Microsoft Exchange 2010 support ends in a matter of days and there are 139,000 internet-facing servers still up
- Reference: 1601627470
- News link: https://www.theregister.co.uk/2020/10/02/exchange2010_servers_exposed/
- Source link:
Exchange 2010 was initially due to go end-of-life in January this year, but Microsoft [1]extended support to 13 October. After this date the application will continue to run but "Microsoft will no longer provide technical support … including bug fixes, security fixes, and time zone updates." It will have been supported for nearly 11 years, having been released on 9 November 2009.
Exchange 2013 support ends in April 2023, while Exchange 2016 and 2019 will be abandoned together in October 2025.
But the out-of-support problem is coming to an end – kind of – since Microsoft [2]will no longer sell permanent licences when the next Exchange, currently known as "vNext," is released in the second half of 2021. It will be a subscription-only product and therefore be kept up to date automatically.
There will be an in-place upgrade from Exchange 2019 so the migration path is either to install vNext into an organisation and migrate the mailboxes, or upgrade Exchange in-place to 2019 and then to vNext. A twist is that the in-place upgrade to vNext is only supported for two years from release.
Long tail problem
Does anyone still run Exchange 2010? Indeed they do, [3]said Tom Sellers, principal security researcher at Rapid7. Using an internet-scanning tool, the company detected 139,711 instances of OWA published by Exchange 2010. It would also be a mistake to think that these servers are conscientiously maintained and patched, he opined.
"Nearly 54,000 of these have not been updated in six years," Sellers said.
If that is not enough to worry about, Rapid7 also identified 16,577 instances of OWA published by Exchange 2007 on the public internet. "This product has been out of support for over three years," Sellers said. "Additionally, the newest version of Windows Server that Exchange 2007 runs on is 2008 R2, which reached end of support in January 2020."
What is perhaps surprising is that there are fewer Exchange 2013 instances out there than 2010, according to Rapid7, with only 102,593 detected, and around 66 per cent are old and unsupported versions of that product.
Organisations are also doing a poor job of keeping Exchange 2016 and 2019 up to date, with 87 per cent of the former and 77 per cent of the latter missing the most recent updates, Sellers said. Of 2019, "there are nearly 2,100 that as far as we can tell have never had updates installed."
The situation may not be as bad as it first appears, in that Rapid7 is not able correlate the data with any information on the number of users on these servers. Some may be test installs, or servers that are out of use following migration to Microsoft 365 or Google Mail.
Some credit is due to Microsoft too: Outlook Web Access has a relatively good record for fixing security, with [4]59 CVE entries since 1999.
Why are there so many old versions of Exchange out there? One of the factors is that Exchange [5]isn't trivial to upgrade. Exchange 2010 was easier to deploy, and there is no in-place upgrade from 2010 to 2013, which may explain why there are so many still out there.
Admins need to think about versions of Windows Server, versions of Active Directory, fiddly issues with public folders, and implications for anti-spam and anti-malware. Email is messy and difficult to manage.
There are times, [6]times , [7]of course , when maintaining a mail server on-premises seems like a smart move, but the cost in terms of admin resources may be high. Although Exchange is among Microsoft's more reliable products, outages happen on-premises too, and probably more often, though they do not attract the same global attention.
Microsoft has also made its cloudy services hard to avoid, with things like ceasing to update the anti-spam feature in on-prem Exchange and recommending cloud-based Exchange Online Protection instead – landing organisations with the same cloud dependency that they were, perhaps, trying to avoid.
Curiously, Microsoft also makes running at least one Exchange server on-premises hard to avoid for many. Firms that use Azure Active Directory Connect, in order to synchronize Active Directory on-premises with its cloudy equivalent, are required to manage email recipients in an on-premises Exchange server, which then syncs changes to Exchange Online. A free licence is on offer, but it remains an administrative burden.
"We completely understand that this is difficult and expensive to do," [8]said Greg Taylor, Exchange director of product marketing, during the Ignite virtual event last month. "We have a solution in mind and are working towards it." More news is promised in Spring 2021.
Taylor also noted that Microsoft continues to work towards turning off basic authentication in Exchange Online, and highlighted new features on the way for Exchange admins, such as a completely new admin center dashboard.
One tip that some have missed: plus addressing, which lets users add throwaway email addresses including a + character for signing up to possibly dodgy websites or mailing lists, is now generally available, though admins need to enable it via PowerShell. One more reason to migrate from Exchange on-premises. ®
Get our [9]Tech Resources
[1] https://docs.microsoft.com/en-us/lifecycle/announcements/exchange-server-2010-support-extended
[2] https://www.theregister.com/2020/09/24/exchange_2022/
[3] https://blog.rapid7.com/2020/09/29/microsoft-exchange-2010-end-of-support-and-overall-patching-study/
[4] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=%22outlook+web+access%22
[5] https://docs.microsoft.com/en-us/exchange/upgrade-from-exchange-2010-to-exchange-2013-exchange-2013-help
[6] https://www.theregister.com/2019/01/29/office_365_outage/
[7] https://www.theregister.com/2020/09/28/microsoft_azure_office_outlook_outage/
[8] https://techcommunity.microsoft.com/t5/video-hub/exchange-here-there-and-everywhere/m-p/1688881
[9] https://whitepapers.theregister.com/
Re: Exchange 2007 and SBS
Last version of SBS (2011) included Exchange 2010, then was dropped as a product.
Re: Exchange 2007 and SBS
So could be both the 2007 and 2010 Exchange installs!
Re: Exchange 2007 and SBS
Future versions were a nightmare too. I had a test license of Exchange 2013 from TechNet, back when Microsoft had some brains and TechNet premium was still a thing. I had a test server to play around with and learn how to use new software. This was Server 2012 R2 standard. I had the essentials role installed for the backup. I follow Microsoft's instructions to the letter. Turns out, essentials role and Exchange were incompatible. But did Microsoft bother saying any of that in their instructions? Did Exchange throw an error in the install? Nope, the closest you get is that Exchange is incompatible with Server Essentials. It installed but never worked.
So I installed a Server 2012 R2 standard virtual machine. I had nothing installed, no updates of any kind. I once again followed Microsoft instructions to the letter. Exchange 2013 installed, but still didn't work. The web interface or Exchange powershell would never ever work.
This time I bought a book, and it had steps Microsoft didn't bother to include. A format, and following the book's instructions Exchange 2013 finally started to work. But 2 months later, the web interface stopped working, although everything else did work. I didn't test the Exchange powershell at that time. About 12 months after that, everything stopped working: calendar, email, etc. I had Exchange on a VM with nothing else and I didn't do anything to the VM, ever. I didn't touch Exchange or the Windows Server on the VM. After I installed, I never remoted into the VM server for any reason. I did nothing, and Exchange just stopped working for no good reason. I came to the conclusion that the new Microsoft has software so screwed up that you have to be pay them to be certified just to fix their incompetence.
Stating the somewhat obvious - not all of us can, or want to move our email servers off premises, or onto cloudy services. Other mail servers are available. Just not many (any?) that can be configured using your AD which for some reason is regarded as a killer app.
Moved all my users to GMail.
Can find no redeeming feature in either Outlook or Exchange at all, and certainly not in OWA.
For those whose inbox was precious, I just used GSSMO (be careful, GSMMO or something is a similarly named tool!) and imported their mailbox into GMail.
The only blocker was a couple of people who use desktop programs that use MAPI to send their mail... but Google Sync for Outlook sorts that out - they have an install of Outlook that syncs to their GMail and it sends the mail from GMail.
The administration, the spam-filtering, the access, the compatibility, the calendar... so much better with GMail and Google Calendar.
If I was a millionaire starting my own business, I'd just buy GSuite. So many problems solved so very simply in any modern browser.
Vnext - and so it starts
Borkzilla is finally gearing up to get everyone on board with a subscription. And with the perfect excuse : no more out-of-date mail servers !
Ain't life grand ? There are going to be some fat bonuses when Vnext comes out, and it'll be every year, too.
I am starting to think about getting some Borkzilla shares. It looks like they won't be going down any time soon.
Re: Vnext - and so it starts
You may of missed the fact many businesses have been using subscriptions for on prem MS stuff for year's.
CapEx vs OpEx etc etc...
Exchange 2007 and SBS
I wonder how many of those instances are on old installs of SBS. Great product to install and initially configure, but upgrades were a nightmare. For most small businesses, if it's not broken, they're not going to upgrade.