  • 4583539 Non-breaking space is visible in message body in Outlook in Exchange Server 2016
  • 4583545 Make DomainName in Authserver a multivalued parameter in Exchange Server 2016
  • 4593465 Description of the security update for Microsoft Exchange Server 2019 and 2016: December 8, 2020

Notes:

  • These Cumulative Updates contain schema changes compared to the previous Cumulative Update. This requires you to run /PrepareSchema. Also, Active Directory changes require you to run PrepareAD (which also can perform the schema update, depending permissions). Consult the Exchange schema versions page for object version numbers.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are allowed to trail at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Security Updates Exchange 2010-2019 (Dec2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released December 8th. These fixes address the following vulnerability:

Exchange 2016 / 2019

  • CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17141: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17143: Microsoft Exchange Information Disclosure Vulnerability

Exchange 2013

  • CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17143: Microsoft Exchange Information Disclosure Vulnerability

Exchange 2010

  • CVE-2020-17144: Microsoft Exchange Remote Code Execution Vulnerability

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.6KB4593465KB4588741
Exchange 2019 CU6Download15.2.659.11KB4593465KB4588741
Exchange 2016 CU18Download15.1.2106.6KB4593465KB4588741
Exchange 2016 CU17Download15.1.2044.12KB4593465KB4588741
Exchange 2013 CU23Download15.0.1497.10KB4593466
Exchange 2010 SP3 RU31 Download14.3.509.0KB4593467

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013-2019 (Nov2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released November 10th. These fixes address the following vulnerability:

  • CVE-2020-17085: Microsoft Exchange Server Denial of Service Vulnerability
  • CVE-2020-17084: Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2020-17083: Microsoft Exchange Server Remote Code Execution Vulnerability

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.4KB4588741KB4581424
Exchange 2019 CU6Download15.2.659.8KB4588741KB4581424
Exchange 2016 CU18Download15.1.2106.4KB4588741KB4581424
Exchange 2016 CU17Download15.1.2044.8KB4588741KB4581424
Exchange 2013 CU23Download15.0.1497.8KB4588741KB4581424

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013-2019 (Oct2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released October 13th. These fixes address the following vulnerability:

  • CVE-2020-16969: Microsoft Exchange Information Disclosure Vulnerability
    An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.

    To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.

    The security update corrects the way that Exchange handles these token validations.

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.3KB4581424KB4577352
Exchange 2019 CU6Download15.2.659.7KB4581424KB4577352
Exchange 2016 CU18Download15.1.2106.3KB4581424KB4577352
Exchange 2016 CU17Download15.1.2044.7KB4581424KB4577352
Exchange 2013 CU23Download15.0.1497.7KB4581424KB4536988

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2016-CU17-KB4581424-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Exchange Updates – September 2020

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Like recent Cumulative Updates for these products, they require .NET Framework 4.8. Apart from fixes as well as security updates included from the previous CU, the Exchange 2019 CU7 also comes with an update for the Exchange Sizing Calculator.

Links to the updates as well as a description of changes and fixes are described below.

VersionBuildKBDownloadUMLPSchemaPrepareAD
Exchange 2019 CU715.2.721.2KB4571787VLSC NY
Exchange 2016 CU1815.1.2106.2KB4571788DownloadUMLPNY

Exchange 2019 CU7 fixes:

  • 4570248 Get-CASMailbox uses wrong LDAP filter for ECPEnabled in Exchange Server 2019
  • 4576652 Updates for Exchange Server 2019 Sizing Calculator version 10.5
  • 4570252 Intermittent poison messages due to NotInBagPropertyErrorException in Exchange Server 2019
  • 4576649 System.InvalidCastException when you change passwords in Outlook on the web in Exchange Server 2019
  • 4570251 Inbox rule applying a personal tag doesn’t stamp RetentionDate in Exchange Server 2019
  • 4570245 ESEUtil /p fails if any long value (LV) is corrupted in Exchange Server 2019
  • 4570255 NullReferenceException occurs when running TestFederationTrust in Exchange Server 2019
  • 4576650 Can’t add remote mailbox when setting email forwarding in Exchange Server 2019 Hybrid environment
  • 4570253 CompletedWithErrors without details for mailbox migration batches in Exchange Server 2019
  • 4570247 CSV log of Discovery export fails to properly escape target path field in Exchange Server 2019
  • 4570246 EdgeTransport crashes with Event ID 1000 (exception code 0xc00000fd) in Exchange Server 2019
  • 4570254 MSExchangeMapiMailboxAppPool causes prolonged 100% CPU in Exchange Server 2019
  • 4563416 Can’t view Online user free/busy status in Exchange Server 2019
  • 4576651 Can’t join Teams meetings from Surface Hub devices after installing Exchange Server 2019 CU5
  • 4577352 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 8, 2020

