Exchange Updates – March 2020

Posted on March 17, 2020 by Michel de Rooij

The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Like the previous Cumulative Updates, these require .NET Framework 4.8. Apart from fixes as well as security updates included from the previous CU, these update contain the following changes for Exchange 2019 CU5:

Updated Exchange calculator (v10.4).
Fixes an issue with Manage-MetaCacheDatabase.ps1 to configure MCDB.
Fixes partial word searches when using Outlook in online mode.

Links to the updates as well as a description of changes and fixes are described below.

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU5	15.2.595.3	KB4537677	VLSC		N
Exchange 2016 CU16	15.1.1979.3	KB4537678	Download	UMLP	N

Exchange 2019 CU5 fixes:

4552472 Exchange Server 2019 Sizing Calculator version 10.4 is available
4536552 Export-ModernPublicFolderStatistics.ps1 is not working in Exchange Server 2019
4538303 Exchange 2019 Setup Prerequisite Check fails for .NET 4.8 Framework in CU4 on Windows builds 1909 and 1903
4547705 Authentication loop between msft.sts.microsoft.com/adfs and OWA in Exchange Server 2019
4547706 Birthday isn’t correctly synced to iOS native mail app in Exchange Server 2019
4547708 Elevation of privileges possible when Active Directory permissions role is granted in Exchange Server 2019
4547709 InternetWebProxyBypassList is ignored by Mailbox Replication service in Exchange Server 2019
4547710 New-MailboxSearch with In-Place Hold enabled replaces all values in msExchUserHoldPolicies if adding a value in Exchange Server 2019
4547711 Public folder permissions aren’t applied from Outlook in Exchange Server 2019 hybrid environment
4547712 Outlook on the web (OWA) exposes junk operations even if disabled via OwaMailboxPolicy in Exchange Server 2019
4547713 IsOnlineMeeting is always false for Teams-only meetings in Exchange Server 2019
4547714 Can’t add remote shared mailbox using ECP into distribution group in Exchange Server 2019 hybrid environment
4547715 New created search folder retention policy is changed in Exchange Server 2019
4547719 MCDB status is “Offline” and SSDs are not formatted in Exchange Server 2019
4547720 Partial word searches not working for mailboxes in Outlook online mode in Exchange Server 2019
4547721 Exchange Sizing Calculator still supports mail.que database over 2 TB in Exchange Server 2019
4547722 Can’t go from Office 365 to Enterprise in Exchange Server 2019 Exchange admin center (EAC) if Chrome SameSite Cookie is enabled
4547723 Can’t sign in to Office 365 if configuring hybrid with Chrome SameSite Cookie enabled in Exchange Server 2019
4536987 Description of the security update for Microsoft Exchange Server 2019: February 11, 2020

Exchange 2016 CU16 fixes:

4547705 Authentication loop between msft.sts.microsoft.com/adfs and OWA in Exchange Server 2016
4547706 Birthday isn’t correctly synced to iOS native mail app in Exchange Server 2016
4547708 Elevation of privileges possible when Active Directory permissions role is granted in Exchange Server 2016
4547709 InternetWebProxyBypassList is ignored by Mailbox Replication service in Exchange Server 2016
4547710 New-MailboxSearch with In-Place Hold enabled replaces all values in msExchUserHoldPolicies if adding a value in Exchange Server 2016
4547711 Public folder permissions aren’t applied from Outlook in Exchange Server 2016 hybrid environment
4547712 Outlook on the web (OWA) exposes junk operations even if disabled via OwaMailboxPolicy in Exchange Server 2016
4547713 IsOnlineMeeting is always false for Teams-only meetings in Exchange Server 2016
4547714 Can’t add remote shared mailbox by using ECP into distribution group in Exchange Server 2016 hybrid environment
4547715 New created search folder retention policy is changed in Exchange Server 2016
4547722 Can’t go from Office 365 to Enterprise in Exchange Server 2016 Exchange admin center (EAC) if Chrome SameSite Cookie is enabled
4547723 Can’t sign in to Office 365 if configuring hybrid with Chrome SameSite Cookie enabled in Exchange Server 2016
4547716 Event ID 1325 and Test-ExchangeSearch crashes application pool with NullReferenceException in Exchange Server 2016
4536987 Description of the security update for Microsoft Exchange Server 2016: February 11, 2020

