On December 15, 2015 Microsoft has released Cumulative Update 11 (CU11) for Exchange Server 2013. Okay, I’m a little late with this one, but I wanted to wait some time to see what would happen with this CU….

Note. You can download Exchange 2013 CU11 at https://www.microsoft.com/en-us/download/details.aspx?id=50366, the accompanying UM Language Pack files can be downloaded from https://www.microsoft.com/en-us/download/details.aspx?id=50365 and this is the office Microsoft announcement: https://support.microsoft.com/en-us/kb/3099522. But please, read on before starting to download and install Exchange 2013 CU11.

Now, about this CU….. Microsoft introduced a new feature in CU11 called Mailbox Anchoring. This means that an Exchange Management Shell will no longer connect to the Exchange 2013 server you’re logged on to, but it will be proxied to the Exchange server hosting your current Mailbox. This can be challenging in a mixed environment.

Support you have an Exchange 2013/2016 coexistence scenario, you’re logged on to an Exchange 2013 server and the administrative account you’re using has a Mailbox on Exchange 2016, then your EMS session will be proxied to the Exchange 2016, even though you’ll see EMS connect to the Exchange server you’re logged on. Even worse, if you have an Exchange 2010/2013 environment and your administrative mailbox is on Exchange 2010, your EMS session will be proxied to the Exchange 2010 server. This is where you will feel the pain….

Needless to say, this will give some challenges. Features not available, EMS returning unexpected data, possible EMS execution against a different (wrong) server. Also when working with a hybrid environment with Office 365 you have to be very careful.

Bottom line, you can no longer trust the ‘Connected to <SERVER>’ message when starting an EMS session. It means your EMS session is proxied through this server. When you’re using an administrative account without a Mailbox (which was a Microsoft recommendation for years) your EMS session will be proxied to an arbitration Mailbox (typically the SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} Mailbox in your environment). Now imagine what happens when your Exchange environment spans multiple sites over slow connections, something that’s not uncommon in the non-Office 365 world.

A workaround (although not officially supported by Microsoft) is to add the Exchange PowerShell snap-in to a regular PowerShell session using the following command:

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

This is obviously a fix for something that happens in the Microsoft datacenters, but that’s totally unknown in the on-premises Exchange deployments. Especially the Exchange 2010/2013 coexistence deployments are hit, a scenario that’s unknown in the Microsoft datacenters I’m afraid.

At this moment I recommend NOT installing Exchange 2013 CU11 if you have an Exchange 2010/2013 environment and wait for Exchange 2013 CU12 to see if this feature will be either fixed or removed. If you have a native Exchange 2013 environment you’re good to go, but you have to be carefull about this EMS proxy thing (I have a couple of native Exchange 2013 CU11 environment J).

You can find more information regarding this issue on Exchange 2013 forums:

https://social.technet.microsoft.com/Forums/en-US/05897b40-0717-437d-90ca-d550e3226c2a/exchange-2013-cu-11-breaks-some-admin-accounts-?forum=exchangesvrdeploy

Also, fellow MVP and Exchange Master Andrew Higginbotham has written about this on https://exchangemaster.wordpress.com/2016/01/06/mailbox-anchoring-affecting-new-deployments-upgrades/

And finally, the official Microsoft blog about Mailbox anchoring: http://blogs.technet.com/b/exchange/archive/2015/12/15/exchange-management-shell-and-mailbox-anchoring.aspx