Exchange 2013

Reviewing the output of an environement's CAS Namespaces showed that there was an unexpecte URL present for the version of Exchagne that was installed.  With Exchange 2013 onwards InternalNLBBypassURL is not something that we need to set.  That was an Exchange 2007 and 2010 thing.

In the environment below note that there are couple of things that pique my interest.

Any thoughts?

What is interesting i… Read the rest “Exchange Unexpected InternalNLBBypass URL – RecoverServer”

Extended Protection uses service binding and channel binding to help prevent an authentication relay attack. In an authentication relay attack, a client that can perform NTLM authentication (for example, Windows Explorer, Microsoft Outlook, a .NET SqlClient application, etc.), connects to an attacker (for example, a malicious CIFS file server). The attacker uses the client's credentials to masquer… Read the rest “Exchange Server Extended Protection”

The May 2022 security update for Exchange Server 2013, 2016 and 2019 resolved CVE-2022-21978.  A common issue is that admins are only doing part of the work to address this CVE.  Yes they are installing the update, but are not reading the rest of the documentation which states that an additional command must be run.

The FAQ states:

Do I need to take further steps to be protected from this vulnerabil… Read the rest “Remediate Exchange Security CVE-2022-21978”

The question "Does Exchange setup automatically run /PrepareSchema?" was something that came up many times in the recent Hafnium remediation activities.  This was due to many customers not updating Exchange for multiple years, and being extremely behind on updates.  In order to get Exchange updated, it was necessary to perform multiple steps in the upgrade process.  Sometimes the /PrepareSchema ta… Read the rest “Does Exchange Setup Automatically Run PrepareSchema?”

When installing Exchange updates, I place the server into maintenance mode and restart it prior to installing the actual Exchange update.  This is due to have being burned many times by other teams or third party tools that conveniently "overlooked" the fact that their setup required the machine to restart.  It also provides an opportunity for issues caused by those third party tools to surface be… Read the rest “Unable to Run Exchange Setup–Pending Reboot From a Previous Installation”