Virtual Machine with Windows Server 2022 with KB5022842 (Feb 2023) installed and configured with secure boot will not boot up on vSphere 7 unless updated to 7.0u3k (vSphere 8 not affected)

Virtual Machine with Windows Server 2022 with KB5022842 (Feb 2023) installed en configured with secure boot enabled will not boot up on vSphere 7 unless updated to 7.0u3k (vSphere 8 not affected)

VMware Seciroty Violation message

In VM vmware.log, there is ‘Image DENIED’ info like the below:
2023-02-15T05:34:31.379Z In(05) vcpu-0 – SECUREBOOT: Signature: 0 in db, 0 in dbx, 1 unrecognized, 0 unsupported alg.
2023-02-15T05:34:31.379Z In(05) vcpu-0 – Hash: 0 in db, 0 in dbx.
2023-02-15T05:34:31.379Z In(05) vcpu-0 – SECUREBOOT: Image DENIED.

To identify the location of vmware.log files:

  1. Establish an SSH session to your host. For ESXi hosts
  2. Log in to the ESXi Host CLI using root account.
  3. To list the locations of the configuration files for the virtual machines registered on the host, run the below command:

#vim-cmd vmsvc/getallvms | grep -i “VM_Name

  1. The vmware.log file is located in virtual machine folder along with the vmx file.
  2. Record the location of the .vmx configuration file for the virtual machine you are troubleshooting. For example:

/vmfs/volumes/xxxxxxxx-xxxxxxx-c1d2-111122223333/vm1/vm1.vmx
/vmfs/volumes/xxxxxxxx-xxxxxxx-c1d2-111122223333/vm1/vmware.log

Resolution

This issue is resolved in VMware ESXi 7.0 U3k, released on February 21st 2023. Build 21313628
A screenshot of a computer

Description automatically generated with medium confidence
Notes:

  • Virtual machines running on any version of vSphere ESXi 8.0.x are not impacted by this issue
  • vSphere ESXi 6.7 is End of general Support. For more information, see The End of General Support for vSphere 6.5 and vSphere 6.7 is October 15, 2022.
  • If you already face the issue, after patching the host to ESXi 7.0 Update 3k, just power on the affected Windows Server 2022 VMs. After you patch a host to ESXi 7.0 Update 3k, you can migrate a running Windows Server 2022 VM from a host of version earlier than ESXi 7.0 Update 3k, install KB5022842, and the VM boots properly without any additional steps required.

VMware vSphere PowerCLI 11.0

VMware vSphere PowerCLI 11.0 New Features

New features available on  VMware vSphere PowerCLI 11.0 is to support the new all updates and release of VMware products , find the below following has been features,

  • New Security module
  • vSphere 6.7 Update 1
  • NSX-T 2.3
  • Horizon View 7.6
  • vCloud Director 9.5
  • Host Profiles – new cmdlets for interacting with
  • New Storage Module updates
  • NSX-T in VMware Cloud on AWS
  • Cloud module multiplatform support
  • Get-ErrorReport cmdlet has been updated
  • PCloud module has been removed
  • HA module has been removed

Now we will go through above mentioned new features to find what functionality it bring to PowerCLI 11.0

What is PowerCLI 11.0 New Security Module

The new security module brings more powerful automation features to PowerCLI 11.0 available  new cmdlets include the following

  • Get-SecurityInfo
  • Get-VTpm
  • Get-VTpmCertificate
  • Get-VTpmCSR
  • New-VTpm
  • Remove-VTpm
  • Set-VTpm
  • Unlock-VM

Also New-VM cmdlet has enhanced functionality with the security module functionality and it includes parameters like KmsCluster, StoragePolicy, SkipHardDisks etc which can be used while creating new virtual machines with PowerCLI .In addition to that  Set-VM, Set-VMHost, Set-HardDisk, and New-HardDisk cmdlets are added.

