Random Musings on Security and Exchange
As we move to add newer email security standards such as MTA-STS (Mail Transfer Agent Strict Transport Security) and DANE (DNS-Based Authentication of Named Entities), the reporting aspect of these standards needs to also be implemented. Even though both MTA-STS DANE enforce encryption, TLS Reporting (TLS-RPT) is what gives you visibility into whether that encryption is actually working or b Read…
Azure Communication Services (ACS) can be used to send high volume outbound email to Internet recipients, represents an important shift in Microsoft’s messaging architecture. As organizations modernised their cloud communications to Exchange Online (EXO) many of them just kept doing what they were doing with Exchange on-premises, i.e. using that as a bulk mailer to send out high volume email inter…
After upgrading Web Application Proxy (WAP) to Windows Server 2025 you may run into an issue with certain applications that are published via WAP to the Internet. This issue will also happen if you build a net new environment for both WAP 2019 and newer. This post discusses WAP 2025, but the same is more than likely going to happen with WAP 2022 In the below example the AD FS upgrade went well wi…
Sender Policy Framework (SPF) is a fundamental component of modern e-mail authentication, designed to reduce the risk of spoofing and phishing attacks. By publishing a DNS record that specifies which mail servers are authorised to send messages on behalf of a domain, SPF allows receiving systems to validate whether an incoming message genuinely originates from the claimed sender. SPF alone does no…
On-premises users were unable to use Entra SSPR to reset their passwords. This needs to use the Password Writeback feature, and in this case Entra Connect was used. Nowadays there is also Entra Cloud Sync, but that was not an option for this customer. Users were able to access the SSPR page at https://aka.ms/SSPR and successfully go through all of the steps of the wizard. This included the CAPT…
In this post we’re capturing a point-in-time reference of the Exchange Server Subscription Edition installation process. As Microsoft continues to evolve Exchange with its subscription-based model, setup screens, prerequisites, and configuration options may change over time. The goal here isn’t to walk through the steps in detail, but simply to document what the installation experience looks like…
The Windows servicing stack relies heavily on the WinSxS (Windows Side-by-Side) component store, which houses all the system files, manifests, and metadata required to service, patch, and maintain the operating system. Corruption within this store can manifest as persistent update failures, integrity check errors, or an inability to apply new servicing operations. Traditional file-level repair met…
Wireshark is the industry tool for packet inspection, but you don’t always want, or are able, to install this onto production systems without a change request. Whether you’re troubleshooting or investigating an issues, there are alternative ways to capture meaningful network traffic without installing Wireshark. Ultimately we want to produce PCAPs easily without having to mess with switchport mi…
In today’s hybrid work environment, securing access to cloud applications is more critical than ever. Microsoft Defender for Cloud Apps offers a powerful way to enforce granular access controls using different policies. Organisations want to ensure that only authorised and compliant devices can access sensitive cloud resources. Requiring device compliance can be achieved with Intune as an MDM a…
This is an issue that can appear when trying to introduce a Windows Server 2025 domain controller into an existing Active Directory forest. You were planning a change, followed the change request process only for it to be torpedoed as the deployment failed. The installation was blocked because the forest functional level is still set to Windows Server 2012R2. At first glance, this can be confusi…
On September 30th, 2025, the legacy multifactor authentication (MFA) and self-service password reset policies will be removed and you'll manage all authentication methods here in the authentication methods policy. Use this control to manage your migration from the legacy policies to the new unified policy. Learn more Traditional Azure Multi-Factor Authentication has served organizations well for…
Transport Layer Security (TLS) has always been a critical component of securing communications in Microsoft Exchange Server, ensuring confidentiality and integrity of email traffic both internally and externally. With Exchange Server 2019, Microsoft has steadily evolved TLS support to align with modern security standards and deprecate older, weaker protocols. A notable shift came between Cumulativ…
This was an issue encountered during the setup of Azure Arc where the onboarding process unexpectedly crashed. Azure Arc is designed to extend Azure management and governance to on-premises and multi-cloud servers, so installation reliability is critical. When a setup program setup crashes, it often points to problems with agent dependencies, connectivity to Azure endpoints, or PowerShell module…
It’s very common that we mount ISO files when needed, then forget to remove them after the fact. This is generally a non issue until you want to move the mounted ISO file as Hyper-V may have a lock on the file. Yes we could open up the properties of each VM in the console, but nope. Not doing that. Rather than search VMs one by one to see which is the offending VM, just run the below command in Po…
When sending email through Azure Communication Services (ACS), proper sender authentication is essential to ensure that your messages are trusted and successfully delivered. DomainKeys Identified Mail (DKIM) is one of the key technologies that provides this assurance by digitally signing each outgoing message. This allows recipient mail systems to verify that the email was not altered and genuine…
Exchange 2019 CU15 has been released to the Microsoft Volume Licensing Center and the public Microsoft Download site! Exchange 2019 has a different servicing strategy than Exchange 2007/2010 and utilises Cumulative Updates (CUs) rather than the Rollup Updates (RU/UR) which were used previously. CUs are a complete installation of Exchange 2019 and can be used to install a fresh server or to upd…
Moving a deployed Exchange hybrid environment to a brand new tenant is not something that is typically done. In all of the years that I've worked with customers on hybrid, a second hand is not needed to count those instances. The biggest reason for customers doing it was they did not like the tenant name, and wanted to change it. In this case it was becase the tenant was being forcibly removed du…
The 14th of October 2025 marks another pivotal moment in Microsoft’s product lifecycle, as a large spectrum of very popular and widely deployed software reaches end-of-support. This includes Windows 10 and Windows 11 22H2. On the productivity front, the extended support for Office 2016 and 2019, along with Visio 2016/2019, Project 2016/2019, and server-side tools like Exchange Server 2016/2019, S…
When working with PowerShell, even small formatting issues can cause big problems. A common culprit is the use of “smart quotes,” which look correct but aren’t expected the ASCII character that PowerShell requires. This leads to frustrating command failures. In many cases his is because blogging software replaces the standard quote with a "smart quote" automatically. We can fix that with a Word…
In this case there was an issue uninstalling the Azure Migrate Mobility Service, but the same principal will apply to running MSIEXEC commands in PowerShell that are not correctly formatted. The Azure Migrate Mobility Service is a key component used during server replication to Azure. The Mobility Service agent is installed on machines to capture disk information and send it to the Azure Migrate…