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – Sep. 2019

Posted on September 17, 2019 by Michel de Rooij

Exchange2019Logo Today, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. The fixes in each release, product downloads are described below:

Version	Build	KB	Download	UMLP	Schema
Exchange 2019 CU3	15.2.464.5	KB4514141	VLSC		N
Exchange 2016 CU14	15.1.1847.3	KB4514140	Download	UMLP	N

Exchange 2019 CU3 fixes:

4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2019
4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2019 and 2016
4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2019 and 2016
4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2019 and 2016
4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2019 and 2016
4515269 SentToMemberOf shows every recipient type not distribution groups when you create transport rule in Exchange Server 2019 and 2016
4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2019 and 2016
4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2019 and 2016
4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2019 and 2016
4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2019 and 2016
4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2019 and 2016
4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2019 and 2016
4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2019 and 2016
4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2019 and 2016
4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2019 and 2016
4515273 Mailbox auditing fails when using SHA1Managed in Exchange Server 2019 and 2016
4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2019 and 2016
4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2019 and 2016
4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Exchange 2016 CU14 fixes:

4515255 “X-InnerException: Microsoft.Mapi.MapiExceptionRpcServerTooBusy” error when you try to use a mailbox in Exchange Server 2016
4515254 Event 1009 frequently occurs in application logs for lagged database copies in Exchange Server 2016
4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2016
4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2016
4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2016
4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2016
4515269 SentToMemberOf shows every recipient type not distribution groups when creating transport rule in Exchange Server 2016
4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2016
4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2016
4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2016
4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2016
4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2016
4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2016
4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2016
4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2016
4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2016
4515273 Mailbox auditing fails when you use SHA1Managed in Exchange Server 2016
4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2016
4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2016
4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Notes:

These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

Security Updates Exchange 2013, 2016 & 2019

Posted on January 14, 2019 by Michel de Rooij

Update 14jan: Added Exchange 2010 SP3 RU25

A quick heads-up as during my vacation Microsoft released security updates for supported releases of Exchange Server 2013, 2016 as well as Exchange Server 2019. In addition, a new Rollup was released for Exchange 2010 as well, containing one of the security updates.

The security updates patch issues as reported in the following Microsoft Common Vulnerabilities and Exposures:

CVE-2019-0586: Microsoft Exchange Memory Corruption Vulnerability
CVE-2019-0588: Microsoft Exchange Information Disclosure Vulnerability

You can download the security updates here:

Security Update For Exchange Server 2013 CU21 (v15.0.1395.10, KB4471389)
Security Update For Exchange Server 2016 CU10 (v15.1.1531.10, KB4471389)
Security Update For Exchange Server 2016 CU11 (v15.1.1591.13, KB4471389)
Security Update For Exchange Server 2019 (v15.2.221.14, KB4471389)
Exchange Server 2010 SP3 Rollup 25 (v14.3.435.0, KB4468742)

Notes:

Exchange 2010 SP3 RU25 addresses CVE-2019-0588 only.
KB4471389 supersedes KB4468741 and KB4459266; KB4468742 supersedes KB4458321.

Be advised that the Security Updates for Exchange 2013 and 2016 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU10 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you archive it, e.g. Exchange2016-KB4471389-x64-en-CU10.msp.

As with any patch or update, I’d recommend to thoroughly test this in a test and acceptance environment first, prior to implementing it in production.

Exchange Updates – October 2018

Posted on October 16, 2018 by Michel de Rooij

The Exchange Team released the October update for Exchange Server 2016. You may notice the absence of Exchange 2013, which is now in extended support phase and thus won’t receive regular updates. This heads-up was also given together with the updates of June.