Host Profile Additions

There are few additions to the VMware.VimAutomation.Core module that will make managing host profiles from PowerCLI

  • Get-VMHostProfileUserConfiguration
  • Set-VMHostProfileUserConfiguration
  • Get-VMHostProfileStorageDeviceConfiguration
  • Set-VMHostProfileStorageDeviceConfiguration
  • Get-VMHostProfileImageCacheConfiguration
  • Set-VMHostProfileImageCacheConfiguration
  • Get-VMHostProfileVmPortGroupConfiguration
  • Set-VMHostProfileVmPortGroupConfiguration

Storage Module Updates

These new Storage Module updates specifically for VMware vSAN , the updates has predefined time ranges when using Get-VsanStat. In addition  Get-VsanDisk has additional new properites that are returned including capacity, used percentage, and reserved percentage. Following are the  cmdlets have been added to automate vSAN

  • Get-VsanObject
  • Get-VsanComponent
  • Get-VsanEvacuationPlan – provides information regarding bringing a host into maintenance mode and the impact of the operation on the data, movement, etc

Additionally  following modules have been removed

  • PCloud module
  • HA module

Download now and start using

Update-module VMware.Powercli

Useful Links

Important information before upgrading to vSphere 6.7 (KB53704)

This article provides important documentation and upgrade information that must be reviewed before upgrading to vSphere 6.7.


Resolution


Compatibility considerations

TLS protocols

These products are not compatible with vSphere 6.7 at this time:

  • VMware NSX
  • VMware Integrated OpenStack (VIO)
  • VMware vSphere Integrated Containers (VIC)
  • VMware Horizon

Environments with these products should not be upgraded to vSphere 6.7 at this time. This article and the VMware Product Interoperability Matrixes will be updated when a compatible release is available.

Upgrade Considerations

Before upgrading your environment to vSphere 6.7, review these critical articles to ensure a successful upgrade
For vSphere

Upgrades to vSphere 6.7 are only possible from vSphere 6.0 or vSphere 6.5. If you are currently running vSphere 5.5, you must first upgrade to either vSphere 6.0 or vSphere 6.5 before upgrading to vSphere 6.7.

For vCenter Server

For Distributed Virtual Switches

Microsoft Deployment Toolkit 8450 Now Available

The Microsoft Deployment Toolkit (MDT), build 8450, is now available on the Microsoft Download Center. This update supports the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1709, available on the Microsoft Hardware Dev Center(adksetup.exe file version 10.1.16299.15).

Here is a summary of the significant changes in this build of MDT:

  • Supported configuration updates
    • Windows ADK for Windows 10, version 1709
    • Windows 10, version 1709
    • Configuration Manager, version 1710
  • Quality updates (titles of bug fixes)
    • Win10 Sideloaded App dependencies and license not installed
    • CaptureOnly task sequence doesn’t allow capturing an image
    • Error received when starting an MDT task sequence: Invalid DeploymentType value “” specified. The deployment will not proceed
    • ZTIMoveStateStore looks for the state store folder in the wrong location causing it to fail to move it
    • xml contains a simple typo that caused undesirable behavior
    • Install Roles & Features doesn’t work for Windows Server 2016 IIS Management Console feature
    • Browsing for OS images in the upgrade task sequence does not work when using folders
    • MDT tool improperly provisions the TPM into a Reduced Functionality State (see KB 4018657 for more information)
    • Updates to ZTIGather chassis type detection logic
    • Upgrade OS step leaves behind SetupComplete.cmd, breaking future deployments
    • Includes updated Configuration Manager task sequence binaries

See the following post on How to get help with MDT.

VMware Horizon 7.3.1 and Horizon Client 4.6 released

VMware has released VMware Horizon 7.3.1 and Horizon Client 4.6! With this new release, Horizon 7.3 enhances key platform features, including Horizon Virtualization Pack for Skype for Business, VMware Instant Clone Technology and the Horizon Help Desk Tool.

Many new items have been introduced, such as HTML5 video redirection support for the Chrome browser and the ability to configure Windows Start menu shortcuts for desktop and application pools using the Horizon Administrator console. As always, you can count on increased operating system support for virtual desktops and clients.

Here is an overview of the new features:

VMware Horizon 7.3 Server Enhancements

Horizon Help Desk Tool

  • Displays application process resources with reset control
  • Role-based access control for help desk staff
  • Activity logging for help desk staff
  • Displays Horizon Client information
  • Granular logon time metrics
  • Blast Extreme display protocol metrics

Instant Clone Technology

  • Instant-clone desktops can now use dedicated assignment to preserve the hostname, IP address and MAC address of a user’s desktop
  • Windows Server OS is now supported for desktop use
  • Instant clones are now compatible with Storage DRS (sDRS)
  • If there are no internal VMs in all four internal folders created in vSphere Web Client, these folders are unprotected, and you can delete them
  • IcUnprotect.cmd utility can now unprotect or delete template, replica or parent VMs or folders from vSphere hosts

