How to Perform HTTP -> HTTPS Redirection in a Single Exchange Server Environment

Tuesday, August 30, 2016
HTTP to HTTPS redirection in Outlook Web App is a user convenience that many admins consider a necessity. It automatically redirects the user's browser to if they enter, or simply Without redirection, the user will get an HTTP 403 Forbidden error page, like the one below.

This happens because the SSL settings on the Default Web Site and all subdirectories are configured to require SSL.

In multi-server environments where load balancers are used, HTTP -> HTTPS redirection is normally performed on the load balancer. Most load balancers, such as KEMP or F5, automatically configure it when you deploy one of their Exchange server templates.

In single Exchange environments without a load balancer, you must configure redirection directly on the server itself. The steps below explain how to do this. I've used this method since Exchange 2007 and it works perfectly 100% of the time. Other methods I've seen on the Internet sometimes cause routing errors.

  • Open Internet Information Services (IIS) Manager on the Exchange 2016 or Exchange client access server and navigate to Sites > Default Web Site.
  • Double-click Error Pages and add a new custom error page for status code 403.4 that responds with a 302 redirect to

  • Special note for Exchange 2016 - The Exchange team did a little number in the web.config file on Exchange servers to "improve performance", but it removes the custom error page behavior. So you'll need to do the following:
    • Open the C:\inetpub\wwwroot\web.config file in Notepad.
    • Remove the following line, and then save and close Notepad:
<remove name="CustomErrorModule" />

Note that this web.config edit will need to be made after every Exchange 2016 CU installation since setup overwrites this file.

That will handle the HTTP 403.4 - Forbidden: SSL is required error behavior in the browser. All that's left is to handle what happens when a user enters

  • Using Notepad, create a web page called default.htm in the C:\inetpub\wwwroot folder of the Exchange 2016 or client access server. Add the following three lines:

<meta http-equiv="REFRESH" content="0;url=/owa">
  • Save and close Notepad, and then test redirection.

Read more ...

How to Change the From Address in OWA

Monday, August 22, 2016
If you have Send-As rights for another mailbox, you may want to send email as that other user from your own mailbox. You may also want to send as an Office 365 Group so that all replies to your message go back to that group.

This is easy enough to do in the Outlook client by clicking the From drop-down box and selecting the appropriate account or entering an email address. It's not quite that intuitive in Outlook Web App (OWA), but it can still be managed.

First, you need to display the From field for the message you are composing in OWA. Click the [...] ellipses button and select Show From:

Next, right-click From the email address and select Remove:

Now type in the email address of the user or Office 365 Group you want to send the email as:

Of course you need to have rights to send as the user for this to work properly, otherwise you will get an NDR saying, "You don't have rights to send as this user."

Note that the sent item will go into your Sent Items folder, not the user's who you are sending as.

Read more ...

Announcing the 9th Annual UC Roundtable at Microsoft Ignite, Atlanta!

Tuesday, August 16, 2016

I'm pleased to announce the 9th Annual UC Roundtable at Microsoft Ignite 2016 in Atlanta!

A one of a kind conference deserves a one of a kind opportunity to network with your peers.

The purpose of the UC Roundtable is to gather Exchange, Office 365, and Skype for Business admins, MCMs, MVPs, Exchange product group members, architects, and experts for a free-flowing discussion about issues, questions, and experiences related to Exchange, Office 365, and Skype for Business. If you work with Exchange, Office 365, or Skype for Business or Lync Server you need to be here!

Wednesday, September 28th from 7:30PM to 11:00PM EDT

A big special thank you to my friends at F5 who will be hosting the event for the fifth year in a row! Those of you who have attended previous UC Rountables know that they put on a great event.

Please RSVP to for event details and location. I will email you the details via EventBrite.

Help spread the word on Twitter and I hope you can join me!


Also, I'm pleased to say that I will be presenting two sessions at Microsoft Ignite this year:
We will take questions from the audience and give advice from the voice of independent experience. I hope you can join me for these sessions. Check out the MyIgnite tool and schedule builder at

Read more ...

New Set-AutodiscoverSCP v2 script is on the TechNet Gallery

Friday, July 22, 2016
I just published version 2.0 of my Set-Autodiscover.ps1 script to the TechNet Gallery. This is a complete rewrite of the old script and includes the following new features:
  • Made setting the new values easier by cloning an existing server
  • Now also configures Outlook Anywhere and all Exchange virtual directory internal and external URLs
  • Revised verbiage and use *-ClientAccessService cmdlets for Exchange 2016
  • Added -Verbose output to display the values we're configuring
  • Improved overall display output
These changes are intended to make the script more powerful and easier to use.

How many times have you installed a new Exchange 2010-2016 server only to hear users complain about a security pop-up in Outlook referencing the new server?