Version	Build	KB	Download	UMLP	Schema?
Exchange 2016 CU11	15.1.1591.10	KB4134118	Download	UMLP	No

This update contain the following important changes and notes:

Exchange 2016 CU11 – as well as Exchange 2013 CU21 – are supported with .NET Framework 4.7.2; at least .NET Framework 4.7.1 is required for both.
Exchange 2016 CU13 (the June 2019 release, December will be skipped) will start requiring .NET Framework 4.7.2, similar to the release of Exchange 2019; Windows Server 2019 will contain .NET Framework 4.7.2.
Exchange 2016 requires installation of VC++ 2012 runtime prior to installation. Additionally, when installing the Mailbox role, VC++ 2013 runtime needs to be installed as well.

Exchange 2016 CU11 fixes:

4076516 Email message body is garbled when the Russian version of Outlook is used in Exchange Server 2016
4095967 CultureNotFoundException when you select an LCID 4096 language in Exchange Server 2016
4456225 The image in a signature that’s created in Outlook on the web isn’t visible to external users in Exchange Server 2016
4456226 Require SSL setting of MAPI virtual directory is reset after you install a cumulative update of Exchange Server 2016
4456227 ActiveSync clients cannot connect or synchronizing is delayed in an Exchange Server environment
4456228 Add an option to control UseAscReqNoToken through app configuration for Exchange Server 2016
4456229 Irrelevant management role entries without parameters are displayed in Exchange Server 2016
4456230 Component/protocol level bypass option for InternetWebProxy to avoid unnecessary proxy traffic within internal networks
4456231 AdvancedDataGovernanceLogs is created on the D drive after deploying Exchange Server 2016
4456232 Outlook on the web enters an authentication loop when you use device registration in Exchange Server 2016
4456234 Email can’t be delivered when the subject has an unknown character set in Exchange Server 2016
4456240 “CrimsonProbe has been poisoned repeatedly” error when migrating mailboxes to Exchange Server 2016
4456243 Hashed lines shown in scheduling assistant when Exchange Server 2016 tries to retrieve free/busy information across untrusted forests
4456244 Public folder forwards the new item that you create in Exchange Server 2016
4456245 Event ID 4999 and NullReferenceException when the New-MailboxRestoreRequest and New-MailboxExportRequest cmdlets fail in Exchange Server 2016
4456247 StoreDriver.config validation fails then meeting reminder can’t be set to “None” in Exchange Server 2016
4456249 Message tracking logs can’t be fully indexed in Exchange Server 2016
4456250 Users can download and view attachments that exceed the maximum attachment size setting in mobile device mailbox policy in Exchange Server 2016
4456259 Exchange Server 2016 user can’t access a shared calendar from Exchange Server 2013
4456233 UAPStatisticsLog and RecordReview are created on the D drive after you deploy Exchange Server 2016
4459847 Can’t send S/MIME encrypted mail or update the S/MIME control from Outlook on the web in Exchange Server 2016

Notes:

Exchange 2016 CU11 does not contain schema changes compared to their previous Cumulative Update. However, they may introduce RBAC changes in your environment. Use setup /PrepareAD to apply RBAC changes, before deploying or updating Exchange servers.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to stay at most one version behind (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order in which you upgrade servers with Cumulative Updates is irrelevant.

Caution:

Exchange Updates – June 2018

Posted on June 20, 2018 by Michel de Rooij

The Exchange Team released the June updates for Exchange Server 2013 and 2016, and an additional Rollup 22 for Exchange Server 2010 Service Pack 3.

Apart from fixes and time zone changes, these updates contain the following important changes and notes:

As announced earlier, Exchange 2013 CU21 and Exchange 2016 CU10 require .NET Framework 4.7.1.
All three updates require the VC++ 2013 runtime library, because it is needed by a 3rd component in WebReady Document Viewing in Exchange 2010/2013 and Data Loss Prevention in Exchange 2013/2016. Exchange 2010 SP3 RU22 will force installation of this VC++ runtime.
Updates include a critical security patch for Oracle Outside In libraries. More about the issue in MSRC advisory ADV180010.
Exchange 2013 CU21 and Exchange 2016 CU10 introduce support for directly creating and enabling remote shared mailboxes, e.g.
```
New-RemoteMailbox [-Shared] [-Name remoteMailboxName]
Enable-RemoteMailbox [-Identity user] [-Shared] [-RemoteRoutingAddress user@domain]
Set-RemoteMailbox [-Name user] [-Type Shared]
```
You need to run setup /PrepareAD to see these changes. More information in KB4133605.
This is the last planned Cumulative Update for Exchange 2013 as it enters Extended Support.
Exchange 2010 SP3 RU22 adds support for Windows Server 2016 Domain Controllers.