Windows Start Menu Shortcuts Created Using the Admin Console

  • Create shortcuts to Horizon 7 resources:
    • Published applications
    • Desktops
    • Global entitlements

Cloud Pod Architecture Scale

  • Total session limit is increased to 140,000
  • The site limit is now seven

VMware Horizon Apps

  • This update makes Horizon Apps easier to use and allows the administrator to restrict entitlements
  • Restrict access to desktop and application pools from specific client machines

Resiliency for Monitoring

  • If the event database shuts down, Horizon administrator maintains an audit trail of the events that occur before and after the event database shutdown

Database Support

  • Always-On Availability Groups feature for Microsoft SQL Server 2014

ADMX Templates

  • Additional GPO settings for ThinPrint printer filtering, HTML5 redirection and enforcement of desktop wallpaper settings

Remote Experience

Horizon Virtualization Pack for Skype for Business

  • Multiparty audio and video conferencing
  • Horizon 7 RDSH support
    • Windows Server 2008 R2
    • Windows Server 2012 R2
  • Forward Error Correction (FEC)
  • Quality of Experience (QOE) metrics
  • Customized ringtones
  • Call park and pickup
  • E911 (Enhanced 911) support, to allow the location of the mobile caller to be known to the call receiver
  • USB desktop-tethering support
  • Horizon Client for Linux support for the following Linux distributions:
    • Ubuntu 12.04 (32-bit)
    • Ubuntu 14.04 (32 & 64-bit)
    • Ubuntu 16.04 (64-bit)
    • RHEL 6.9/CentOS 6.x (64-bit)
    • RHEL 7.3 (64-bit)
    • SLED12 SP2 (64-bit)

Additional NVIDIA GRID vGPU Support

  • Support for the Tesla P40 graphics card from NVIDIA

HTML5 Video Redirection

  • View HTML 5 video from a Chrome browser and have video redirected to the client endpoint for smoother and more efficient video playback

Performance Counter Improvements

  • Windows agent PerfMon counters improvements for Blast Extreme sessions: imaging, audio, client-drive redirection (CDR), USB and virtual printing

Linux Virtual Desktops

  • KDE support: Besides RHEL/CentOS 6.x, the KDE GUI is now supported on RHEL/CentOS 7.x, Ubuntu 14.04/16.04 and SUSE Linux Enterprise Desktop 11 SP4
  • MATE  interface is now supported on Ubuntu 14.04 and Ubuntu 16.04
  • Blast Extreme Adaptive Transport is now supported for Linux desktops
  • vGPU hardware H.264 encoder support has been added

USB Redirection

  • USB redirection is supported in nested mode

ThinPrint Filtering

  • Administrators can filter out printers that should not be redirected

Horizon Client 4.6 Updates

Security Update

  • All clients have been updated to use SHA-2 to prevent SHA-1 collision attacks

Session Pre-launch

  • Session pre-launch is now extended to both Horizon Client for macOS and Horizon Client for Windows

Apteligent

  • Integration of Apteligent crash log

Blast Extreme

  • Improvements in Blast Extreme Adaptive Transport mode for iOS and macOS
  • User can change Blast Extreme settings without having to disconnect

Horizon Client 4.6 for Windows

  • Support for UNC path with CDR

Horizon Client 4.6 for macOS

  • Support for macOS Sierra and macOS High Sierra
  • Selective monitor support
  • Norwegian keyboard support

Horizon Client 4.6 for iOS

  • CDR support with drag and drop of files in split view
  • iOS split keyboard enhancement
  • iOS UI updates

Horizon Client 4.6 for Android

  • Android Oreo support
  • Manage the Horizon server list with VMware AirWatch
  • Simple shortcuts
  • External mouse enhancements
  • Real-Time Audio-Video (RTAV) support for Android and Chrome OS

Horizon Client 4.6 for Linux

  • Blast Extreme Adaptive Transport support

Horizon Client 4.6 for Windows 10 UWP

  • Network recovery improvements

Horizon HTML Access 4.6

  • HTML Access for Android with a revised UI
  • Customization of HTML Access page

Horizon Help Desk Tool

The Horizon Help Desk Tool provides a troubleshooting interface for the help desk that is installed by default on Connection Servers. To access the Horizon Help Desk Tool, navigate to https://<CS_FQDN>/helpdesk, where <CS_FQDN> is the fully qualified domain name of the Connection Server, or click the Help Desk button in the Horizon Administrator console.

