Exchange Extended Protection Service - 前置作業

-

前置作業 

若有Exchange ORG 中有Modern Hybrid server、Public Folder 等使用，可請排除或再詳細確認支援事項，也可參閱worldwide 的用戶反饋經驗


  1. 完成最新的CU & SU，基本支援N-1，如Exchange 2016 CU22也支援，但強烈建議直接上
    到最新的CU23 (2022H1 CU) 


  2. 所有EX 的CU/SU 版本要一致，可用Get-ExchangeServer | ft name, *version* 



  3. 每台Exchange Server 上的TLS設定需完全相同
    https://docs.microsoft.com/en-us/exchange/exchange-tls-configuration?view=exchserver-2019

    可統一執行下列機碼 (部分需重開機才會生效) 


  4. HealthChecker 也可檢查TLS 配置



  5. 可透過模擬方式執行腳本觀看結果
    .\ExchangeExtendedProtectionManagement.ps1 -WhatIf



  6. 可用的參數詳細介紹
    https://microsoft.github.io/CSS-Exchange/Security/Extended-Protection/


  7. 執行路徑有debug log 可參考


  8. 完成模擬執行結果，詳細列出異動的步驟


  9. 實際執行結果




  10. 心得:
    若組織內有多台Exchange Server 且分布多個site 如全球，那檢查步驟有可能非常耗時
    執行前及執行後多用HealthChecker 驗證結果
    EP 執行後不需要重開機或重設IIS

Comments

Post a Comment

Popular posts from this blog

E15 CU3–Update Failed–AD replicated Exceeded the tombstone lifetime.

-
Image
  Exchange 2013 CU3 The naming context is in the process of being removed or is not replicated http://technet.microsoft.com/en-us/library/replication-error-8452-the-naming-context-is-in-the-process-of-being-removed-or-is-not-replicated-from-the-specified-server(v=ws.10).aspx   C:\> REPADMIN /SHOWREPS Root\RDC01 DSA Options: IS_GC Site Options: (none) DSA object GUID: f1694974-47c4-4555-a214-db3c86854aeb DSA invocationID: f1694974-47c4-4555-a214-db3c86854aeb ==== INBOUND NEIGHBORS ====================================== CN=Schema,CN=Configuration,DC=lab7,DC=root     TW\AD02 via RPC         DSA object GUID: bfcc1053-e1da-46fd-8b9d-179c79921331         Last attempt @ 2013-12-19 17:
Read more

202301 - Exchange onpreme - PowerShell Serialization Payload Signing

-
Image
Released: January 2023 Exchange Server Security Updates https://techcommunity.microsoft.com/t5/exchange-team-blog/released-january-2023-exchange-server-security-updates/ba-p/3711808 https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ 1.  Update KB5022143 (Exchange SU) 2. Run latest HealthCherker 3.  PowerShell Serialization Payload Signing https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ Certificate signing of PowerShell serialization payload in Exchange Server https://support.microsoft.com/en-us/topic/certificate-signing-of-powershell-serialization-payload-in-exchange-server-90fbf219-b0dd-4b2c-8a68-9d73b3309eb1 4.  MonitorExchangeAuthCertificate    https://microsoft.github.io/CSS-Exchange/Admin/MonitorExchangeAuthCertificate/ 5.                 New-SettingOverride -Name "EnableSigningVerification" -Component Data -Section EnableSerializationDataSigning -Parameters @("Enabled=true&qu
Read more

E14–Bulk Create Mail Contact & Set-Contact

-
Image
  http://community.office365.com/en-us/w/exchange/579.aspx     Get-Contact | Export-Csv c:\temp\contact.csv Get-MailContact | Export-Csv c:\temp\Mailcontact.csv   [PS] Import-Csv .\Contact_Source.csv | % {New-MailContact -Name $_.Name -DisplayName $_.DisplayName -ExternalEmailAddress $_.ExternalEmailAddress -Alias $_.Alias -PrimarySmtpAddress $_.PrimarySMTPAddress -OrganizationalUnit "Contacts" -WhatIf }   [PS] >$Contacts = Import-Csv .\Contact_final.csv [PS] >$Contacts | foreach {Set-Contact $_.Name -Company $_.Company -Department $_.Department -Office $_.Office -Phone $_.Phone }
Read more