This happens because Exchange setup uses the FQDN of the server as the service connection point (SCP) that Outlook clients use for autodiscover requests (for example, https://exch03.contoso.local/autodiscover/autodiscover.xml). This new SCP is configured in Active Directory when the Front-End Client Access role is installed during setup. In most load balanced environments the valid SCP should be something like Outlook will prompt users with a security warning because the self-signed Exchange certificate installed by setup is not trusted. If the new server is Internet-facing, ActiveSync clients can also get security warnings on their mobile device.

Read Exchange Active Directory Deployment Site for more information about this behavior.

I wrote a script, Set-AutodiscoverSCP.ps1 (available on the TechNet Gallery), that automatically updates the SCP, Outlook Anywhere FQDNs, and all the virtual directory internal/external URLs for the server your specify to match the values currently configured on another server you specify as soon as the new server is detected in AD. It continually polls Active Directory until it finds the new SCP value and sets the new values. A progress bar indicates that the script is polling AD.

The script is intended to run on another Exchange server in the org running the same version of Exchange as the new server. This is because Exchange 2010 cannot update SCP values for Exchange 2013 or 2016, and vice versa. You can also have the script target a particular domain controller. This is useful when the new server you are installing is in a different AD site.

The syntax for Set-AutodiscoverSCP.ps1 is:
Set-AutodiscoverSCP.ps1 [-Server] <String> [-ServerToClone] <String> [[-DomainController] <String>] [<CommonParameters>]
Two examples of usage:
PS C:\>Set-AutodiscoverSCP.ps1 -Server exch02 -ServerToClone exch01
Example #1 continually queries the current configuration domain controller until it finds an SCP for server EXCH02 and then sets it to match the SCP of EXCH01. It also configures Outlook Anywhere and the internal/external virtual directory URLs to match those found on EXCH01.

PS C:\>Set-AutodiscoverSCP.ps1 -Server exch02 -ServerToClone exch01 -DomainController dc03
Example #2 is almost the same as the command in the previous example, except it continually queries DC03 for the SCP record and configures it on that domain controller. This is useful when configuring a new Exchange server in a different Active Directory site.

The script is designed to be run during installation. Normally, you would run this script from an existing Exchange server of the same version while the new server is being installed.

You can also run the script directly from the server that is being installed. This is useful when you're installing the first Exchange 2013/2016 server in a 2010 environment. You can start running the script on the new server when the Client Access Front End Service is being installed. The caveat is that setup restarts IIS and web services several times during setup, causing the script to possibly stall during configuration of the virtual directories. If that happens, simply CTRL-C to quit the script and run it again.

I've included error handling for the following conditions:

  1. The script notifies you what version of Exchange is running the script and warns you to make sure the new server is running the same version. Note that Exchange 2013/2016 servers can update each other. This warning really only applies to Exchange 2010 and Exchange 2013/2016 coexistence. 
  2. The script checks that the server, server to clone, and the domain controller (if specified) are pingable. If the servers cannot be pinged, the script will terminate.
  3. If a domain controller is specified, it validates that the DC specified is actually a domain controller

Set-AutodiscoverSCP.ps1 is a useful addition to your Exchange toolbox. Please let me know if you have any questions or feature requests. I'll update the script again on the TechNet Gallery as needed.

Read more ...

Cannot Create Frontend Receive Connector using Exchange 2016 CU2 Admin Center

Wednesday, July 13, 2016
I've heard a few people complaining about this on Twitter and social media, so I figured I document it here.

You may find when you create a new Receive Connector using the Exchange Admin Center from an Exchange 2016 CU2 server that you cannot create the new connector as a Frontend Hub Transport role. The option to select the Frontend Transport role is grayed out and defaults to the Hub Transport role.

New receive connector role is grayed out

I've been able to reproduce this bug when the admin account used to create the new receive connector has a mailbox hosted on an Exchange 2016 CU server. If the admin account's mailbox is hosted on Exchange 2013 you can select the Frontend Transport role as expected.

This smells very much like a mailbox anchoring issue, which was supposed to have been reversed in Exchange 2016 CU2.

There are three workaround for this:
  • Create the new receive connector using the Exchange Management Shell (EMS)
  • Create the new receive connector from the Exchange 2013 Admin Center. Note you will need to connect directly to the Exchange 2013 EAC using the Exchange 2013 server's FQDN. For example,
  • Move the admin account's mailbox to an Exchange 2013 server. Note that this bug will still occur if the admin mailbox is hosted on an Exchange 2010 server.
You can create a new frontend transport receive connector via the Exchange Management Shell using a cmdlet similar to this example:
New-ReceiveConnector -Name 'New Receive Connector' -RemoteIPRanges @('') -Bindings @('') -Usage 'Custom' -Server '' -TransportRole 'FrontendTransport' 
I've created a bug for this on Microsoft Connect. Hopefully it will be corrected in Exchange 2016 CU3.

Irritating Side Note:
Why, oh why, does the Exchange Admin Center default to creating a Hub Transport role receive connector in the first place?? 99.99% of all receive connectors created by admins should be Frontend Transport role connectors. This causes much wailing and gnashing of teeth because the new receive connector doesn't function as expected.

