Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.
Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.
Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.
Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.
A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released October 13th. These fixes address the following vulnerability:
CVE-2020-16969: Microsoft Exchange Information Disclosure Vulnerability An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.
To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.
The security update corrects the way that Exchange handles these token validations.
The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.
Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2016-CU17-KB4581424-x64-en.msp.
Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.
Last Update: Added points from Exchange Online Transport – Manage Email, Optics, End User Experiences.
It shouldn’t come as a surprise that this year’s Ignite event is very different than previous years. However what is also different is that at this year’s digital experience, product groups lined up articles and pre-recorded sessions with deep-dive level 300-400 contents as well as articles to accompany those. The sessions, which are available through the Virtual Hub, were all launched right after the start of the event, including the prepared articles. Speaking of a flood flood of contents to digest.
To ease digesting all this information related to Exchange without going through all the videos and blogs, I prepared a summary of all the announcements made at and during Ignite for your reference. For reference, links to the original articles and sessions are at the bottom of this article. The list might not be conclusive; if you find something missing, let me know.
Exchange vNext
Exchange Server vNext is scheduled for H2/2021, and will be subscription-based.
Will support in-place upgrades from Exchange Server 2019, just like installing another Cumulative Update. Which makes you think, maybe it is just a CU with a high version offset to avoid clashing with its predecessor.
Support for this in-place upgrade process is limited to 2 years after release of vNext. If everything goes to plan, this means upgrades will be supported from Exchange 2019 CU11/12-CU19/20 to Exchange vNext RTM-CU8/9.
Will support co-existence with Exchange Server 2013, 2016 and 2019, which is 1 down-level more than previous editions (n-3 support instead of n-2).
Customers staying on-premises are recommended to upgrade to Exchange Server 2019 today, so they can benefit from an in-place upgrade to vNext when it gets released.
Exchange Online Management PowerShell module is now GA (v2.0.3). This module contains cmdlets leveraging Graph which can show significant performance enhancements in larger tenants, supports certificate-based authentication a.o.
Exchange Online Management PowerShell preview module (v2.0.4) supports Linux and PowerShell Core.
Cross-tenant migration of mailboxes is now in Public Preview. Separate programs for cross-tenant SharePoint Online and OneDrive for Business will also launched (register for private preview at aka.ms/SPOMnAPreview). An Azure Key Vault subscription is required on the target tenant. Management of these moves is done from PowerShell, after setting things up with some MSFT scripts which you can grab from GitHub here.
Message Recall to orchestrate recall of message in Exchange Online as announced at Ignite 2019 is expected later this year (Q4/2020).
Admins can toggle the new Exchange Admin Center (was already in preview). It will become the default in Q1/2021.
The new Exchange Admin Center is also tailored for use on mobile browsers.
Outbound mail flow now supports MTA-STS (MTA Strict Transport Security).
The new Exchange Admin Center will host all mail flow related management options, which will be consolidated from the earlier Admin Center as well as the Security & Compliance Center.
The new Exchange Admin Center will get new mail flow insights and notifications, such as early certificate expiration notifications or detected reply-to-all storms.
Option to reduce message expiration timeout interval from the current default of 24 hours.
Administrators get the option to block users from moving groups (distribution groups as well as Microsoft 365 Groups) to the BCC line, which might break receivers’ inbox rules (Q1/2021).
Entitled organizations can appoint Priority Users. Priority Users are critical mailboxes that are monitored for mail flow issues. Requires minimum of 10,000 Office 365 E3 or E5 or Microsoft 365 E3 or E5 licenses with at least 50 monthly active Exchange Online users.
Microsoft 365 Network Connectivity functionality goes into preview, which is accessible via the admin portal (Health > Network Connectivity).
The stand-alone Network Connectivity test tool also goes in preview, and is available from connectivity.office.com.
Notifications for expired or soon to expire SSL certificates and Domains (Q4/2020).
Exchange Server 2019 Server Role Requirements Calculator or just Capacity Calculator is now available as separate download (v10.5, link).
Exchange Hybrid
New Exchange Hybrid Configuration Wizard, which will become available later month, will support connecting your Exchange on-premises environment to multiple tenants. Note that multiple Exchange organizations connecting to a single tenant was already an option, as mentioned in the supported Azure AD Connect topologies document (link).
The Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. Like recent Cumulative Updates for these products, they require .NET Framework 4.8. Apart from fixes as well as security updates included from the previous CU, the Exchange 2019 CU7 also comes with an update for the Exchange Sizing Calculator.
Links to the updates as well as a description of changes and fixes are described below.
4570248 Get-CASMailbox uses wrong LDAP filter for ECPEnabled in Exchange Server 2019
4576652 Updates for Exchange Server 2019 Sizing Calculator version 10.5
4570252 Intermittent poison messages due to NotInBagPropertyErrorException in Exchange Server 2019
4576649 System.InvalidCastException when you change passwords in Outlook on the web in Exchange Server 2019
4570251 Inbox rule applying a personal tag doesn’t stamp RetentionDate in Exchange Server 2019
4570245 ESEUtil /p fails if any long value (LV) is corrupted in Exchange Server 2019
4570255 NullReferenceException occurs when running TestFederationTrust in Exchange Server 2019
4576650 Can’t add remote mailbox when setting email forwarding in Exchange Server 2019 Hybrid environment
4570253 CompletedWithErrors without details for mailbox migration batches in Exchange Server 2019
4570247 CSV log of Discovery export fails to properly escape target path field in Exchange Server 2019
4570246 EdgeTransport crashes with Event ID 1000 (exception code 0xc00000fd) in Exchange Server 2019
4570254 MSExchangeMapiMailboxAppPool causes prolonged 100% CPU in Exchange Server 2019
4563416 Can’t view Online user free/busy status in Exchange Server 2019
4576651 Can’t join Teams meetings from Surface Hub devices after installing Exchange Server 2019 CU5
4577352 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 8, 2020
Exchange 2016 CU18 fixes:
4570248 Get-CASMailbox uses wrong LDAP filter for ECPEnabled in Exchange Server 2016
4570252 Intermittent poison messages due to NotInBagPropertyErrorException in Exchange Server 2016
4576649 System.InvalidCastException when you change passwords in Outlook on the web in Exchange Server 2016
4570251 Inbox rule applying a personal tag doesn’t stamp RetentionDate in Exchange Server 2016
4570245 ESEUtil /p fails if any long value (LV) is corrupted in Exchange Server 2016
4570255 NullReferenceException occurs when you run TestFederationTrust in Exchange Server 2016
4576650 Can’t add remote mailbox when setting email forwarding in Exchange Server 2016 Hybrid environment
4570253 CompletedWithErrors without details for mailbox migration batches in Exchange Server 2016
4570247 CSV log of Discovery export fails to properly escape target path field in Exchange Server 2016
4570246 EdgeTransport crashes with Event ID 1000 (exception code 0xc00000fd) in Exchange Server 2016
4570254 MSExchangeMapiMailboxAppPool causes prolonged 100% CPU in Exchange Server 2016
4563416 Can’t view Online user free/busy status in Exchange Server 2016
4576651 Can’t join Teams meetings from Surface Hub devices after installing Exchange Server 2016 CU16
4577352 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 8, 2020
Notes:
These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
There are Active Directory changes requiring you to run PrepareAD. Consult the Exchange schema versions page for object version numbers.
When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are allowed to trail at most one version (n-1).
If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.
Caution:
As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.
EighTwOne (821) 