The Help Desk Tool was introduced in Horizon 7.2 and has been greatly expanded upon in the Horizon 7.3 release.

Help Desktop Tool features with Horizon 7.2:

  • Virtual machine metrics
  • Remote assistance
  • Session control (restart, logoff, reset, and disconnect)
  • Sending messages

Additional features with Horizon 7.3:

  • Display application process resources with reset control
  • Role-based access control for help desk staff
  • Activity logging for help desk staff
  • Granular login time metrics
  • Display Horizon Client information

User Session Details

The user session details appear on the Details tab when you click a user name in the Computer Name option on the Sessions tab. You can view details for Horizon Client, the VDI desktop or RDSH-published desktop, CPU and memory stats, and many other details.

  • Client version
  • Unified Access Gateway name and IP address
  • Logon breakdown (client to broker):
    • Brokering
    • GPO load
    • Profile load
    • Interactive
    • Authentication

Blast Extreme Metrics

Blast extreme metrics that have been added include estimated bandwidth (uplink), packet loss, and transmitted and received traffic counters for imaging, audio, and CDR.

Note the following behavior:

  • The text-based counters do not auto-update in the dashboard. Close and reopen the session details to refresh the information.
  • The counters for transmitted and received traffic counters are accumulative from the point the session is queried/polled.

Blast Extreme Metrics for a Windows 10 Virtual Desktop Session

Display and Reset Application Processes and Resources

This new feature provides help desk staff with a granular option to resolve problematic processes without affecting the entire user session, similar to Windows Task Manager. The session processes appear on the Processes tab when you click a user name in the Computer Name option on the Sessions tab. For each user session, you can view additional details about CPU- and memory-related processes to diagnose issues.

Role-based Access Control and Custom Roles

You can assign the following predefined administrator roles to Horizon Help Desk Tool administrators to delegate the troubleshooting tasks between administrator users:

  • Help Desk Administrator
  • Help Desk Administrator (Read Only)

You can also create custom roles by assigning the Manage Help Desk (Read Only) privilege along with any other privileges based on the Help Desk Administrator role or Help Desk Administrator (Read Only) role.

Members of the Help Desk Administrators (Read Only) role do not have access to following controls; in fact, functions such as Log Off and Reset are not presented in the user interface.

Watch this brief demonstration video of the Horizon Help Desk Tool to see it in action:

Horizon Virtualization Pack for Skype for Business

You can now make optimized audio and video calls with Skype for Business inside a virtual desktop without negatively affecting the virtual infrastructure and overloading the network.

All media processing takes place on the client machine instead of in the virtual desktop during a Skype audio and video call.

New support with many expanded features for the Horizon Virtualization Pack for Skype for Business can be found in Horizon 7.3 and Client 4.6.

New Features

Horizon Virtualization Pack for Skype for Business offers the following supported features:

System Requirements

The following table outlines the system requirements for the new release:

Supported Clients

The following table provides the list of support Horizon clients:

Start Menu Shortcuts Configured Through the Admin Console

This feature improves the user experience by adding desktop and application shortcuts to the Start menu of Windows client devices.

You can use Horizon Administrator to create shortcuts for the following types of Horizon 7 resources:

  • Published applications
  • Desktops
  • Global entitlements

Shortcuts appear in the Windows Start menu and are configured by IT. Shortcuts can be categorized into folders.

Users can choose at login whether to have shortcuts added to the Start menu on their Windows endpoint device.

Watch this brief demonstration video of the new Desktop and Apps Shortcuts feature to see it in action:

Dedicated Desktop Support for Instant Clones

Upon the initial release of instant clones in Horizon 7, we supported floating desktop pools and assignments only. Further investments have been made to Instant Clone Technology that add support for dedicated desktop pools. Fixed assignments and entitlements of users to instant-clone machines is now provided as part of Horizon 7.3.

Dedicated instant-clone desktop assignment means that there is a 1:1 relationship between users and desktops. Once an end user is assigned to a desktop, they will consistently receive access to the same desktop and corresponding virtual machine. This feature is important for apps that require a consistent hostname, IP address, or MAC address to function properly.

Note: Persistent disks are not supported. Fixed assignments to desktops does not mean persistence for changes. Any changes that the user makes to the desktop while in-session will not be preserved after logoff, which is similar to how a floating desktop pool works. With dedicated assignment, when the user logs out, a resync operation on the master image retains the VM name, IP address, and MAC address.

