Exchange

This week saw some critical cumulative updates for Exchange 2016 and Exchange 2019. These new updates contain the security patches previously released on March 2nd. Organizations that apply these cumulative updates don’t need to install the previous security patch.

The exception to this is those organizations on Exchange 2010 or Exchange 2013, where no update has superseded the March 2nd security patch. Those on Exchange 2010 and 2013 must ensure that they have the March 2nd patch applied as soon as possible.

The updates are as follows:

Exchange 2019 Cumulative Update 9 | KB4602570

Exchange 2016 Cumulative Update 20 | KB4602569 | UM Language Pack

Exchange 2013 Security Update | KB5000871 (March 2nd Security Patch)

Exchange 2010 SP3 Rollup 32 | KB5000978 (March 2nd Security Patch)

Tackling the March 2nd security exploits

It is imperative to protect yourself from the exploits published on March 2nd. HAFNIUM, a cyberespionage group with ties to the Chinese government, has leveraged these Exchange Server exploits to infiltrate victims’ networks to deliver malware and other malicious payloads with varying motives, primarily to exfiltrate confidential data.

First, patching is imperative.

• Those on Exchange 2016 or 2019 should apply the latest cumulative update.
• Those on Exchange 2013 will need to install Cumulative Update 23 (released June 2019), followed by the March 2nd, 2021 security patch.
• Those on Exchange 2010 need to install rollup 32.

Note: On March 8th Microsoft updated the security patch allowing it to be installed on older cumulative updates. This aided organizations that could not yet upgrade to the latest cumulative update. Note that applying the security patch and then upgrading to an older CU (rather than the latest) will expose your organization to the exploits again.

Once you are fully patched, I recommend running the Microsoft Safety Scanner (also known as the Microsoft Emergency Response Tool), which detects and remediates all known malware. This is a self-executing program that can be downloaded here.

I recommend running a full system scan. Note that it takes a few hours to run a scan, and it may spike your CPU, so it’s best to do this during a maintenance window. If you have a database availability group, consider putting the server into maintenance mode so that you can run the scanner with zero user impact.

Last week was a big week for Exchange. Microsoft released its eighth cumulative update for Exchange 2019 as well as a cumulative update for Exchange 2016. Security updates have been released for Exchange 2010 and 2013.

As always, test these updates in a lab first! I recommend checking out this 7-part guide on configuring Exchange in your lab. It doesn’t take much to get one going.

The updates are as follows:

Exchange 2019 Cumulative Update 8 | KB4588885

Exchange 2016 Cumulative Update 19 | KB4588884 | UM Language Pack

Exchange 2013 December Security Patch | KB4593466

Exchange 2010 SP3 Rollup 31 | KB4593467

Exchange 2016 entered extended support on October 14th

Back in October, Exchange 2016 entered extended support. The March 2021 cumulative update (CU20) is the last planned feature update for Exchange 2016. Any cumulative update after 20 is at Microsoft’s discretion.

Security patches will continue to be available in extended support until October 14th, 2025, delivered primarily through the Security Update Guide.

Block Outlook for Android on wearables and smartwatches

Microsoft has added a policy to Intune that grants an administrator the ability to block Outlook for Android on wearable devices (for example, a Samsung Galaxy Watch). This block prevents any Outlook data from being shared with the wearable device. This includes emails, calendar items, and more.

To configure this block, log into Endpoint Manager and select the Apps > App Configuration Policy tabs. From here, click Add and choose Managed Apps (you can also modify an existing Outlook app policy).

Give the policy a name and click Select public apps. Search for, and add Microsoft Outlook. Click Next.

On the Settings tab, expand Outlook configuration settings, and next to the field Org Data on Wearables select No. From here select any other settings to go into your App Configuration Policy and click Next. On the next screen pick which users or groups of users will get this settings. Click Next and Create.

For those who do not have an Intune subscription, a new feature is being added to mobile device policies in Exchange Online (which anyone with an Exchange license can leverage) to disable Bluetooth on the device. You can do this via PowerShell. In the example below, we are disabling Bluetooth for the policy named, Company Mobile Policy.

 C:\> Set-MobileDeviceMailboxPolicy -Identity "Company Mobile Policy" -AllowBluetooth Disable

Global recipient limits

Earlier in the year, Microsoft announced a change to recipient limits in Office 365. Recipient limits dictate how many recipients someone can add to a single email message (this includes all recipients added to the To, Cc, and Bcc lines). This limit was previously hardcoded to 500 recipients. With the February announcement, administrators were allowed to configure this limit per mailbox, with a value of 1 to 1,000 recipients per message.

Starting in August Microsoft extended this functionality by allowing a global recipient limit to be set via PowerShell using the Set-TransportConfig command.

To see the current configuration, connect to Exchange Online PowerShell and run the following command.

 C:\> Get-TransportConfig | Format-List MaxRecipientEnvelopeLimit

MaxRecipientEnvelopeLimit : Unlimited

A value of Unlimited denotes the Office 365 published limits, which at the time of writing is 1,000 recipients per message.

You can modify this value with the following command. In the example below we are setting the max recipients per message to 500.

 C:\> Set-TransportConfig -MaxRecipientEnvelopeLimit 500

In most cases, when this setting is configured on both the mailbox and globally, the mailbox will win. The exception to this is when the mailbox is set to Unlimited, then the global parameter wins. Another way to think of Unlimited at the mailbox and global level is null or not set.

This week was a big week for Exchange. Microsoft released its seventh cumulative update for Exchange 2019 as well as a cumulative update for Exchange 2016. At the time of writing, there is no cumulative update for Exchange 2013.

As always, test these updates in a lab first! I recommend checking out this 7-part guide on configuring Exchange in your lab. It doesn’t take much to get one going.

The updates are as follows:

Exchange 2019 Cumulative Update 7 (VLSC)| KB4571787

Exchange 2016 Cumulative Update 18 | KB4571788 | UM Language Pack

So, what’s new in this Cumulative Update?

Microsoft has resolved a number of issues with the Exchange 2019 Sizing Calculator. I actually ran into one of these myself where the transport database size estimate (under the Role Requirements tab) always reported a 0 GB size per server. This issue has now been fixed in version 10.5 of the calculator (included with the Exchange 2019 CU7 ISO in the Support folder). Be sure to ditch v10.4.

These series of cumulative updates also resolves an issue where Surface Hub would connect to meetings with the wrong communications client (Skype or Teams) if both clients were installed on the device.

A couple of other items of note is that this cumulative update will fix an issue where the MAPI App Pool could become locked and drive CPU to 100% for over an hour and resolves the security issue CVE-2020-16875, which addresses a remote code execution vulnerability.