Exchange 2016 CU18 fixes:

  • 4570248 Get-CASMailbox uses wrong LDAP filter for ECPEnabled in Exchange Server 2016
  • 4570252 Intermittent poison messages due to NotInBagPropertyErrorException in Exchange Server 2016
  • 4576649 System.InvalidCastException when you change passwords in Outlook on the web in Exchange Server 2016
  • 4570251 Inbox rule applying a personal tag doesn’t stamp RetentionDate in Exchange Server 2016
  • 4570245 ESEUtil /p fails if any long value (LV) is corrupted in Exchange Server 2016
  • 4570255 NullReferenceException occurs when you run TestFederationTrust in Exchange Server 2016
  • 4576650 Can’t add remote mailbox when setting email forwarding in Exchange Server 2016 Hybrid environment
  • 4570253 CompletedWithErrors without details for mailbox migration batches in Exchange Server 2016
  • 4570247 CSV log of Discovery export fails to properly escape target path field in Exchange Server 2016
  • 4570246 EdgeTransport crashes with Event ID 1000 (exception code 0xc00000fd) in Exchange Server 2016
  • 4570254 MSExchangeMapiMailboxAppPool causes prolonged 100% CPU in Exchange Server 2016
  • 4563416 Can’t view Online user free/busy status in Exchange Server 2016
  • 4576651 Can’t join Teams meetings from Surface Hub devices after installing Exchange Server 2016 CU16
  • 4577352 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 8, 2020

Notes:

  • These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
  • There are Active Directory changes requiring you to run PrepareAD. Consult the Exchange schema versions page for object version numbers.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are allowed to trail at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – March 2020

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Like the previous Cumulative Updates, these require .NET Framework 4.8. Apart from fixes as well as security updates included from the previous CU, these update contain the following changes for Exchange 2019 CU5:

  • Updated Exchange calculator (v10.4).
  • Fixes an issue with Manage-MetaCacheDatabase.ps1 to configure MCDB.
  • Fixes partial word searches when using Outlook in online mode.

Links to the updates as well as a description of changes and fixes are described below.

VersionBuildKBDownloadUMLPSchema
Exchange 2019 CU515.2.595.3KB4537677VLSC N
Exchange 2016 CU1615.1.1979.3KB4537678DownloadUMLPN

Exchange 2019 CU5 fixes:

  • 4552472 Exchange Server 2019 Sizing Calculator version 10.4 is available
  • 4536552 Export-ModernPublicFolderStatistics.ps1 is not working in Exchange Server 2019
  • 4538303 Exchange 2019 Setup Prerequisite Check fails for .NET 4.8 Framework in CU4 on Windows builds 1909 and 1903
  • 4547705 Authentication loop between msft.sts.microsoft.com/adfs and OWA in Exchange Server 2019
  • 4547706 Birthday isn’t correctly synced to iOS native mail app in Exchange Server 2019
  • 4547708 Elevation of privileges possible when Active Directory permissions role is granted in Exchange Server 2019
  • 4547709 InternetWebProxyBypassList is ignored by Mailbox Replication service in Exchange Server 2019
  • 4547710 New-MailboxSearch with In-Place Hold enabled replaces all values in msExchUserHoldPolicies if adding a value in Exchange Server 2019
  • 4547711 Public folder permissions aren’t applied from Outlook in Exchange Server 2019 hybrid environment
  • 4547712 Outlook on the web (OWA) exposes junk operations even if disabled via OwaMailboxPolicy in Exchange Server 2019
  • 4547713 IsOnlineMeeting is always false for Teams-only meetings in Exchange Server 2019
  • 4547714 Can’t add remote shared mailbox using ECP into distribution group in Exchange Server 2019 hybrid environment
  • 4547715 New created search folder retention policy is changed in Exchange Server 2019
  • 4547719 MCDB status is “Offline” and SSDs are not formatted in Exchange Server 2019
  • 4547720 Partial word searches not working for mailboxes in Outlook online mode in Exchange Server 2019
  • 4547721 Exchange Sizing Calculator still supports mail.que database over 2 TB in Exchange Server 2019
  • 4547722 Can’t go from Office 365 to Enterprise in Exchange Server 2019 Exchange admin center (EAC) if Chrome SameSite Cookie is enabled
  • 4547723 Can’t sign in to Office 365 if configuring hybrid with Chrome SameSite Cookie enabled in Exchange Server 2019
  • 4536987 Description of the security update for Microsoft Exchange Server 2019: February 11, 2020

