Microsoft Exchange Server 2019 Cumulative Update 14 Unattended Setup

Copying Files…
File copy complete. Setup will now collect additional information needed for installation.

Languages
Management tools
Mailbox role: Transport service
Mailbox role: Client Access service
Mailbox role: Mailbox service
Mailbox role: Front End Transport service
Mailbox role: Client Access Front End service

Performing Microsoft Exchange Server Prerequisite Check

Configuring Prerequisites COMPLETED
Prerequisite Analysis COMPLETED

Setup will prepare the organization for Exchange Server 2019 by using ‘Setup /PrepareAD‘. No Exchange Server 2013 roles have been detected in this topology. After this operation, you will not be able to install any Exchange Server 2013 roles.

For more information, visit: https://learn.microsoft.com/Exchange/plan-and-deploy/deployment-ref/ms-exch-setupreadiness-NoE15ServerWarning?view=exchserver-2019

Configuring Microsoft Exchange Server

Organization Preparation COMPLETED
Preparing Setup COMPLETED
Stopping Services COMPLETED
Language Files COMPLETED
Removing Exchange Files COMPLETED
Preparing Files COMPLETED
Copying Exchange Files COMPLETED
Language Files COMPLETED
Restoring Services COMPLETED
Language Configuration COMPLETED
Exchange Management Tools COMPLETED
Mailbox role: Transport service COMPLETED
Mailbox role: Client Access service COMPLETED
Mailbox role: Mailbox service COMPLETED
Mailbox role: Front End Transport service COMPLETED
Mailbox role: Client Access Front End service COMPLETED
Finalizing Setup

The Exchange Server setup operation completed successfully.

Exchange Setup preserved the required configurations during upgrade. More details can be found in Exchangesetup.log located in <SystemDrive>:\ExchangeSetupLogs folder. For more information, visit: https://aka.ms/PreserveExchangeConfig2019.

Exchange Setup has enabled Extended Protection on all the virtual directories on this machine. For more information visit: https://aka.ms/EnableEPviaSetup.

We recommend running Exchange HealthChecker script to evaluate if there are any configuration issues which can cause feature breakdowns. HealthChecker script can be downloaded from https://aka.ms/ExchangeSetupHC.

Extended Protection Powershell Parameter für Exchange 2016 und 2019

Wenn der Installationsbefehl .\Setup.EXE /Mode:Upgrade /DoNotEnableEP_FEEWS lautete, wäre der nächste Befehl für die manuelle Aktivierung abzusetzen und mit Ja zu bestätigen. Alle notwendigen Einstellungen würden automatisiert umgesetzt werden.

.\ExchangeExtendedProtectionManagement.ps1

.\ExchangeExtendedProtectionManagement.ps1 -ShowExtendedProtection
.\ExchangeExtendedProtectionManagement.ps1 -DisableExtendedProtection
.\ExchangeExtendedProtectionManagement.ps1 -RollbackType “RestoreConfiguration”
.\ExchangeExtendedProtectionManagement.ps1 -RollbackType “RestoreIISAppConfig”

Die nachfolgende Befehle angepasst und ausgeführt in der Powershell deaktivieren das SSL-Offloading für Outlook-Anywhere.

Set-OutlookAnywhere -Identity EX1\Rpc* -Externalhostname EX1.windowspapst.de -ExternalClientsRequireSsl:$True -ExternalClientAuthenticationMethod Basic

Set-OutlookAnywhere -Identity EX1\Rpc* -SSLOffloading $true
Set-OutlookAnywhere -Identity EX1\RPC (Default Web Site) -SSLOffloading $true

appcmd Recycle AppPool MSExchangeRpcProxyFrontEndAppPool

Restart-WebAppPool MSExchangeRpcProxyFrontEndAppPool

Hier noch einmal der Hinweis, was nicht geht, wenn EP aktiviert ist:

Extended Protection is recommended to be enabled for security reasons. Known Issues: Following scenarios will not work when Extended Protection is enabled.

– SSL offloading or SSL termination via Layer 7 load balancing.
– Exchange Hybrid Features if using Modern Hybrid.
– Access to Public folders on Exchange 2013 Servers.

You can find more information on: https://aka.ms/ExchangeEPDoc.

SSL-Bridging

SSL-Bridging ermöglicht es den gesamten sicheren Datenverkehr zwischen dem SSL-Client und dem SSL-Server zu überbrücken. Es kommt zu keinem Ausladen, Verschlüsseln oder Entschlüsseln und beschleunigt den Bridge-Traffic nicht. Daher ist es wichtig, das die Web Application Firewall, der Loadbalancer sowie der Exchange das gleiche Zertifikat nutzen. HTTP/s Passthrough und HTTP/s re-encrypted sorgen für die nötige Verschlüsselung zwischen den Endpunkten.

# Exchange Server Dienste prüfen
Get-Service | Where {$_.DisplayName -Like “*Exchange*”} | Format-Table DisplayName, Name, Status
Get-Service *MSExchange*
Test-ServiceHealth

# MAPI Test
Test-MAPIConnectivity -Server SRVEX
Get-MailboxDatabase | Test-MAPIConnectivity

# Replikation überprüfen
Get-DatabaseAvailabilityGroup | Select -ExpandProperty:Servers | Test-ReplicationHealth

# Prüfen ob alle Komponenten aktiv sind
Get-ServerComponentState -Identity SRVEX | select @{N=’Exchange’;E={SRVEX}}, Component,State

Nicht vergessen den AV-Schutz zu prüfen!

HealthChecker

.\HealthChecker.ps1
.\HealthChecker.ps1 -Server EX1
.\HealthChecker.ps1 -Server EX1, EX2
.\HealthChecker.ps1 -BuildHtmlServersReport
.\HealthChecker.ps1 -LoadBalancingReport
.\HealthChecker.ps1 -VulnerabilityReport