Support for the Tesla P40 Graphics Card from NVIDIA

VMware has expanded NVIDIA GRID support with Tesla P40 GPU cards in Horizon 7.3.

HTML5 Video Redirection

This feature provides the ability to take the HTML5 video from a Chrome (version 58 or higher) browser inside a Windows VDI or RDSH system and redirect it to Windows clients. This feature uses Blast Extreme or PCoIP side channels along with a Chrome extension.

The redirected video is overlaid on the client and is enabled as well as managed using GPO settings.

Benefits include:

  • Supports generic sites such as YouTube, without requiring a server-side plugin.
  • Provides smooth video playback comparable to the native experience of playing video inside a browser on the local client system.
  • Reduces data center network traffic and CPU utilization on the vSphere infrastructure hosts.

Improved USB Redirection with User Environment Manager

The default User Environment Manager timeout value has been increased. This change ensures that the USB redirection Smart Policy takes effect even when the login process takes longer than expected.

With Horizon Client 4.6, the User Environment Manager timeout value is configured only on the agent and is sent from the agent to the client.

You can now bypass User Environment Manager control of USB redirection by setting a registry key on the agent machine (VDI desktop or RDSH server). This change ensures that smart card SSO works on Teradici zero clients. Note: Requires a restart.

HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB uemFlags (REG_DWORD 1)

Blast Extreme Performance Counter Improvements

The Windows Agent PerfMon counters for the Blast Extreme protocol have been improved to update at a constant rate and to be even more accurate.

Counters include:

  • Imaging
  • Audio
  • CDR
  • USB
  • Virtual printing

Linux Virtual Desktops

Features and functions for Horizon 7 for Linux virtual desktops have been expanded:

  • KDE support – Besides RHEL/CentOS 6.x, the KDE GUI is now supported on RHEL/CentOS 7.x, Ubuntu 14.04/16.04, SUSE Linux Enterprise Desktop 11 SP4.
  • Support for the MATE interface on Ubuntu 14.04, Ubuntu 16.04.
  • Blast Extreme Adaptive Transport support.
  • vGPU hardware H.264 encoder support.

USB Redirection Support in Nested Mode

The USB redirection feature is now supported when you use Horizon Client in nested mode. When using nesting–for example, when opening RDSH applications from a VDI desktop–you can now redirect USB devices from the client device to the first virtualization layer and then redirect the same USB device to the second virtualization layer (that is, nested session).

Filtering Redirected Printers

You can now create a filter to specify the printers that should not be redirected with ThinPrint. A new GPO ADMX template (vmd_printing_agent.admx) has been added to enable this functionality.

By default, the rule permits all client printers to be redirected.

  • Supported attributes:
    • PrinterName
    • DriverName
    • VendorName
  • Supported operators:
    • AND
    • OR
    • NOT
  • Supported searching pattern is a regular expression.

Blast Extreme Improvements in CPU Usage

Now even lower CPU usage is achieved with adaptive Forward Error Correction algorithms. This clever mechanism decides how to handle error correction, lowering CPU usage within virtual desktop machines as well as on client endpoint devices.

Blast Extreme Adaptive Transport Side Channel

New support has been added for Blast Extreme Adaptive Transport side channels for USB and CDR communications. Once enabled, TCP port 32111 for USB traffic does not need to be opened, and USB traffic uses a side channel. This feature is supported for both virtual desktops and RDS hosts.

  • Feature is turned off by default.
  • Enable the feature through a registry key: HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config\UdpAuxiliaryFlowsEnabled 1

Entitlement Restrictions Based on Machine Name

This feature allows IT administrators to restrict access to published applications and desktops based on both client computer and user. With client restrictions for RDSH, it is now possible to check AD security groups for specific computer names. Users only have access to desktops and apps when both the user and the client machine are entitled. For this release, the feature is supported only for Windows clients and works with global entitlements.

Pre-Launch Improvements

Pre-launch provides the ability to launch an empty (application-less) session when connecting to the Connection Server. The feature is now also available to Windows clients, in addition to macOS.

Also, it is no longer necessary to manually make changes to the client settings. You can configure automatic reconnection.

Blast Extreme Adaptive Transport Mode for iOS and macOS

With prior client releases, users were required to configure their Blast Extreme settings before they connected to the Connection Server. After a connection was established, the options to change the Blast Extreme setting—which included H.264, Poor, Typical, and Excellent—were unavailable.