Exchange 2016 CU16 fixes:

  • 4547705 Authentication loop between msft.sts.microsoft.com/adfs and OWA in Exchange Server 2016
  • 4547706 Birthday isn’t correctly synced to iOS native mail app in Exchange Server 2016
  • 4547708 Elevation of privileges possible when Active Directory permissions role is granted in Exchange Server 2016
  • 4547709 InternetWebProxyBypassList is ignored by Mailbox Replication service in Exchange Server 2016
  • 4547710 New-MailboxSearch with In-Place Hold enabled replaces all values in msExchUserHoldPolicies if adding a value in Exchange Server 2016
  • 4547711 Public folder permissions aren’t applied from Outlook in Exchange Server 2016 hybrid environment
  • 4547712 Outlook on the web (OWA) exposes junk operations even if disabled via OwaMailboxPolicy in Exchange Server 2016
  • 4547713 IsOnlineMeeting is always false for Teams-only meetings in Exchange Server 2016
  • 4547714 Can’t add remote shared mailbox by using ECP into distribution group in Exchange Server 2016 hybrid environment
  • 4547715 New created search folder retention policy is changed in Exchange Server 2016
  • 4547722 Can’t go from Office 365 to Enterprise in Exchange Server 2016 Exchange admin center (EAC) if Chrome SameSite Cookie is enabled
  • 4547723 Can’t sign in to Office 365 if configuring hybrid with Chrome SameSite Cookie enabled in Exchange Server 2016
  • 4547716 Event ID 1325 and Test-ExchangeSearch crashes application pool with NullReferenceException in Exchange Server 2016
  • 4536987 Description of the security update for Microsoft Exchange Server 2016: February 11, 2020

Notes:

  • These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – Sep. 2019

Exchange2019LogoToday, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. The fixes in each release, product downloads are described below:

VersionBuildKBDownloadUMLPSchema
Exchange 2019 CU315.2.464.5KB4514141VLSC N
Exchange 2016 CU1415.1.1847.3KB4514140DownloadUMLPN

Exchange 2019 CU3 fixes:

  • 4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2019
  • 4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2019 and 2016
  • 4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2019 and 2016
  • 4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2019 and 2016
  • 4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2019 and 2016
  • 4515269 SentToMemberOf shows every recipient type not distribution groups when you create transport rule in Exchange Server 2019 and 2016
  • 4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2019 and 2016
  • 4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2019 and 2016
  • 4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2019 and 2016
  • 4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2019 and 2016
  • 4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2019 and 2016
  • 4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2019 and 2016
  • 4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2019 and 2016
  • 4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2019 and 2016
  • 4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2019 and 2016
  • 4515273 Mailbox auditing fails when using SHA1Managed in Exchange Server 2019 and 2016
  • 4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2019 and 2016
  • 4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2019 and 2016
  • 4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Exchange 2016 CU14 fixes:

  • 4515255 â€śX-InnerException: Microsoft.Mapi.MapiExceptionRpcServerTooBusy” error when you try to use a mailbox in Exchange Server 2016
  • 4515254 Event 1009 frequently occurs in application logs for lagged database copies in Exchange Server 2016
  • 4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2016
  • 4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2016
  • 4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2016
  • 4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2016
  • 4515269 SentToMemberOf shows every recipient type not distribution groups when creating transport rule in Exchange Server 2016
  • 4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2016
  • 4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2016
  • 4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2016
  • 4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2016
  • 4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2016
  • 4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2016
  • 4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2016
  • 4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2016
  • 4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2016
  • 4515273 Mailbox auditing fails when you use SHA1Managed in Exchange Server 2016
  • 4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2016
  • 4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2016
  • 4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Notes:

  • These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.