Released: June 2016 Quarterly Exchange Updates

[bsuneja]

Today we are announcing the latest set of Cumulative Updates for Exchange Server 2016 and Exchange Server 2013. In addition to normal fixes to customer reported issues, these releases also include updated functionality. Exchange Server 2016 Cumulative Update 2 and Exchange Server 2013 Cumulative Update 13 are available on the Microsoft Download Center.

.Net 4.6.1 Support

Support for .Net 4.6.1 is now available for Exchange Server 2016 and 2013 with these updates. We fully support customers upgrading servers running 4.5.2 to 4.6.1 without removing Exchange. We recommend that customers apply Exchange Server 2016 Cumulative Update 2 or Exchange Server 2013 Cumulative Update 13 before upgrading .Net FrameWork. Servers should be placed in maintenance mode during the upgrade as you would do when applying a Cumulative Update. Support for .Net 4.6.1 requires the following post release fixes for .Net as well.

• Windows Server 2008/2008R2 - KB3146716
• Windows Server 2012 - KB3146714
• Windows Server 2012R2 - KB3146715

Note: .Net 4.6.1 installation replaces the existing 4.5.2 installation. If you attempt to roll back the .Net 4.6.1 update, you will need to install .Net 4.5.2 again.

AutoReseed support for BitLocker

Beginning with Exchange 2013 CU13 and Exchange 2016 CU2, the Disk Reclaimer function within AutoReseed supports BitLocker. By default, this feature is disabled. For more information on how to enable this functionality, please see Enabling BitLocker on Exchange Servers.

SHA-2 support for self-signed certificates

The New-ExchangeCertificate cmdlet has been updated to produce a SHA-2 certificate for all self-signed certificates created by Exchange. Creating a SHA-2 certificate is the default behaviour for the cmdlet. Existing certificates will not automatically be regenerated but newly installed servers will receive SHA-2 certificates by default. Customers may opt to replace existing non-SHA2 certificates generated by previous releases as they see fit.

Migration to Modern Public Folders resolved

The issue reported in KB3161916 has been resolved.

Change to Get-ExchangeServer cmdlet

The Get-ExchangeServer cmdlet has been updated in Exchange Server 2016 Cumulative Update 2 to reflect the Exchange 2016 ServerRole definitions; Mailbox or Edge. Due to the way Remote PowerShell (RPS) works, the ServerRole definition output will be based upon the version hosting the RPS session, e.g. CU2 endpoints will report CU2 ServerRole definitions for all servers in the org. Customers should use the properties assigned to a particular service on the Exchange Server object to determine capabilities of a server, if needed. For instance, customers with scripts relying upon ServerRole Output looking for ClientAccess to be installed will need to look for the IsClientAccessServer property in the cmdlet output instead. An example follows:

[PS] C:\Windows\system32>$MyServer = Get-ExchangeServer EXHV-9895

[PS] C:\Windows\system32>$MyServer.ServerRole

Mailbox

[PS] C:\Windows\system32>$MyServer.IsClientAccessServer

True

[PS] C:\Windows\system32>

Installing from a mounted ISO displays English UI only

We are aware that customers who mount the ISO image and install Exchange from the mapped drive will not receive a local language setup experience. For customers who desire a local language setup experience, the workaround is to copy the files from the mounted ISO to a local OS drive and execute Setup from the local OS drive instead of the mounted ISO. We are working to resolve this in a future cumulative update.

Release details

KB articles which contain greater depth on what each release includes are available as follows:

• Exchange Server 2016 Cumulative Update 2 (KB3135742), Download, UM Lang Packs
• Exchange Server 2013 Cumulative Update 13 (KB3135743), Download, UM Lang Packs

Exchange Server 2016 Cumulative Update 2 does include updates to Active Directory Schema. These updates will apply automatically during setup if the permissions and Active Directory requirements are met during installation. If the Exchange Administrator lacks permissions to update Active Directory Schema, a Schema Admin should execute SETUP /PrepareSchema before installing Cumulative Update 2 on the first Exchange server. The Exchange Administrator should also execute SETUP /PrepareAD to ensure RBAC roles are updated correctly.

Exchange Server 2013 Cumulative Update 13 does not include updates to Active Directory, but may add additional RBAC definitions to your existing configuration. PrepareAD should be executed prior to upgrading any servers to CU13. PrepareAD will run automatically during the first server upgrade if Setup detects this is required and the logged on user has sufficient permission.

Additional information

Microsoft recommends all customers test the deployment of any update in their lab environment to determine the proper installation process for your production environment. For information on extending the schema and configuring Active Directory, please review the appropriate TechNet documentation.

