Exchange Server SE / 2019 / 2016 Archives

20Sep 2026 by Ceyhun Kirmizitas 0 Comments

Exchange Server Auth Certificate Field Guide: Validation, Rotation, Recovery, and Time Zone Issues

Exchange, Exchange Server SE / 2019 / 2016

Applies to: Exchange Server SE / 2019 / 2016 In a healthy Exchange Server environment, Exchange Server Auth Certificate renewal should normally be a straightforward process. In the field, however, I have seen cases where this process did not go as expected. Sometimes the certificate is still healthy. Sometimes it is close to expiration. In other cases, it is already expired, invalid, or missing from one or more Exchange servers. The correct action is not the same in every case. Because of this, I wanted to put together a practical guide based on the Exchange Server Auth Certificate cases I see in real environments. This guide shows how to check the current state, choose the correct path, renew or replace the certificate when needed, validate the result, and complete the…

19Sep 2026 by Ceyhun Kirmizitas 0 Comments

Recover the Microsoft Exchange Self-Signed Certificate Without EMS

Exchange, Exchange Server SE / 2019 / 2016

Applies to: Exchange Server SE / 2019 / 2016 / 2013 Exchange Server creates a self-signed certificate during setup. Its friendly name is normally Microsoft Exchange, and its subject is the Exchange server name. For example, if the server name is EX1901, the certificate subject is CN=EX1901. Normally, you do not need to touch this certificate. But if it is removed, or if the Exchange Back End HTTPS binding loses the certificate, OWA, ECP, ActiveSync, and Exchange Management Shell can be affected. Microsoft documents this problem and uses New-ExchangeCertificate to create a replacement certificate. One of the possible symptoms is that Exchange Management Shell itself cannot connect. This post shows a practical recovery path when EMS is not available. Microsoft's recovery article is scoped to Exchange Server 2013 and 2016;…

02Sep 2026 by Ceyhun Kirmizitas 0 Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 2: Forms-Based and Basic Authentication – What Really Changes?

Exchange, Exchange Server SE / 2019 / 2016

Applies to: Exchange Server SE / 2019 / 2016 Summary: In Part 1, we mapped the OWA authentication layers and captured the default configuration. In this part, we change only the frontend OWA authentication settings and watch what happens in Exchange, IIS, and the browser. Changing one Exchange OWA authentication setting can completely change what IIS allows and what the browser shows. Understanding those differences makes it much easier to tell a real authentication failure from an expected 401 challenge, a Basic prompt, or the normal Exchange OWA sign-in flow. Part 1: How OWA Authentication Really WorksPart 2: Forms-Based and Basic Authentication – What Really Changes? — you are herePart 3: Frontend vs Backend Authentication – Controlled A/B TestsPart 4: Troubleshooting OWA Authentication with IIS and HttpProxy LogsPart 5: Managed…

31Aug 2026 by Ceyhun Kirmizitas 0 Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 1: How OWA Authentication Really Works

Exchange, Exchange Server SE / 2019 / 2016

Applies to: Exchange Server SE / 2019 / 2016 Summary: OWA authentication is easier to troubleshoot once the frontend, Exchange authentication layer, HttpProxy, and backend are treated as separate parts of the same request. This first part sets the baseline, shows the main commands, and explains which settings matter before we start changing anything. Exchange OWA authentication problems are easy to misdiagnose because the browser, frontend IIS, Exchange authentication layer, HttpProxy, and backend do not tell the same story. Before changing any setting, you need to know which layer actually owns the failure. Version scope: The controlled tests in this series were performed on Exchange Server 2019 CU15 and Exchange Server Subscription Edition (SE) RTM. Microsoft states that SE RTM is code-equivalent to Exchange 2019 CU15 apart from the license…

