This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 61%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hi
I am currently using Exchange Server 2019 CU13 on-premises to relay emails from apps to O365 and to set up Exchange attributes on user accounts. There are no mailboxes on-premises since they are all in the cloud.
After reading the docs, I noticed a note about a hybrid configuration, but I cannot see the Hybrid agent installed on any server on-premises.
So this makes me think if my setup is hybrid at all?
Could it be that the we just using ECP to write the Exchange attributes and then be synced via ADsyc?
If my setup isn't hybrid, is it safe to install CU14 with Extended Protection?
Thanks, M
If you dont find any evidence of a Hybrid Agent and you have met all the requriements for Extended Protection, then yes I would install CU14 ASAP
Run the health checker and the script in this link and check that you meet the requirements.
Also see the info about SSLOffloading before installing
I will run the script and check thanks.
About SSLOffloading - I don't have any clients connecting to the exchange servers.
Just admins connecting to ECP and on-prem app sending emails via exchange server.
Will that be affected?
No, that should be fine. the SSLOffloading is really about client connectivity.
Great, I will make a plan.
If there are any issues with EP can I just run this command to revert?
.\ExchangeExtendedProtectionManagement.ps1 -DisableExtendedProtection
Correct. I havent heard of many issues with enabling it so you should be able to do so easily - esp since CU14 will just enable for you when you install it.
Nice one thanks Andy for your always helpful and expert assistance.
Just ran the ExchangeExtendedProtectionManagement.ps1 -PrerequisitesCheckOnly
and got this about SSLOffloading.
Must I set it to -false to continue with CU14 install or leave as i?
TLS prerequisites check successfully passed!
WARNING: 'exch01\RPC (Default Web Site)' has SSLOffloading set to true. Therefore, we can not configure Extended
Protection.
WARNING: 'exch02\RPC (Default Web Site)' has SSLOffloading set to true. Therefore, we can not configure Extended
Protection.
WARNING: Please address the following server regarding RPC (Default Web Site) and SSL Offloading:exch01,exch02
WARNING: The following cmdlet should be run against each of the servers: Set-OutlookAnywhere 'SERVERNAME\RPC (Default
Web Site)' -SSLOffloading $false -InternalClientsRequireSsl $true -ExternalClientsRequireSsl $true
All servers that we are trying to currently configure for Extended Protection have RPC (Default Web Site) set to false for SSLOffloading.
WARNING: Unable to continue due to the required prerequisites to enable Extended Protection in the environment. Please
address the above issues.
Do you have feedback regarding the script? Please email ExToolsFeedback@microsoft.com.
Set to false, yes
Most likely you are using regular hybrid and not the agent.
You can confirm by running:
Get-HybridConfiguration
on-prem Exchange powershell
I see it now, it's showing outdated server info (the server listed is long gone and the IP addresses are from an old provider firewall).
I wonder how it's still working...
Do I need to update this or can I leave as is?
About CU14 is it safe to install with Extended Protection on?
Thanks for helping out