Exchange SE Transport Rule Query
I'm trying to use a transport rule to send a notification to an audit mailbox with a note of the names of all attachments being sent externally with From, To, CC, BCC details. It sort of works. Rule If message has an attachment that's larger than or equal to 0 bytes Do the following Set audit severity level to 'Not specified' and send the incident report to <audit mailbox>, include these message properties in the report: sender, recipients, subject, cc'd recipients, bcc'd recipients, severity, sender override information, matching rules, false positive reports, detected data classifications, matching content. If I send a message to: 'email address removed for privacy reasons', cc: 'email address removed for privacy reasons', bcc:'email address removed for privacy reasons' with 2 attachments the report includes the following: Sender: <sender> Recipient: To & CC Attachments: Only 1 attachment name i.e. Missing an attachment name and the BCC entry Is this a bug or a feature? I presume it is just flagging the first attachment greater than 0 bytes which is annoying but that wouldn't explain the missing BCC entry.
Hybrid Configuration Wizard fails to run – manifest download error on all machines
Hello, I am unable to run the Exchange Hybrid Configuration Wizard (HCW) for our Exchange 2016 environment. The issue occurs on multiple machines and networks, so it does not appear to be a local configuration problem. Environment: Exchange Server: 2016 CU23 Windows versions tested: Windows Server 2016, Windows 10 (all fully updated) .NET Framework: 4.8 (Release 528040 / 4.8.03761) TLS: TLS 1.2 enabled, SSL 3.0/TLS 1.0/1.1 disabled Network: No proxy, firewall, or other network restrictions; internet access available Problem: When attempting to run HCW via https://aka.ms/HybridWizard, the wizard fails to start. I have also tried to run HCW offline by downloading Microsoft.Online.CSE.Hybrid.Client.application, but it immediately fails. The error log shows the following repeated messages: Downloading file:///C:/Users/.../Application Files/Microsoft.Online.CSE.Hybrid.Client_17_1_3902_0/Microsoft.Online.CSE.Hybrid.Client.exe.manifest did not succeed. Could not find a part of the path 'C:\Users\...\Application Files\Microsoft.Online.CSE.Hybrid.Client_17_1_3902_0\Microsoft.Online.CSE.Hybrid.Client.exe.manifest' This occurs on all tested machines (three PCs across three different networks). ClickOnce cache has been cleared, root certificates are up-to-date, .NET is 4.8, and TLS 1.2 is active. Attempts to resolve: Ensured TLS 1.2 is enabled and default in .NET and OS Verified .NET 4.8 installation Cleared ClickOnce cache (rundll32 dfshim CleanOnlineAppCache) Updated root certificates Tried multiple machines and networks Tried to run offline using .application file and local copy of Application Files Result: HCW fails immediately with DeploymentDownloadException / DirectoryNotFoundException for the manifest. The issue is reproducible on all tested machines. Request: Please advise if there is an official offline installation method for HCW or a way to obtain a working manifest. If this is a temporary issue with the hosted distribution, please confirm expected resolution or workaround. Thank you for your assistance.
Exchange 2016 Mail Flow is Not Working
We had issues with updating to a latest Cumulative Update and messed up our EMS and some Web Config. It seems our Exchange Server is totally bricked. So, we decided to boot our Exchange Server from backup. The backup was dated September 2025. Unfortunately, after booting up the September 2025 backup, we noticed that the internal and external mail flow is not working (our Exchange 2016 is Exchange hybrid configured). The outgoing emails are stuck in Draft folder. The following troubleshooting steps have been done to no avail: -Checked if the port 25 is open -> This port is opened -Check the network settings if the Preferred DNS Address points to the correct DNS Server --> It points to the correct DNS Server -Modified the DNS lookup under Exchange Admin Center > Servers > DNS Lookups > Internal DNS Lookups --> Added the IP Address of the DNS Server -Modified the hosts file under System32 > drivers > etc --> Pointed the IP Address of the Exchange Server to the FQDN of the Exchange Server Currently, are not sure of the next steps to do in order to fix the issue. Any advice?Exchange Server SE Licensing and Product Keys
It seems that there’s a lot of confusion about licensing and product keys for Exchange Server SE; not just here on the Tech Community, but also on LinkedIn, on Reddit, and in the general Exchange community. So, I thought I would write an article to try to clear up that confusion. Licensing Let’s talk about licensing first. Undoubtedly, changing the name of the product to Exchange Server Subscription Edition caused some of the confusion. Some mistakenly believed it meant that cloud connectivity would now be required for the first time in Exchange Server history. Others thought this meant that Microsoft would start updating on-premises Exchange servers the same way they update Exchange Online. Neither of these things are true—as with all previous versions of Exchange Server, cloud (or Internet) connectivity is not required for Exchange Server SE (although there are some features that do require cloud connectivity to be used, such as the Exchange Emergency Mitigation service and Feature Flighting). Despite the name change, though, the reality is that the https://www.microsoft.com/licensing/terms/productoffering/ExchangeServer/all (and distributions channels) for Exchange Server SE are exactly the same as Exchange Server 2019: there are three licensing options: Server licenses and client access licenses (CALs) that have active Software Assurance (SA); Exchange Online licenses; or CAL equivalency licenses. Purchasing server licenses and CALs with SA is the traditional approach and something that can be done with Exchange Server SE; however, some customers have chosen to purchase cloud licenses or equivalency licenses to modernize their license acquisition and to better manage their licenses. Qualifying cloud licenses that satisfy the Exchange Server SE CAL requirement include https://www.microsoft.com/microsoft-365/exchange/exchange-online, which provides a license equivalent to an Exchange Server Standard CAL, and https://www.microsoft.com/microsoft-365/exchange/compare-microsoft-exchange-online-plans, which provides a license equivalent to an Exchange Server Enterprise CAL, which gives you the right to use advanced features, such as In-Place Archive, In-Place Holds, Information Protection and Compliance, Custom Retention Policies, Per User/DL Journaling, Site Mailboxes – Compliance, Data Loss Prevention, Exchange Online Protection, and Cloud Voicemail. At the higher end of cloud licenses are Microsoft 365 E3 (ME3) and Microsoft 365 E5 (ME5), both of which include https://www.microsoft.com/licensing/terms/productoffering/Microsoft365 for on-premises Office servers, namely Exchange Server, SharePoint Server, and Skype for Business Server, depending on the type of agreement you have with Microsoft. For example, customers with an Enterprise Agreement and ME3 or ME5 licenses can “install any number of copies of” Office server software. In this scenario, though, all users and devices accessing the on-premises Office servers must have an ME3 or ME5 license. Note though that you don’t directly assign the license in this case; you simply need to purchase it. In addition, there are similar https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA available with Microsoft 365 A3 and A5 under the Microsoft Customer Agreement (MCA) program. As I mentioned earlier, these are the same requirements as Exchange Server 2019. So, if you are running Exchange Server 2019 and you have active SA, then you likely already satisfy the license requirements for Exchange Server SE, and you can deploy it in your environment without any additional licensing costs. If you are running an earlier version of Exchange Server and you have active SA or qualifying cloud licenses, then you also likely satisfy the license requirements for Exchange Server SE. But if you don’t have SA or cloud licenses (or a Volume License Agreement), then you will need to purchase qualifying licenses and sign the right agreement to be entitled to Exchange Server SE and updates. However, there is one key difference. Downgrade (aka previous version) rights are no longer available. This is simply because there are no other supported versions, so there’s nothing to downgrade to. So, if you don’t maintain a subscription, you lose the right to install updates and run the product. Product Keys Now let’s talk about product keys. As with previous versions of Exchange Server, there is no product key or license activation. You simply purchase the required licenses (or maintain your existing subscription) to get the rights to use the software and install updates. A product key validates that you have purchased a Standard or Enterprise Edition server license for Exchange Server SE. Without a product key, a server is considered a Trial Edition. The Trial edition operates identically to a Standard Edition server and can be used to evaluate Exchange in a non-production setting for up to 180 days. To continue using the server beyond this period, you must enter a product key; otherwise, the Exchange admin center (EAC) will begin displaying reminders to enter a product key on the server, which you can do using the EAC or the Exchange Management Shell. Although the EAC will display a warning when the trial period expires, there’s no loss of functionality, and the software will continue to operate as if it were licensed (except for the warning messages). If you are doing an in-place upgrade of a running Exchange Server 2019 that has an existing valid product key, the RTM version of Exchange Server SE will continue to use that key. This was done on purpose to support a smooth in-place upgrade. If you are doing a fresh install of Exchange Server SE RTM (which includes legacy upgrades from Exchange Server 2016), you can also enter a product key Exchange Server 2019, which you can get from the Volume License page in the Microsoft 365 admin center (after you’ve signed your agreement with Microsoft). Exchange Server SE is available in four Editions: Enterprise, which supports a maximum of 100 mounted databases per server. Standard, which supports a maximum of 5 mounted databases per server. StandardEvaluation, which is a 180-day time-limited Standard Trial Edition. Coexistence (aka Hybrid Deployment), which maintains the hybrid relationship with Exchange Online. As an aside, a mounted database is a database that's in use (an active mailbox database that's mounted for use by clients or a passive mailbox database that's mounted for log replication and replay). While you can create more databases than the described limits, you can only mount the maximum number of databases that are allowed by the Edition of Exchange, as determined by the product key. Note that recovery databases don’t count towards