Version	Build	KB Article	Download	UMLP	Schema Changes
Exchange 2016 CU10	15.1.1531.3	KB4099852	Download	UMLP	No
Exchange 2013 CU21	15.0.1395.4	KB4099855	Download	UMLP	No
Exchange 2010 SP3 RU22	14.3.411.0	KB4295699	Download

Exchange 2016 CU10 fixes:

4056609 Event ID 4999 and mailbox transport delivery service won’t start with Exchange Server 2016 CU7 installed
4133605 Cmdlets to create or modify a remote shared mailbox in an on-premises Exchange environment
4133620 “HTTP 500 due to ADReferralException” error when a user tries to view detail properties of mailboxes in a child domain in Exchange Server
4095974 “System.InvalidOperationException” occurs when the “Enable-MailPublicFolder” cmdlet is run against a public folder in Exchange Server
4095973 Set-ServerComponentState cmdlet does not honor the write scope defined in the RBAC management scope in Exchange Server
4095993 HTTP 500 error when an administrator tries to manage regional settings in ECP on Windows Server 2016
4294209 Cannot clear the “Maximum message size” check box for Send messages or Receive messages in EAC in Exchange Server 2016
4294208 “TooManyObjectsOpenedException” error when you run the “Get-PublicFolderMailboxDiagnostics” cmdlet in Exchange Server
4294212 Cannot send VBScript-created messages in the Outlook 2016 client
4294211 Cannot run “Set-CalendarProcessing” cmdlets after you apply CU8 or CU9 for Exchange Server 2016
4294210 Cannot edit an email attachment in OWA in an Exchange Server 2016 environment
4294204 Changing “IsOutOfService” to “False” in an earlier Exchange Server version does not immediately update in a later Exchange Server environment
4092041 Description of the security update for Microsoft Exchange Server 2013 and 2016: May 8, 2018

Exchange 2013 CU20 fixes:

4133605 Cmdlets to create or modify a remote shared mailbox in an on-premises Exchange environment
4133604 User can’t log on to a POP/IMAP account by using NTLM authentication in Exchange Server 2013
4133618 Unexpected error occurs when running the Get-DatabaseAvailabilityGroupNetwork cmdlet in Exchange Server 2013
4133620 “HTTP 500 due to ADReferralException” when a user tries to view detail properties of mailboxes in a child domain in Exchange Server
4058473 An Office 365 primary mailbox user cannot be assigned full access permissions for an on-premises mailbox in Exchange Server
4094167 The MSExchangeRPC service crashes with a System.NullReferenceException exception in Exchange Server 2013
4095974 “System.InvalidOperationException” occurs when the “Enable-MailPublicFolder” cmdlet is run against a public folder in Exchange Server
4092041 Description of the security update for Microsoft Exchange Server 2013 and 2016: May 8, 2018
4294205 POP3 services intermittently stop in an Exchange Server 2013 environment
4294204 Changing “IsOutOfService” to “False” in an earlier Exchange Server version does not immediately update in a later Exchange Server environment

Exchange 2010 Rollup 22 fixes:

4295751 EWS impersonation not working when accessing resource mailboxes in a different site in Exchange Server 2010 SP3

Notes:

Exchange 2016 CU8 and Exchange 2013 CU18 do not contain schema changes compared to their previous Cumulative Update. However, they introduce RBAC changes in your environment. Use setup /PrepareAD to apply RBAC changes, before deploying or updating Exchange servers.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
When upgrading your Exchange 2013 or 2016 installation, don’t forget to put the server in maintenance mode when required. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to stay at most one version behind (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly, i.e. no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order in which you upgrade servers with Cumulative Updates is irrelevant.

Caution: