When you want to check which updates are installed on an Exchange server you can navigate to Control Panel | Programs | View Installed Updates and you will see a list of installed updates, including the Exchange Security Updates.
When running Exchange 2019 on Windows 2019 Server Core there is no Control Panel and you can view the registry to check which updates are installed. Use the following command to view all installed Updates:
When installing a Database Availability Group in Exchange 2019 running on Windows 2019 Server Core, I got IP address configuration errors when creating the DAG. It did succeed, but when running the Get-DatabaseAvailabilityGroupNetwork command in EMS is get a ‘Misconfigured’ warning:
This will be a DAG with two networks. One Mapi network (10.38.96.0/24) for clients, and one replication network (192.168.0.0/24).
The requirements for an additional replication network in a DAG are:
No default gateway configured
No DNS servers configured
IP address must not be registered in DNS
When using Windows 2019 Server Core, the first two can be configured using the SCONFIG utility, but the last one is not that simple (but in Windows 2019 Desktop Experience it is just a matter of deselection the “Register this connection’s address in DNS” option when configuring the network interface).
When using Windows Server Core, you can use the Set-DnsClient command to configure this setting, combined with the Get-NetAdapter command.
Execute the Get-NetAdapter command to retrieve the network interfaces. In the following screenshot “Ethernet” is the regular Mapi network interface, “Ethernet 2” is the replication network interface.
To configure the DNS registration option, execute the following command:
On July 13, 2021 Microsoft has released a number of Security Updates for Exchange. Security Updates are released for:
Exchange 2013 CU23
Exchange 2016 CU20 and CU21
Exchange 2019 CU9 and CU10
Some of the issues are marked ‘critical’ (Remote Code Execution) but no evidence have been found for any exploits in the wild, but it is strongly recommended to install these Security Updates as soon as possible. The following CVE’s are addressed in these Security Updates:
Detailed information regarding the vulnerabilities can be found in the Security Update Guide.
As always, when installing the Security Update manually from a command prompt, use elevated privileges. If you do not, installation will succeed but under the hood things break! This is not an issue when installing using Windows Update.
Note. This Security Update has a dependency on the Schema update that came with Exchange 2016 CU21 and Exchange 2019 CU10. If you are running an older version of these CUs, please update the Schema first to the latest level. If you are still running Exchange 2013, and only Exchange 2013 at the latest level, you can install the Security Update, but you must run setup.exe /PrepareSchema from the V15\bin directory. The SU installation will install the latest schema files in the V15\bin directory which will be used by the setup application to make the schema changes. Failure to do so will result in an unprotected Exchange 2013 environment.
Currently I am working with a customer on this specific scenario, and to my surprise I ran into this Teams/Exchange connectivity test on the Microsoft Remote Connectivity Analyzer (https://aka.ms/exRCA). Open the Remote Connectivity Analyzer, select Microsoft Teams and click the Teams Calendar Tab button. Login with the account you want to test (in this example I have an on-premises mailbox on Exchange 2019, but works for Exchange 2016 as well) and click Perform Test.
Within seconds you will see if connectivity from Microsoft Teams to your Exchange server is working properly. Very nice!
One June 29, 2021 Microsoft has released the June 2021 Cumulative Updates for Exchange server, two weeks later than initially planned.
For Exchange 2016 it is a special Cumulative Update, since CU21 is the latest update that will be released for the product.
Besides a number of fixes, both CU’s contain integration with the Anti-Malware Scan Interface (AMSI). AMSI is available in Windows 2016 and Windows 2019, and Exchange now integrates with AMSI. Prerequisite is of course that Exchange 2016 is running on Windows 2016. When running on Windows 2012 R2, the AMSI integration is not available.
AMSI integration is a result of the HAFNIUM infections earlier this year. When using an anti-malware solution that is AMSI capable, malicious HTTP requests are blocked before they are processed by the Exchange server.
Important notes:
Both CUs contain a Schema Update and an Active Directory update, so you must run Setup.exe /PrepareSchema and Setup.exe /PrepareAD.
When running the Exchange servers in a DAG, don’t forget to put your DAG members in maintenance mode prior to updating.
When running in Hybrid Mode, Microsoft requires you to run the last or second-last Cumulative Update.
As usual, test the CUs thoroughly before bringing them into your production environment.
You must be logged in to post a comment.