these limits. When you enter a valid product key, the supported edition for the server is established. You can use a valid product key to move from the Trial Edition to either Standard Edition or Enterprise Edition. Again, no loss of functionality occurs after the Trial Edition expires, so you can maintain lab, demo, training, and other non-production environments beyond 180 days without having to reinstall the Trial Edition of Exchange or enter a product key. You can use a valid product key to move from Standard Edition to Enterprise Edition, but you can't use a valid product key to downgrade from Enterprise Edition to Standard Edition or revert to a Trial Edition. You can only do these types of downgrades by uninstalling Exchange, reinstalling Exchange, and entering the correct product key. Product keys also apply to Edge Transport servers. When you create an Edge Subscription, the Edition of Edge Transport server is captured (as determined by the presence or absence of a product key). Edge Transport servers support two Editions: Trial or Standard. Enterprise doesn’t apply because there are no Enterprise features or mailbox databases on Edge Transport servers. Hybrid doesn’t apply because you can’t use an Edge Transport server as a hybrid server. If you create an Edge Subscription for an Edge Transport server that is a Trial Edition, it will appear as unlicensed to the internal organization. If you then enter a product key on a subscribed Edge Transport server, the server will reflect the change to Standard immediately, but the internal organization will not. To update the internal organization information, you must remove and recreate the Edge Subscription. If you don’t, the internal organization will continue to see the Edge Transport server as unlicensed, which is only cosmetic in nature (e.g., no changes in functionality). However, for compliance, auditing, etc., it is considered a best practice to recreate the Edge Subscription. As in previous versions, the Hybrid Configuration Wizard (HCW) provides the license for Hybrid servers, so it is expected that you have not entered a product key on the server. To obtain the Hybrid server license, click license this server now in the HCW and authenticate to your tenant. The HCW will update the product key on the server and refresh the page, and depending on replication latency, it might not update the Version from StandardEvaluation Edition to Coexistence Edition (Hybrid Deployment). However, you can verify the license using Get-ExchangeServer or simply toggle between the two on-premises server options in the HCW, which triggers detection and should choose the same server with updated properties. Final Note Although the Exchange Server 2019 product keys work with Exchange Server SE RTM, it is expected that new product keys specific to Exchange Server SE will be made available with Exchange Server SE CU1, which is expected in H1 of 2026. When the new keys are issues, they will be available from the Volume License area of the Microsoft 365 admin center, along with the CU1 download. I hope this clears up any confusion regarding licensing and product keys for Exchange Server SE.Exchange Server SE Licensing and Product Keys
It seems that there’s a lot of confusion about licensing and product keys for Exchange Server SE; not just here on the Microsoft Tech Community, but also on Reddit, on LinkedIn, and in the general Exchange community. So, I thought I would write an article to try to clear up that confusion. https://www.linkedin.com/pulse/exchange-server-se-licensing-product-keys-scott-schnoll-qjhic/ If you're confused about licensing or product keys, this may help.Exchange database dismounted due to NTFS file extent limit reached – unexpected outage
Hi everyone, We experienced a serious outage on our Exchange 2016 server recently, and I wanted to share what we found during the root cause analysis – in case it helps someone else avoid the same scenario. Summary: After digging deep, we discovered that the issue was caused by the NTFS file system hitting its internal file extent limit on the .edb file. Once this threshold was reached, the database could no longer grow, and the system dismounted the database unexpectedly. No prior warning, just service interruption. Details: The .edb was around 1.2 TB in size. This isn’t a limit on database size itself — it’s about how fragmented the file is on disk. Once NTFS couldn’t track any more extents, the database stopped working. Microsoft doesn’t publish a clear fix for this; only scattered references to similar behavior in past cases. What we did: Created a fresh, clean database. Manually moved user mailboxes into the new DB. The old database couldn't be mounted anymore, so we brought the system live without historical mail – just to maintain continuity. We're now working on extracting data from the unmounted .edb using third-party tools. Looking for thoughts: Has anyone else hit the NTFS extent wall with Exchange? How do you monitor extent growth proactively? Did switching to ReFS solve this for you long-term? Open to any input or similar experiences – appreciate it in advance. Thanks!
I am receiving DMARC errors
Hello Please i need your help on this issue. Last night I started receiving DMARC and other errors when trying to send emails. I dont believe my business email is receiving messages either. Please help me 'fix' resolve these bounce back errors. I did try to find the solution on my own,, but its just out of my wheelhouse. Please help as my business is being affected by these errors and bounce backs.
