Exchange Server OWA does not display lnline Images after EEMS M2.1.0 mitigation.
Exchange Server can automatically apply applicable mitigations by using the Exchange Emergency Mitigation Service (EEMS) to retrieve mitigation information from Microsoft's Office Config Service (OCS). EEMS can apply several types of mitigations: 1. IIS URL Rewrite Rule Mitigation: Blocks specific malicious HTTP request patterns that could put an Exchange Server at risk. 2. Exchange Service Mitigation: Disables a vulnerable Exchange service. 3. Application Pool Mitigation: Disables a vulnerable application pool on the Exchange Server. In this case, inline images were displayed correctly in Outlook, but the same images were not displayed in OWA. The issue was identified as being related to the IIS URL Rewrite rule deployed by the M2.1.0 mitigation for CVE-2026-42897. Verification Run the following commands in the Exchange Management Shell. 1. Check the installed Exchange Security Update version (Get-Command ExSetup.exe).FileVersionInfo.ProductVersion 2. Check whether the Emergency Mitigation Service is enabled Get-OrganizationConfig | fl MitigationsEnabled 3. Check applied and blocked mitigations Get-ExchangeServer | fl Name,MitigationsApplied,MitigationsBlocked For example, a server affected by this issue may show: MitigationsApplied : {PING1, M2.1.0} MitigationsBlocked : {M2.1.0} 4. Check the IIS URL Rewrite rule Import-Module WebAdministration Get-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules/rule" -Name "." | Select-Object name The following rule may be present: EEMS M2.1 OWA CSP - outbound Microsoft provides Security Updates (SUs) to address security vulnerabilities in Exchange Server. Exchange Server SE is currently supported, while Exchange Server 2016 and Exchange Server 2019 can continue to receive applicable security updates through the Extended Security Updates (ESU) program. Note: Exchange Server 2016 and Exchange Server 2019 reached end of support in October 2025. ESU must be purchased separately to continue receiving applicable security updates. Resolution 1. Install the July 2026 SU or later Install the July 2026 SU or a later Security Update (preferably the latest available SU), and then restart the server. Installing the update does not automatically remove the previously applied CVE-2026-42897 mitigation. 2. Block M2.1.0 from being reapplied If M2.1.0 is not already listed under MitigationsBlocked, add it: Set-ExchangeServer -Identity EXSE-01 -MitigationsBlocked @{Add="M2.1.0"} Note: Adding M2.1.0 to MitigationsBlocked does not remove the IIS rules that have already been applied. It prevents EEMS from reapplying the M2.1.0 mitigation. 3. Back up the OWA web.config file Copy-Item ` -Path "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config" ` -Destination "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config.$((Get-Date).ToString('yyyyMMdd-HHmmss')).bak" 4. Remove the M2.1.0 IIS URL Rewrite rule and precondition Remove-WebConfigurationProperty ` -PSPath "IIS:\Sites\Default Web Site\owa" ` -Filter "system.webServer/rewrite/outboundRules" ` -Name "." ` -AtElement @{name="EEMS M2.1 OWA CSP - outbound"} Then remove the associated precondition: Remove-WebConfigurationProperty ` -PSPath "IIS:\Sites\Default Web Site\owa" ` -Filter "system.webServer/rewrite/outboundRules/preConditions" ` -Name "." ` -AtElement @{name="EEMS M2.1 OWA SPA HTML shell - precondition"} Verification After Rollback Without restarting the Exchange Server or running IISReset, reopen the same OWA message that previously failed to display the inline image and verify that the image is now displayed correctly. Test Results I reproduced the issue in an Exchange Server SE June 2026 SU test environment. After EEMS automatically applied the M2.1.0 mitigation, an inline PNG image that was displayed correctly in Outlook was no longer displayed in OWA. After blocking M2.1.0 and removing the M2.1.0 IIS rules according to Microsoft's rollback guidance, the inline image in the same message was displayed correctly again in OWA. No Exchange Server restart or IISReset was required after removing the IIS rules.