In order to change the role to Frontend Transport, run the following cmdlet:
Set-ReceiveConnector "Receive Connector" -TransportRole "FrontendTransport"
FYI - I have an Exchange design change request logged to make the default transport role Frontend Transport, too. <holding breath>

Read more ...

MAPI Virtual Directory Bug in Exchange 2016 CU2

Wednesday, June 29, 2016
I discovered a bug in Exchange 2016 CU2 where if you change the MAPI virtual directory URLs using the Exchange Admin Center (EAC), it clears all forms of authentication from the MAPI virtual directory. This will cause all Outlook clients to constantly prompt for credentials because there are no ways for Outlook to authenticate.

All authentication methods are disabled

The default IISAuthenticationMethods for the MAPI virtual directory are NTLM, Negotiate, and OAUTH.

Steps to reproduce the issue:
  • Double-click the MAPI virtual directory from the Exchange Admin Center to confirm that authentication is set to NTLM and Negotiate. Note that OAUTH is not shown as an authentication method in EAC. Click Cancel to close the dialog box.
  • Double-click the MAPI virtual directory and change the internal and/or external URL and click Save.
    • Observing the command console, the cmdlet executed is: Set-MapiVirtualDirectory -ExternalUrl '' -IISAuthenticationMethods @() -Identity 'fe29d135-6f9c-4191-a68e-b028d94bd7ff'
  • If you examine the authentication settings before you click Save, the authentication settings will be written as NTLM and Negotiate (missing OAUTH).
    • Observing the command console, the cmdlet executed is: Set-MapiVirtualDirectory -ExternalUrl '' -IISAuthenticationMethods @(Ntlm,Negotiate) -Identity 'fe29d135-6f9c-4191-a68e-b028d94bd7ff'

This bug affects both Exchange 2013 and Exchange 2016 MAPI virtual directories configured using the Exchange 2016 CU2 EAC. Note that the MAPI virtual directory was not exposed in the EAC until Exchange 2016 RTM, so you won't see it in the Exchange 2013 EAC.

If you change the URLs via the Exchange Management Shell (without using the -IISAuthenticationMethods parameter) the URLs are updated without affecting the authentication methods.

To set the authentication methods for all MAPI virtual directories back to their defaults, run the following cmdlet from EMS:
Get-MapiVirtualDirectory | Set-MapiVirtualDirectory -IISAuthenticationMethods @(Ntlm,Negotiate,OAuth)
All MAPI virtual directories set back to default authentication methods

I reported this bug on Connect and Microsoft confirmed this is an issue with Exchange Server 2016 CU2.

Read more ...

How to Quickly Determine Exchange Server Versions

Tuesday, June 28, 2016
It's fairly easy to determine the version of Exchange Server running on a server using the Exchange Management Shell. The following cmdlet will display the Exchange version for each server in the organization, according to Active Directory:
Get-ExchangeServer | fl name,AdminDisplayVersion
The output will look something like this:

The AdminDisplayVersion value tells you the Exchange version using the following ww.xx.yyyy.zzz format:

MajorVersion | ServicePack | CumulativeUpdate/UpdateRollup | MinorVersion

For example, 14.3.0123.004 is Exchange 2010 Service Pack 3, 15.0.1178.004 is Exchange Server 2013 CU13, and 15.1.0466.034 is Exchange Server 2016 CU2. You can refer to Exchange Server Updates: build numbers and release dates to determine the exact version of Exchange is running. You can also run the Get-ExchangeServerBuildNumbers cmdlet in Exchange 2013 or Exchange 2016. This cmdlet scrapes the same webpage and displays the Product Names, Release Dates, and Build Numbers for every version of Exchange Server going as far back as Exchange Server 4.0 Standard Edition, released on June 11, 1996. Worth memorizing if you want to win one of Tony Redmond's famous Exchange trivia contests. :)

Note that Exchange 2013 CU4 was released as "Exchange 2013 Service Pack 1", but the ServicePack build number did not really increment until Exchange 2016 to 15.1, further demonstrating that Exchange 2016 is really just an incremental upgrade to Exchange 2013.

But what if you don't have easy access to EMS, or you want to check the version of the Exchange Server your mailbox is hosted on in Exchange Online for some reason?

If your on-prem Exchange 2013/2016 organization is using MAPI over HTTP (and you really should be) you can use the following URL to check which version of Exchange is running on the server hosting your mailbox:
For Office 365 use

The output will show the server version number, as shown below.

The cool thing about this method is that even works externally as long as Outlook Anywhere is published to the Internet. Keep in mind that the version returned is for the server hosting the mailbox being accessed, not the front-end client access proxy server. You can tell which front-end CAS your hitting by observing the Cafe server value.

Note that this method won't work if you haven't configured MAPI/HTTP or for mailboxes hosted on Exchange 2010 or earlier because they don't support MAPI over HTTP.

Read more ...