Exchange Archives - Ceyhun KIRMIZITAS

02Sep 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 2: Forms-Based and Basic Authentication – What Really Changes?

Exchange, Exchange Server SE / 2019 / 2016

Summary: In Part 1, we mapped the OWA authentication layers and captured the default configuration. In this part, we change only the frontend OWA authentication settings and watch what happens in Exchange, IIS, and the browser. Changing one Exchange OWA authentication setting can completely change what IIS allows and what the browser shows. Understanding those differences makes it much easier to tell a real authentication failure from an expected 401 challenge, a Basic prompt, or the normal Exchange OWA sign-in flow. Part 1: How OWA Authentication Really WorksPart 2: Forms-Based and Basic Authentication – What Really Changes? — you are herePart 3: Frontend vs Backend Authentication – Controlled A/B Tests — coming soon This is not a production hardening guide. The point is to change one thing at a time,…

31Aug 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 1: How OWA Authentication Really Works

Exchange, Exchange Server SE / 2019 / 2016

Summary: OWA authentication is easier to troubleshoot once the frontend, Exchange authentication layer, HttpProxy, and backend are treated as separate parts of the same request. This first part sets the baseline, shows the main commands, and explains which settings matter before we start changing anything. Exchange OWA authentication problems are easy to misdiagnose because the browser, frontend IIS, Exchange authentication layer, HttpProxy, and backend do not tell the same story. Before changing any setting, you need to know which layer actually owns the failure. Version scope: The behaviors and configurations covered in this series apply to Exchange Server 2019 CU15 and Exchange Server Subscription Edition (SE) RTM. Microsoft states that SE RTM is code-equivalent to Exchange 2019 CU15 apart from the license agreement, product name, and build number. Earlier Exchange…

25Aug 2026 by Ceyhun Kirmizitas 2 Comments

Get Exchange Server URLs and Authentication Settings with PowerShell

Exchange, Exchange Server SE / 2019 / 2016

The original GetExchangeURLs.ps1 script was written by Paul Cunningham to provide a simple way to display Exchange Server Client Access URLs from a single PowerShell script. Ali Tajran later updated the script to version 1.10, adding the PowerShell virtual directory and reorganizing the output. I recently revisited the script and decided to continue the same approach rather than create a completely new one. The result is Get-ExchangeURLs-v2.ps1. View / Download the PowerShell Script View Get-ExchangeURLs-v2.ps1 The script opens directly in the browser so the contents can be reviewed before saving or running it. Version 2 keeps the original read-only URL reporting concept, but updates and extends it with additional options for authentication visibility, service filtering, multi-server output, grouping, and text-file export. What Changed in Version 2 The main changes added…

24Aug 2026 by Ceyhun Kirmizitas No Comments

Get-ExchangeCertificate Returns Blank with a Valid Auth Certificate

Exchange, Exchange Server SE / 2019 / 2016

While validating a fresh Exchange Server 2019 CU15 installation, I started capturing the default configuration before making any namespace, certificate, or authentication changes. One of the first checks was Get-ExchangeCertificate. Unexpectedly, the cmdlet returned only the column headers and no certificate objects, even though the Exchange Admin Center showed the certificates normally. PowerShellGet-ExchangeCertificateGet-ExchangeCertificate Thumbprint Services Subject ---------- -------- ------- At first, this looked like the known Exchange Auth Certificate issue associated with PowerShell Serialization Payload Signing. However, the Auth Certificate was present, valid, correctly configured, and Microsoft's validation script reported no problem. What initially looked like a certificate problem eventually turned out to be related to the timing of certificate activation and HMAC key selection. Certificates were present and the Auth Certificate was valid The Exchange Admin Center showed all…

12Jun 2026 by Ceyhun Kirmizitas No Comments

Handling External Disclaimer Exceptions for Trusted Application Relays in Exchange Hybrid

Exchange, Exchange Online, Exchange Server SE / 2019 / 2016, Hybrid, Security & Hardening

In Exchange Hybrid environments, it is common to use mail flow rules to add an external disclaimer or warning banner to messages received from outside the organization. A typical warning may look like this: WARNING: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender. This is a good security control. It helps users identify messages that came from external sources. However, there are some scenarios where messages generated by internal application servers may also receive this external disclaimer. This usually happens when an internal application server submits email anonymously to Exchange Server on-premises, and Exchange then routes the message to Exchange Online. In this article, we will look at how to handle this scenario safely by using a custom header…

21May 2026 by Ceyhun Kirmizitas No Comments

Force OWA Light Users to Premium OWA After Exchange Server May 2026 CVE Mitigation

Exchange, Exchange Server SE / 2019 / 2016, Migration & Upgrade, Security & Hardening

Microsoft recently published guidance for Exchange Server addressing the May 2026 vulnerability. One important note in the article is related to OWA Light. Microsoft states that OWA Light — accessed by using an OWA URL ending with /?layout=light — does not work properly after the mitigation is applied. Microsoft also notes that this feature was deprecated several years ago and is not intended for regular production use. For a deeper look at the OWA request path and frontend/backend authentication design, see Exchange OWA Authentication Deep Dive – Part 1. This can become a practical issue if some users previously selected the following option in Outlook on the web: "Use the light version of Outlook" When this option is selected, the user may continue to be redirected to the Light version…

18Mar 2026 by Ceyhun Kirmizitas No Comments

What Happens to Shared Calendars After Exchange Hybrid Migration?

Exchange, Exchange Online, Hybrid, Migration & Upgrade

In Exchange Hybrid environments, shared calendar behavior after mailbox migration is often misunderstood. Many assume that calendar access breaks when a mailbox is moved to Exchange Online. In reality, the outcome depends on how permissions were configured before the migration. This article walks through a controlled scenario and shows exactly what happens. Scenario We use two users: buser01@onpremx.com bmuser01@onpremx.com Initial state: Both mailboxes are on on-prem Exchange Users can access each other’s calendars Step 1 – Test Default Behavior (On-Prem → On-Prem) Without assigning any permissions: Add calendar in Outlook Calendar is added successfully Only free/busy information is visible No subject or details This is expected. Default calendar permission: PowerShellAvailabilityOnlyAvailabilityOnly Step 2 – Check Existing Permissions Verify current permissions: PowerShellGet-MailboxFolderPermission bmuser01:\Calendar Get-MailboxFolderPermission buser01:\CalendarGet-MailboxFolderPermission bmuser01:\Calendar Get-MailboxFolderPermission buser01:\Calendar Typical result: No explicit…

13Apr 2019 by Ceyhun Kirmizitas No Comments

Moved Mailboxes Are Shown in Disconnected Mailbox – Exchange 2010 SP1 SP2 SP3

Exchange, Migration & Upgrade

You have just moved some mailboxes from one Exchange 2010 SP1 ( or later ) mailbox database to another mailbox database but all the moved mailboxes are shown in disconnected mailboxes. This happens because of the "Soft Deleted mailboxes". Exchange doesn?t fully delete the mailbox from the source database immediately after completion of the move. Instead, the mailbox in the source mailbox database is switched to a soft-deleted state. The soft-deleted mailboxes are retained in the source database until either the deleted mailbox retention period expires or you use the Remove-StoreMailbox cmdlet to purge the mailbox. You can see soft-deleted mailbox by running the following shell command Get-MailboxStatistics ?Database ?Mailbox Database Name? | Where-Object {$_.DisconnectReason ?eq ?Softdeleted?} You can delete all soft deleted mailboxes from a particular Mailbox Database by…

12Apr 2019 by Ceyhun Kirmizitas No Comments

Installing and Configuring Data Protection Manager 2010 for Exchange Server 2010 SP2

Exchange, System Center, Video Tutorials

A System Center Data Protection Manager (DPM) 2010 installation includes two primary tasks: installing the DPM prerequisite software and installing the DPM application. The DPM Setup Wizard guides you through the process of specifying the DPM installation settings, and automatically installs the prerequisite software as part of an integrated DPM installation process. Important Note: DPM 2010 is not supported on the Turkish language version of Windows Server 2008 or Windows Server 2008 R2. If the automatic installation of one or more of the DPM prerequisite software products fails, you can install the prerequisite software manually. Before installing DPM, note the following: All computers that you use for your DPM installation must meet at least the minimum hardware and software requirements. DPM Setup stops the Removable Storage service before installing DPM. After you install DPM, you…

Category: Exchange