25Aug 2026 by Ceyhun Kirmizitas 2 Comments

Get Exchange Server URLs and Authentication Settings with PowerShell

Exchange, Exchange Server SE / 2019 / 2016

Applies to: Exchange Server SE / 2019 / 2016 The original GetExchangeURLs.ps1 script was written by Paul Cunningham to provide a simple way to display Exchange Server Client Access URLs from a single PowerShell script. Ali Tajran later updated the script to version 1.10, adding the PowerShell virtual directory and reorganizing the output. I recently revisited the script and decided to continue the same approach rather than create a completely new one. The result is GetExchangeURLs-v2.ps1. Download GetExchangeURLs-v2.ps1 Download from GitHub | Direct Download from Here Questions and feedback are welcome in the comments below. For script issues or feature requests, please use GitHub Issues. Current version: 2.1 (September 14, 2026). See What Changed below for the version history. In This Article 1. What Changed 2. Get Exchange Server URLs…

24Aug 2026 by Ceyhun Kirmizitas 0 Comments

Get-ExchangeCertificate Returns Blank with a Valid Auth Certificate

Exchange, Exchange Server SE / 2019 / 2016

Applies to: Exchange Server 2019 CU15 While validating a fresh Exchange Server 2019 CU15 installation, I started capturing the default configuration before making any namespace, certificate, or authentication changes. One of the first checks was Get-ExchangeCertificate. Unexpectedly, the cmdlet returned only the column headers and no certificate objects, even though the Exchange Admin Center showed the certificates normally. PowerShellGet-ExchangeCertificateGet-ExchangeCertificate Thumbprint Services Subject ---------- -------- ------- At first, this looked like the known Exchange Auth Certificate issue associated with PowerShell Serialization Payload Signing. However, the Auth Certificate was present, valid, correctly configured, and Microsoft's validation script reported no problem. What initially looked like a certificate problem eventually turned out to be related to the timing of certificate activation and HMAC key selection. In This Article 1. Certificates Were Present and the…

12Jun 2026 by Ceyhun Kirmizitas 0 Comments

Handling External Disclaimer Exceptions for Trusted Application Relays in Exchange Hybrid

Exchange, Exchange Online, Exchange Server SE / 2019 / 2016, Hybrid, Security & Hardening

Applies to: Exchange Server SE / 2019 / 2016 | Exchange Online | Hybrid In Exchange Hybrid environments, it is common to use mail flow rules to add an external disclaimer or warning banner to messages received from outside the organization. A typical warning may look like this: WARNING: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender. This is a good security control. It helps users identify messages that came from external sources. However, there are some scenarios where messages generated by internal application servers may also receive this external disclaimer. This usually happens when an internal application server submits email anonymously to Exchange Server on-premises, and Exchange then routes the message to Exchange Online. In this article, we…

21May 2026 by Ceyhun Kirmizitas 0 Comments

Force OWA Light Users to Premium OWA After Exchange Server May 2026 CVE Mitigation

Exchange, Exchange Server SE / 2019 / 2016, Migration & Upgrade, Security & Hardening

Applies to: Exchange Server SE / 2019 Microsoft recently published guidance for Exchange Server addressing the May 2026 vulnerability. One important note in the article is related to OWA Light. Microsoft states that OWA Light — accessed by using an OWA URL ending with /?layout=light — does not work properly after the mitigation is applied. Microsoft also notes that this feature was deprecated several years ago and is not intended for regular production use. For a deeper look at the OWA request path and frontend/backend authentication design, see Exchange OWA Authentication Deep Dive – Part 1. This can become a practical issue if some users previously selected the following option in Outlook on the web: "Use the light version of Outlook" When this option is selected, the user may continue…

23May 2013 by Ceyhun Kirmizitas 0 Comments

How to Perform Dial Tone Recovery in Exchange Server

Exchange, Exchange Server SE / 2019 / 2016, High Availability

Applies to: Exchange Server SE / 2019 / 2016 / 2013 / 2010 Dial tone recovery is an Exchange Server recovery method that gives users temporary mailboxes so they can continue sending and receiving email while the original mailbox database is being restored. The original version of this article was written for Exchange Server 2010 with Windows Server Backup. Microsoft still documents dial tone recovery for Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016. The recovery concept is the same, although the current procedure is based on Exchange Management Shell, a dial tone database, a Recovery Database, and mailbox restore requests. In This Article 1. What Is Dial Tone Recovery? 2. Dial Tone Recovery Process 3. Same Server or Alternate Server 4. Recovery Database and Data Merge…

Category: Exchange Server SE / 2019 / 2016