Also, to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed. To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded. If the policies are NOT set to Unrestricted you should use the resolution steps in KB981474 to adjust the settings.

Reminder for customers in hybrid deployments

Customers in hybrid deployments where Exchange is deployed on-premises and in the cloud, or who are using Exchange Online Archiving (EOA) with their on-premises Exchange deployment are required to deploy the most current (e.g., CU13) or the prior (e.g., CU12) Cumulative Update release.

For the latest information on Exchange Server and product announcements, please see What's New in Exchange Server 2016 and Exchange Server 2016 Release Notes. You can also find updated information on Exchange Server 2013 in What’s New in Exchange Server 2013, Release Notes and product documentation available on TechNet.

Note: Documentation may not be fully available at the time this post was published.

Exchange Team

[#2]

This is great news, Thanks.

Does Microsoft plan on ever releasing another Help (.chm) file for Exchange 2013 and 2016 ? The last one was released a very long time ago and the page has now mysteriously disappeared. (

http://www.microsoft.com/en-us/download/details.aspx?id=35395 ). Is it really that difficult to make these available for those of us who use them ?

[#3]

So much stuff this time .

regarding below

Reminder for customers in hybrid deployments

****Customers in hybrid deployments where Exchange is deployed on-premises and in the cloud, or who are using Exchange Online Archiving (EOA) with their on-premises Exchange deployment are required to deploy the most current (e.g., CU13) or the prior (e.g., CU12) Cumulative Update release.****

Do you mean CU12 and CU13 are mandatory for any Hybrid (Exchange 2013) Deployment? So if a customer is on Exchange 2013 CU10 they must be at least CU12, right?

[#4]

Yes, an E2013 customer must be on CU12 or CU13 for support in a hybrid deployment. Likewise, an E2016 customer must be on CU1 or CU2.

[#5]

Link doesn't work for Exchange 2013 CU 13 if you click on the KB link. Does work for 2016 CU 2 though.

[#6]

As noted in these update articles:

Documentation may not be fully available at the time this post was published.

[#7]

Excellent work on resolving the PF issue, Now I can get those stalled migrations moving.

[#8]

Great set of updates. Any word on if this includes the passive index rebuilding Greg Taylor mentions in his Mechanics videos? Where network utilization was to be dropped by 40%?

[#9]

No, CU2 does not include this feature.

[#10]

Awesome. Greg mentioned on Yammer that hopefully it will ship in CU3.

[#11]

Gareth, we are completely committed to shipping this feature when it is ready. We simply need to ensure that we work out any unexpected issues. Things are looking very good for Cumulative Update 3 at the moment.

[#12]

Great news. Looking forward to testing that feature.

[#13]

2013 KB link appears to be broken.

Exchange Server 2013 Cumulative Update 13 (KB3135743)

https://support.microsoft.com/en-us/kb/3135743

[#14]

Hello

How bout Exchange 2010 updates are covered here https://blogs.technet.microsoft.com/rmilne/2016/06/17/exchange-2010-sp3-ru14-released/

thank you

[#15]

I wonder what percentage of the user base this even affects. It addresses people who installed Oracle products on their Exchange boxes.

[#16]

I understand Oracle binaries are baked-in to OWA on Exchange 2007 [web-ready document viewing] - so installing UR20 should be considered to fix the security vulnerability.

[#17]

Also Oracle libraries are baked-in to Exchange 2010 - see https://technet.microsoft.com/en-us/library/security/ms12-058.aspx - so install UR14 to cover this vulnerability

[#18]

The Outside-In binaries from Oracle affect all currently supported versions of Exchange. Last week we shipped security updates for all products as part of the patch Tuesday release. We do not consider security releases to be bound by our quarterly release schedule which is why they are not called out in this blog announcement. Customer who move to Exchange Server 2016 Cumulative Update 2 or Exchange Server 2013 Cumulative Update 13 do not need to apply the updates released last week if they move to the Cumulative Updates released this week. All customers should choose a deployment path that allows them to address the security vulnerability in the Oracle products included with Exchange Server.

[#19]

Also, don't forget to read Ross' article, DAG Activation Preference Behavior Change in Exchange Server 2016 CU2. https://blogs.technet.microsoft.com/exchange/2016/06/16/dag-activation-preference-behavior-change-in-exchange-server-2016-cu2/

[#20]

Thanks both !

Good catch, technically that article from Ross at least could have a link on this CU release news - just my two cents :)

[#21]

Should we need to apply cumulative update 1 ( https://www.microsoft.com/en-us/download/details.aspx?id=51497) before applying CU2 for Exchange server 2016?