Scoping application Crestron to access only room mailboxes of resourcetype Workspace
We got a requirement for to enable application Crestron to be able to access Workspace resourcetype Room mailboxes only. So, we thought of directly tieing the application to these mailboxes over the usual way of assigning it to a group because we had to create a group just for to maintain this delegation. Below are the steps we performed: #Create management scope Connect-ExchangeOnline New-ManagementScope -Name "Workspace Mailboxes" ` -RecipientRestrictionFilter "((RecipientTypeDetails -eq 'RoomMailbox') -and (ResourceType -eq 'Workspace'))" #Assign the management scope to Roles New-ManagementRoleAssignment ` -App "<AppID>" ` -Role "Application Calendars.ReadWrite" ` -CustomResourceScope "Workspace Mailboxes" ` -Name "MyApp-WorkspaceOnly" New-ManagementRoleAssignment ` -App "<AppID>" ` -Role "Application MailboxSettings.Read" ` -CustomResourceScope "Workspace Mailboxes" ` -Name "MyApp-WorkspaceOnly-Settings" #Verified the assignment via: Get-ManagementRoleAssignment -App "<AppID>" | ft Name, Role, CustomResourceScope Name Role CustomResourceScope ---- ---- ------------------- MyApp-WorkspaceOnly Application Calendars.ReadWrite Workspace Mailboxes MyApp-WorkspaceOnly-Settings Application MailboxSettings.Read Workspace Mailboxes Tested the scope of the assignment with a non-workspace mailbox and a workspace mailbox, the scope resulted false for non-workspace mailbox and true for a workspace mailbox. Later, admin consented for API permissions Calendars.ReadWrite, Mailboxsettings.Read & User.Read.All and generated an application secret with validity of 180 days to the application team and shared the secret key. ISSUE: When application team tested the access from Crestron application for a workspace mailbox it is resulting in Authentication Failed. This is the actual issue. In order to test whether this is happening because of scope , performed the below steps: $TenantId = "<TenantID>" $AppId = "<AppID>" $ClientSecret = "<ClientSecret>" $Body = @{ grant_type = "client_credentials" client_id = $AppId client_secret = $ClientSecret scope = "https://graph.microsoft.com/.default" } $TokenRequest = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" ` -Method POST -Body $Body $AccessToken = $TokenRequest.access_token $WorkspaceMailbox = "<email address removed for privacy reasons>" Invoke-RestMethod ` -Uri "https://graph.microsoft.com/v1.0/users/$WorkspaceMailbox/events" ` -Headers @{Authorization = "Bearer $AccessToken"} The expected results for this test was to receive Workspace mailbox → Returns events. Non-Workspace mailbox → Should return 403 Forbidden. However, it resulted events in both the cases, when dug further I realised that Graph API will override the management scopes created at Exchange level, so need guidance on how we can take this further.
Exchange Server 2019 to Subscription Edition (SE) Licensing and Migration Guidance
1. Current Infrastructure Setup Component Detail Notes Product Microsoft Exchange Server 2019 Enterprise Edition Servers 3 Virtual Servers (VMware) Configured in a Database Availability Group (DAG) Version Cumulative Update (CU) 15 Licenses Server License and 1100 CALs (Standard/Enterprise) Purchased in 2019 without Software Assurance (SA). 2. Core Licensing and Compliance Queries We require definitive guidance on the following compliance and purchase requirements: Software Assurance (SA) Requirement: Is Software Assurance mandatory for our existing Exchange Server 2019 setup for ongoing compliance and full support? Please advise on the status of our current setup without SA. Standalone SA Purchase: As our Exchange Server licenses/CALs were purchased in 2019 without SA, is it possible for us to purchase standalone Software Assurance for our existing Exchange Server 2019 licenses now, or must we purchase a completely new license with SA? Client Access License (CAL) Migration: Will our existing Exchange Server 2019 Standard/Enterprise CALs be compatible and automatically migrate to the Subscription Edition (SE) requirement, or must we purchase new CALs specifically for Exchange Server SE? Please clarify if the old CALs will become obsolete. 3. Recommended Migration Path (Budgeting Focus) Based on the licensing realities, we need advice on the most financially responsible path to move to Exchange Server SE. Please guide us on which of the following scenarios is recommended: Option A: Purchase Software Assurance for our existing Exchange Server 2019 infrastructure, and then migrate to SE, utilizing the same 2019 CALs (if permissible). Option B: Forego purchasing SA for the 2019 environment and directly purchase new Exchange Server Subscription Edition (SE) licenses and corresponding new CALs (if necessary). We look forward to your detailed guidance to ensure full compliance and a smooth transition to Exchange Server SE. Thank you, Narayan Das Senior System Administrator