How to Delete a Composing Email Attachment via Outlook Add-in?
Context: Server: Exchange Server 2019 on premise Client: OWA Category: Outlook Add-in Office JS API Set: Supported up to 1.5 only Problem Details: Delete an attachment added manually or through EWS API to an email item. Limitations: 1. Limitation of makeEWSRequestAsync() Office JS method: The makeEWSRequestAsync method in Office.js does not support the DeleteAttachment SOAP operation, which is required from outlook add in. -> Attempted Workaround - Using fetch with EWS SOAP Request: I tried invoking the DeleteAttachment operation via a fetch call to the EWS endpoint. However, EWS response states "requested web method is not allowed for this application". 2. OWA Limitation: As OWA in this environment only supports Office.js up to version 1.5, the modern attachment Office JS APIs and Graph APIs are not an option. Question: In an Exchange On-Premises scenario, how can I programmatically delete attachments via my add-in? Specifically, is there a recommended approach to obtain a valid token for EWS requests, or any supported alternative to perform DeleteAttachment? Any way to convert EWS attachment ID to Office JS attachment UUID? Additional Notes: I am aware that Exchange Online supports more modern APIs (Graph/REST), but my current deployment is strictly Exchange On-Premises. The add-in works well for reading attachments and other operations, except for deletion. Any guidance or recommendations would be highly appreciated! Thank you in advance.
Why signatures disappear in OWA
Hi, We have problem with disappearing signatures in OWA. Signatures in OWA worked without problem till last week. But today, users that have BB licences and use only OWA loosing their signatures. It repeats every 1-2 days. Have anybody experience with this problem? Can you give me advice, how to solved it? Thanks.
Exchange Server 2019 OWA web app when open calendar keep direct login page
After migrate all mailbox from Exchange 2013 to 2019, Outlook client / mobile app working fine. However when open OWA web app then go Calendar, may be wait for few second or click on any event, it will reload to login page. I can't see any error from event log or inetpub\logs\LogFiles. If owa IP address point back to Exchange 2013, web app calendar work again. I tired add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\BackConnectionHostNames with exch2019.domain.local, domain.local and autodiscover.domain.local didn't help. The exchange server only allow access internally or by vpn connection. Any idea about this? Thanks
Exchange 2019 - Outlook/OWA all messages show the same time 8:02PM
Ok this one has me really puzzled. For some reason, which started randomly (since Feb 2023) the display time in Outlook, OWA and Phones (default app or outlook) have randomly been showing all emails as being received at 8:02PM and sometimes the next day at that time, on every message, could be ones that were sent at 11:02 am, could be ones sent at 2:22pm etc. And seems to have been some but not all users, but now more and more users are affected. All time zone and time syncs are correct. Headers shows the correct time and time zone on the messages. Messagetracking shows correct times as well. I was on Exch 2019, CU12, Nov22SU but did update to the Feb23SU(and all WU) and issue returned. It seems a reboot does fix it for a while. (Did the updates about 5-6 days ago, started again today) No major errors in event viewer other than the following, and that my SSL cert is expiring (in may) MSExchange Front End HTTP Proxy - 1003 [GetActiveCopiesForDatabaseAvailabilityGroup.FindAnotherServerLocatorServer: Server locator number of failovers since 2/22/2023 12:02:42 AM is already 25. No more failover attempts are allowed.] An internal server error occurred. The unhandled exception was: %2 but do not have a DAG The only other odd thing that I see is for some reason there is about 6 Microsoft Exchange certs (4 expire 2023, 2 expire 2026) and I believe there should only be one of those if I look at other setupsExchange 2013 The certificate key algorithm is not supported
Hello, We have an Exchange 2013 server, updated to CU23, which worked fine until one day, it showed the error on OWA "The certificate key algorithm is not supported"! I tried to put back an older valid certificate, reactivate all ciphers and TLS, updated to latest Microsoft patches, this error still comes back and I cannot manage the server anymore! Anyone has a clue how to resolve this issue?