[#22]

Cumulative Updates are cumulative, meaning that they include all changes introduced in prior updates. You do not need to apply CU1 in order to install CU2.

[#23]

Hi,

That's not necessary, because these are CUMULATIVE updates.

Sebastian

[#24]

@sime3000 - The CHM file technology has been deprecated by Microsoft. We have no plans to produce further versions of this file. All product help documentation has been transferred to TechNet or is exposed in place within the product, e.g. Outlook on the Web or Exchange Admin Center.

[#25]

Thanks Brent. So if we're at 40,000 ft on a long flight working with no Internet access or we're at one of our client sites where the Exchange servers have no Internet access and we need to get quick access to a TechNet Exchange subject or we need to get the syntax of a cryptic shell command, how would you suggest that we get that information without the use of a complied help file ?

[#26]

CHM technology is deprecated and no longer produced for the Exchange Server products. Might I suggest if you find yourself at 40,000 feet (well above normal commercial flight limits BTW) you sit back and enjoy the in-flight entertainment, your favorite refreshment or just take a nap as an alternative. We are not going to produce an offline version of Exchange documentation for this or any other purpose.

[#27]

@sime3000 It looks like there is a tool that you can use to make an offline copy of the Technet articles. It's called "Package This" and more info is at http://www.itworld.com/article/2769712/networking-hardware/how-to-download-the-entire-microsoft-technet-library-and-take-it-on-the-road.html.

But otherwise, I'd say if you're at 40,000 feet on a flight, you won't be working on an Exchange server. And if you are, you already have internet access. :) There's also the help command. For instance, "help get-mailbox" will give you an output of the syntax for the cmdlet. "get-help get-mailbox" gives you even more detailed syntax.

[#28]

For me personally I will use the plane's wifi. If at a site without internet access I turn on internet sharing with my phone.

If I don't have access to TechNet and need the latest PowerShell syntax I first run the Update-Help cmdlet. Then I can use the Get-Help cmdlet. For example, "Get-Help Get-Mailbox". Or "Get-Help Get-Mailbox -Examples" works wonders as well.

Tab-completion also helps when remembering those cmdlets and parameters.

Hope this helps. :)

[#29]

Hello Brent Alinger [MSFT]

Your condescending response is noted. It’s a common reaction I see from Microsoft reps at all levels when they can't handle a question. I'm reminded of The Emperor's New Clothes.

I've posted this simple CHM question several times in this blog. No one could be bothered to address it until now and when I posted the location of the last Exchange CHM file ( http://www.microsoft.com/en-us/download/details.aspx?id=35395 ) a while back, no one responded again but it magically disappeared. Nice.

You didn't answer my question re offline access to Exchange TechNet documentation (regardless of altitude), so I will take your condescending response to mean - "I don't know and I really don't care"

[#30]

Not really. The question was specifically for Brent Alinger [MSFT] .

[#31]

Brent Alinger [MSFT]

Hmmm. No Reply function under your June 24, 2016 at 9:07 am post.

"We absolutely care about our community" Is a nice sentiment however ...

I posted a simple query in this blog re the CHM file in February 2014 but no one from your group could be bothered to respond

https://blogs.technet.microsoft.com/exchange/2014/02/25/released-exchange-server-2013-service-pack-1/ . That might tend to indicate that your group really doesn't care.

I posted a simple query in this blog re the CHM file in September 2015 but no one from your group could be bothered to respond

https://blogs.technet.microsoft.com/exchange/2015/09/15/released-september-2015-quarterly-exchange-updates/ . That might tend to indicate that your group really doesn't care.

I posted a simple query in this blog re the CHM file in December 2015 but no one from your group could be bothered to respond

https://blogs.technet.microsoft.com/exchange/2015/12/15/released-december-2015-quarterly-exchange-updates/ . That might tend to indicate that your group really doesn't care.

I posted a simple query in this blog re the CHM file in March 2016 but no one from your group could be bothered to respond

https://blogs.technet.microsoft.com/exchange/2016/03/15/released-march-2016-quarterly-exchange-updates/ . That might tend to indicate that your group really doesn't care.

I posted a simple query re the CHM file in this particular June 2016 thread but I received what to me was an obviously condescending response advising how you thought I should spend my time while on a commercial airliner. That might tend to indicate that your group really doesn't care.

I posted a simple query in this particular June 2016 thread asking if Microsoft had a suggestion for an alternative to the CHM file for doing work offline. I didn't get a response to that specific question either from Microsoft. That might tend to indicate that your group really doesn't care.

Repeatedly posting this simple query and not getting a response after two+ years, other than a condescending one, has been a complete waste of my time. This definitely tells me that your group really does not care regardless of the nice sentiment.

