Exchange update refusenik? Consider yourself warned by Microsoft
(2025/01/24)
- Reference: 1737754387
- News link: https://www.theregister.co.uk/2025/01/24/microsoft_has_a_warning_for/
- Source link:
Exchange Server administrators lagging on their cumulative and security updates be warned: Microsoft has stated that the Exchange Emergency Mitigation Service (EEMS) might stop working on "significantly out of date" versions of the software.
EEMS was [1]released in September 2021 and connects to the Office Configuration Service (OCS) to read the current state of mitigations.
Considering the infamously [2]dubious security of Exchange Server – so bad that Microsoft had to push the release of the latest version [3]deep into 2025 and leave Exchange Server 2019 as the latest and greatest incarnation while it worked on plugging the holes – EEMS is a useful service.
[4]
However, the service [5]might stop working if administrators do not keep on top of Exchange Server updates. One of the older certificate types used by OCS is being deprecated. Not to worry, according to Microsoft, "any server that is updated to any Exchange Server Cumulative Update (CU) or Security Update (SU) newer than March 2023 will continue to be able to check for new EEMS mitigations."
[6]
[7]
However, the company warned that EEMS on Exchange versions older than March 2023 would likely be unable to contact OCS for new mitigation definitions.
We contacted Microsoft to find out what that meant for the March 2023 Security Update itself – since "newer than March" [8]means April for Exchange Server 2019 and June for Exchange Server 2019, but the company has yet to respond.
[9]Microsoft patches the patch that broke Exchange Server
[10]Salt Typhoon's surge extends far beyond US telcos
[11]Amazon adds MFA to its enterprise email service ... eight years after launch
[12]Microsoft bigwig says the Feds catching Chinese spies in Exchange Online is the cloud working as intended
One of the issues fixed in the [13]March 14, 2023, Security Update for Exchange Server 2019, 2016, and 2013 is "EEMS stops responding after TLS endpoint certificate update," so it seems likely that if your server is updated as far as March 2023, then you should be OK.
At least from the perspective of EEMS.
[14]
Microsoft called an Exchange Server sitting that far back in the update cycle "significantly out of date," and there have certainly been a good few updates since then for Exchange Server 2019 and 2016.
Imagine what the company must call users still clinging to Windows 10. ®
Get our [15]Tech Resources
[1] https://techcommunity.microsoft.com/blog/exchange/new-security-feature-in-september-2021-cumulative-update-for-exchange-server/2783155
[2] https://www.theregister.com/2022/09/30/exchange_server_zero_day/
[3] https://techcommunity.microsoft.com/blog/exchange/exchange-server-roadmap-update/3421389
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://techcommunity.microsoft.com/blog/exchange/exchange-emergency-mitigation-service-might-not-work-for-servers-significantly-o/4370312
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://learn.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019
[9] https://www.theregister.com/2024/11/28/microsoft_fixes_broken_exchange_server/
[10] https://www.theregister.com/2024/11/27/salt_typhoons_us_telcos/
[11] https://www.theregister.com/2024/10/31/amazon_mfa_workmail/
[12] https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/
[13] https://support.microsoft.com/en-gb/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-14-2023-kb5024296-e13b0369-2102-4c95-bee2-456514630727
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
EEMS was [1]released in September 2021 and connects to the Office Configuration Service (OCS) to read the current state of mitigations.
Considering the infamously [2]dubious security of Exchange Server – so bad that Microsoft had to push the release of the latest version [3]deep into 2025 and leave Exchange Server 2019 as the latest and greatest incarnation while it worked on plugging the holes – EEMS is a useful service.
[4]
However, the service [5]might stop working if administrators do not keep on top of Exchange Server updates. One of the older certificate types used by OCS is being deprecated. Not to worry, according to Microsoft, "any server that is updated to any Exchange Server Cumulative Update (CU) or Security Update (SU) newer than March 2023 will continue to be able to check for new EEMS mitigations."
[6]
[7]
However, the company warned that EEMS on Exchange versions older than March 2023 would likely be unable to contact OCS for new mitigation definitions.
We contacted Microsoft to find out what that meant for the March 2023 Security Update itself – since "newer than March" [8]means April for Exchange Server 2019 and June for Exchange Server 2019, but the company has yet to respond.
[9]Microsoft patches the patch that broke Exchange Server
[10]Salt Typhoon's surge extends far beyond US telcos
[11]Amazon adds MFA to its enterprise email service ... eight years after launch
[12]Microsoft bigwig says the Feds catching Chinese spies in Exchange Online is the cloud working as intended
One of the issues fixed in the [13]March 14, 2023, Security Update for Exchange Server 2019, 2016, and 2013 is "EEMS stops responding after TLS endpoint certificate update," so it seems likely that if your server is updated as far as March 2023, then you should be OK.
At least from the perspective of EEMS.
[14]
Microsoft called an Exchange Server sitting that far back in the update cycle "significantly out of date," and there have certainly been a good few updates since then for Exchange Server 2019 and 2016.
Imagine what the company must call users still clinging to Windows 10. ®
Get our [15]Tech Resources
[1] https://techcommunity.microsoft.com/blog/exchange/new-security-feature-in-september-2021-cumulative-update-for-exchange-server/2783155
[2] https://www.theregister.com/2022/09/30/exchange_server_zero_day/
[3] https://techcommunity.microsoft.com/blog/exchange/exchange-server-roadmap-update/3421389
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://techcommunity.microsoft.com/blog/exchange/exchange-emergency-mitigation-service-might-not-work-for-servers-significantly-o/4370312
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://learn.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019
[9] https://www.theregister.com/2024/11/28/microsoft_fixes_broken_exchange_server/
[10] https://www.theregister.com/2024/11/27/salt_typhoons_us_telcos/
[11] https://www.theregister.com/2024/10/31/amazon_mfa_workmail/
[12] https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/
[13] https://support.microsoft.com/en-gb/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-14-2023-kb5024296-e13b0369-2102-4c95-bee2-456514630727
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5QbkHKFsntpXb-3spx4IQAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Excused Boots
"Imagine what the company must call users still clinging to Windows 10.”
Probably not fit for polite company.
Let’s be honest here Exchange, on premise Exchange is dead, MS don't want you to use it (be honest why would they, the money is in Azure?).
It’ll die the death by a thousand cuts, it’ll get, gradually, so more difficult to support that most companies will simply go ‘screw it and move to M365' - and then they’ve got you; paying them; for ever......
Bear in mind that Cumulative Updates have to be installed manually, as far as I'm aware, at least I've always done that.