Exchange Solutions

In May, Microsoft released a cumulative update for Exchange 2019. Once you get the H1 2023 cumulative update, be sure to grab the security updates released in June.

While Exchange 2016 did not receive a cumulative update, it did get a June security update, so be sure to install it.

Exchange 2013 did not get any updates as it is officially out of support. If you are on Exchange 2013, you should upgrade to Exchange 2019 or migrate to Exchange Online. No future security updates are planned for Exchange 2013.

If you need guidance on migrating from a specific CU to the latest, check out Microsoft’s Exchange Update Wizard for step-by-step instructions.

The updates are as follows:

Exchange 2019:
Cumulative Update 13 (KB5020999) | June 2023 Security Update (for CU13)

Exchange 2016:
No new cumulative update | June 2023 Security Update (for CU23)

Exchange 2013 is out of extended support

Exchange 2013 exited extended support on April 11th, 2023. This means that there are no more security patches or technical support for these products. Any security patches after April 11th, 2023, are at Microsoft’s discretion. At the time of writing, the last update for Exchange 2013, is the March 14th, 2023 security update.

Due to the lack of security patches, it is imperative to upgrade these products to either Exchange 2019 or Exchange Online as soon as possible. For more information on how to migrate to Exchange 2019 or Exchange Online, check out Microsoft’s deployment guides here.

Modern Authentication

Cumulative Update 13 adds native OAuth2.0 support to Exchange 2019. Previously if you wanted to leverage modern authentication with Exchange 2019, you had to establish hybrid connectivity with Exchange Online and implement Hybrid Modern Authentication.

This update removes that requirement allowing you to implement modern auth with entirely on-premises technologies. To implement native modern auth in Exchange 2019, you will need to meet the following requirements:

• Exchange 2019 CU13 or later
• Active Directory Federation Services 2019 (ADFS 2019) or later
• Outlook for Windows (Version 2304 – Build 16327.20214) running on Windows 11 (Version 22H2 with KB5023706 installed)
• Outlook on the Web

Note: Modern auth support for Outlook for Mac, Outlook Mobile, and native mail apps will be added in a later update. At the time of writing, these clients will continue to use basic auth to connect to Exchange 2019.

Enabling modern auth, either through native modern authentication or hybrid modern authentication, greatly increases the security posture of Exchange on-premises. With native modern auth, organizations leveraging Exchange on-prem can utilize ADFS as their identity provider. This allows for multi-factor authentication, smart card authentication, certificate-based authentication, and integration with third-party authentication providers.

For more information on deploying native modern authentication for Exchange 2019, check this article.

While deploying an Exchange server, you may run into the following error during setup, which will block the installation from continuing.

[07/01/2020] ErrorRecord: Cannot find an overload for "CompareTo" and the argument count: "1".
[07/01/2020] ErrorRecord: System.Management.Automation.MethodException: Cannot find an overload for "CompareTo" and the argument count: "1".

This error is definitely cryptic. Thankfully the Exchange Setup Logs (located at “C:\ExchangeSetupLogs\ExchangeSetup.txt”) is excellent at providing more clues when troubleshooting.

In our case, the logs identified that setup was trying to process the Offline Address Book (“OAB”) at the time of the error. The error occurred during a function that contained OAB-related PowerShell commands, including Get-OfflineAddressBook, Get-OabVirtualDirectory, and Set-OfflineAddressBook. So, this was the logical place to continue troubleshooting.

From another Exchange Server, we ran the PowerShell command Get-OfflineAddressBook, and strangely, three address books were returned.

 C:\> Get-OfflineAddressBook | Format-List Name

Name: Default Offline Address List
Name: Default Offline Address List (Ex2013)
Name: Default Offline Address List (Ex2013)
      CNF:3e4b413a-e5d6-4371-8541-defecb812f98

The returned results were strange.

• Default Offline Address List is an OAB from a legacy Exchange installation (Exchange 2010 and earlier) and is common to see in an Exchange environment.
• Default Offline Address List (Ex2013) is present whenever an Exchange 2013 or 2016 server is installed into a legacy Exchange environment. This address list is standard, and it is common to see both this OAB and the first OAB coexisting in mixed Exchange environments.
• Default Offline Address List (Ex2013)CNF:<GUID>, is an address list I had never seen before.

Default Offline Address List (Ex2013)CNF:<GUID> being an unknown quickly became the focus of our investigation.