[#32]

sime3000 - My failed attempt at humor was not intended to be condescending. My apologies if you interpret it otherwise. As to your no clothes comment, your view of the situation is not accurate from my point of view. We absolutely care about our community. As I indicated, the underlying CHM technology has been deprecated and is no longer supported. This is not an Exchange only position and should not be news to anyone using Microsoft products. Our plan is to provide support content online via TechNet and in product for OWA/EAC only. That statement should be clear that there is no plan to make this available in any other form. I believe this statement answers your question as to how this content is to be consumed now and in the future.

[#33]

This still works for saving TechNet sections into a .CHM file. Is it so hard to make it yourself if you insist on being stuck in the past?

http://packagethis.codeplex.com/

[#34]

I missed the "Additional Information" about changing the Execution Policy on the March 2016 updates, but this was not a recommendation on the December 2015 updates as far as I can see, is this just for Exchange 2016 or all versions? also is the Recommendation post update to reset to "RemoteSigned"? ...Is there another reason this has been added that your not telling us about?

[#35]

This applies to all versions.

[#36]

What about support for PowerShell v5?

[#37]

Does this fix the Edge valid recipient bug; https://support.microsoft.com/en-gb/kb/3152396 ?

[#38]

Yes it does. Funny this doesn't get mentioned anywhere. ;)

[#39]

This seems to be a pretty important bug fix for anyone running call ahead, did it make this release or is there an expected release that will include it?

[#40]

According to Premiere, this bug was actually fixed in CU2. So apparently, the issue is that the CU2 release notes don't document this as being one of the items that were fixed. I have not tested to confirm that it is, in fact, fixed yet.

[#41]

The recently updated Supportability Matrix at https://technet.microsoft.com/en-us/library/ff728623(v=exchg.150).aspx appears to indicate that Exchange 2013 RU13 does not support .NET Framework 4.6.1 while Exchange 2016 CU1/RTM does support it. That's incorrect, is it not ?

[#42]

When evaluating .NET Framework 4.6.1 with E2016CU2 and Win2012 R2, KB3146715 displays a disclaimer about "PRE-RELEASE SOFTWARE":

MICROSOFT PRE-RELEASE SOFTWARE LICENSE TERMS

MICROSOFT .NET FRAMEWORK PRE-RELEASE

These license terms are an agreement between Microsoft Corporation [...]

Is that a mistake or this cumulative hotfix is really a pre-release ? looks like the .NET Framework 4.6.2 Preview somehow. Can we install or is there a misleading link in the KB article ?

[#43]

Seems like a bug in the KB. Thanks for pointing this out we will follow-up with the .Net team. 4.6.2 is not yet supported against any version of Exchange. 4.6.1 is as high as we go currently.

[#44]

As stated above, CU13 for E2013 supports .Net 4.6.1 (plus hotfix). The TechNet article will be corrected in the future.

[#45]

Ross Smith IV

I assume that your comment is in response to my June 22, 2016 at 7:46 am post.

It appears that after my post some changes were made to the https://technet.microsoft.com/en-us/library/ff728623(v=exchg.150).aspx article to try and correct the misinformation but the .NET information in that article is still wrong...

[#46]

I also see that Update Rollup 14 for Exchange Server 2010 SP3 was also released. I know it's a small update but it should also be posted here so we know. :)

[#47]

In what was a terrifying moment on step 16 (finalizing setup), the DepedentAssemblyGenerator.exe crashed and left the setup incomplete. Luckily running setup again detected the incomplete previous setup and was able to successfully complete it, but man that was scary. I copied what was presented in case anyone wants it, and also submitted a crash report to Microsoft.

Error:

The following error was generated when "$error.Clear();

$dependentAssemblyGeneratorExePath = [System.IO.Path]::Combine($RoleInstallPath, "bin", "DependentAssemblyGenerator.exe");

$exchangeBinPath = [System.IO.Path]::Combine($RoleInstallPath, "bin");

$clientAccessPath = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess");

$sharedWebConfig = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess", "SharedWebConfig.config");

$a = &"$dependentAssemblyGeneratorExePath" -exchangePath "$exchangeBinPath" -exchangePath "$clientAccessPath" -configFile "$sharedWebConfig";

$a | % { if ($_.Length > 0) { Write-ExchangeSetupLog -Info "$_.ToString()" } }

Start-SetupProcess -Name "iisreset" -Args "/timeout:120"

" was run: "System.Management.Automation.RemoteException".

Error:

The following error was generated when "$error.Clear();

$dependentAssemblyGeneratorExePath = [System.IO.Path]::Combine($RoleInstallPath, "bin", "DependentAssemblyGenerator.exe");

$exchangeBinPath = [System.IO.Path]::Combine($RoleInstallPath, "bin");

$clientAccessPath = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess");

$sharedWebConfig = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess", "SharedWebConfig.config");

$a = &"$dependentAssemblyGeneratorExePath" -exchangePath "$exchangeBinPath" -exchangePath "$clientAccessPath" -configFile "$sharedWebConfig";

$a | % { if ($_.Length > 0) { Write-ExchangeSetupLog -Info "$_.ToString()" } }

Start-SetupProcess -Name "iisreset" -Args "/timeout:120"

" was run: "System.Management.Automation.RemoteException: Unhandled Exception:".

Error:

The following error was generated when "$error.Clear();

$dependentAssemblyGeneratorExePath = [System.IO.Path]::Combine($RoleInstallPath, "bin", "DependentAssemblyGenerator.exe");

$exchangeBinPath = [System.IO.Path]::Combine($RoleInstallPath, "bin");

$clientAccessPath = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess");

$sharedWebConfig = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess", "SharedWebConfig.config");

$a = &"$dependentAssemblyGeneratorExePath" -exchangePath "$exchangeBinPath" -exchangePath "$clientAccessPath" -configFile "$sharedWebConfig";

$a | % { if ($_.Length > 0) { Write-ExchangeSetupLog -Info "$_.ToString()" } }

Start-SetupProcess -Name "iisreset" -Args "/timeout:120"

" was run: "System.Management.Automation.RemoteException: ".

Error:

The following error was generated when "$error.Clear();

$dependentAssemblyGeneratorExePath = [System.IO.Path]::Combine($RoleInstallPath, "bin", "DependentAssemblyGenerator.exe");

$exchangeBinPath = [System.IO.Path]::Combine($RoleInstallPath, "bin");

$clientAccessPath = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess");

$sharedWebConfig = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess", "SharedWebConfig.config");

$a = &"$dependentAssemblyGeneratorExePath" -exchangePath "$exchangeBinPath" -exchangePath "$clientAccessPath" -configFile "$sharedWebConfig";

$a | % { if ($_.Length > 0) { Write-ExchangeSetupLog -Info "$_.ToString()" } }

Start-SetupProcess -Name "iisreset" -Args "/timeout:120"

" was run: "System.Management.Automation.RemoteException: System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\SharedWebConfig.config' is denied.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)

at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)

at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)

at System.Xml.XmlDocument.Save(String filename)

at Microsoft.Exchange.Management.DependentAssemblyGenerator.UpdateConfigFile(String configFilePath, IList`1 exchangeAssemblies, Int32& numAssembliesAdded)

at Microsoft.Exchange.Management.DependentAssemblyGenerator.Main(String[] args)".

Error:

The following error was generated when "$error.Clear();

$dependentAssemblyGeneratorExePath = [System.IO.Path]::Combine($RoleInstallPath, "bin", "DependentAssemblyGenerator.exe");

$exchangeBinPath = [System.IO.Path]::Combine($RoleInstallPath, "bin");

$clientAccessPath = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess");

$sharedWebConfig = [System.IO.Path]::Combine($RoleInstallPath, "ClientAccess", "SharedWebConfig.config");

$a = &"$dependentAssemblyGeneratorExePath" -exchangePath "$exchangeBinPath" -exchangePath "$clientAccessPath" -configFile "$sharedWebConfig";

$a | % { if ($_.Length > 0) { Write-ExchangeSetupLog -Info "$_.ToString()" } }

Start-SetupProcess -Name "iisreset" -Args "/timeout:120"

" was run: "System.Management.Automation.RemoteException:

".

[#48]

Now that .NET 4.6 is on the supported list, is there any word on support for WMF5 / PowerShell 5 in Exchange? It'd be really nice to be able to standardise to that across the environment.

[#49]

David, we are not going to support installing WMF packages that bring newer WMF versions down to older OS versions with Exchange server. Our plan is to only support the version of WMF which is installed natively with the OS. Interop of these versions will be supported if Exchange is deployed on different OS versions, but there is no plan to support standardization on WMF versions across different OS versions.

[#50]

Hello Exchange Team,

Why are some redirection functions apparently not working in the Exchange Management shell ? e.g. in Exchange 2013 CU13 if you run "Get-MailPublicFolder 3> output.txt" to redirect warning messages to a text file, any warning messages will be visible on the screen but the output file will be empty.

[#51]

That's a bit sad to hear, since PowerShell v5 has brought many useful additions (thinking abut extracting archives for pointing one simple but helpful feature). It's in daily use where you realize when going back to pre-v5 PowerShell what you are missing.