With this release, users can change the network condition setting from Excellent to Typical or the reverse while inflight to sessions. Doing so also changes the protocol connection type between TCP (for Excellent) and UDP (for Typical).

Note: End users will not be able to change the network condition setting if Poor is selected before establishing a session connection.

Horizon Client for Windows

Horizon Client 4.6 updates include:

  • Additional command-line options for the new client installer – When silently installing the Windows client, using the /s flag, you can now also set:
    • REMOVE-SerialPort,Scanner – Removes the serial port, scanner, or both.
    • DESKTOP_SHORTCUT-0 – Installs without a desktop shortcut.
    • STARTMENU_SHORTCUT-0 – Installs without a Start menu shortcut.

  • Support for UNC paths with client drive redirection (CDR):
    • Allows remote applications to access files from a network location on the client machine. Each location gets its own drive letter inside the remote application or VDI desktop.
    • Folders residing on UNC paths can now be redirected with CDR, and get their own drive letter inside the session, just as any other shared folder.

Horizon Client for macOS

Horizon Client 4.6 updates include:

  • Apple macOS High Sierra day 0 support.
  • Users can select which monitors to use for VDI sessions and which to use for the local system.
  • Norwegian keyboard support and mappings are now available

Horizon Client for iOS

Horizon Client 4.6 updates include:

  • iOS 11 support
  • iOS split keyboard update – Removes the middle area in the split keyboard for a better view of the desktop
  • New dialog box for easy connection to a Swiftpoint Mouse

Horizon Client for Android

Horizon Client 4.6 updates include:

  • Android 8.0 Oreo support.
  • Server URL configuration – Allows administrators to configure a list of Connection Servers and a default Connection Server on Android devices managed by VMware AirWatch.

Android and Chrome OS Client Updates

Horizon Client 4.6 for Android and Horizon Client 4.6 for Chrome OS updates include:

  • Simple shortcuts – Users can right-click any application or desktop to add a shortcut to the home screen.
  • Webcam redirection – Integrated webcams on an Android device or a Chromebook are now available for redirection using the Real-Time Audio-Video (RTAV) feature.

HTML Access

HTML Access 4.6 updates include:

  • HTML Access on Android devices – Though HTML Access has fewer features than the native Horizon Client, it allows you to use remote desktops and published applications without installing software.
  • HTML Access page customization – Administrators can customize graphics and text and have those customizations persist through future upgrades.

Horizon Client for Linux

Horizon Client 4.6 updates include:

  • Support for Raspberry Pi 3 Model B devices:
    • ThinLinx operating system (TLXOS) or Stratodesk NoTouch operating system
    • Supported Horizon Client features include:
  • Blast Extreme
  • USB redirection
  • 264 decoding
  • 8000Hz and 16000Hz audio-in sample rate
  • RHEL/CentOS 7.4 support

Horizon Client for Windows 10 UWP

Horizon Client 4.6 updates include:

  • Network recovery improvements – Clients can recover from temporary network loss (up to 2 minutes). This feature was already available for Windows, macOS, Linux, iOS, and Android, and is now available for Windows 10 UWP.
    • Automatically reconnects Blast Extreme sessions
    • Reduces re-authentication prompts

We are excited about these new features in Horizon 7.3.1 and the Horizon Client 4.6.  We hope that you will give them a try.

You can download it here.

Exchange Server 2016 Cumulative Update 7 (KB4018115) and Exchange Server 2013 Cumulative Update 18 (KB4022631)

The latest set of Cumulative Updates for Exchange Server 2016 and Exchange Server 2013 are now available on the download center.  These releases include fixes to customer reported issues, all previously reported security/quality issues and updated functionality.

Minimum supported Forest Functional Level is now 2008R2

In our blog post, Active Directory Forest Functional Levels for Exchange Server 2016, we informed customers that Exchange Server 2016 would enforce a minimum 2008R2 Forest Functional Level requirement for Active Directory.  Cumulative Update 7 for Exchange Server 2016 will now enforce this requirement.  This change will require all domain controllers in a forest where Exchange is installed to be running Windows Server 2008R2 or higher.  Active Directory support for Exchange Server 2013 remains unchanged at this time.

Support for latest .NET Framework

The .NET team is preparing to release a new update to the framework, .NET Framework 4.7.1.  The Exchange Team will include support for .NET Framework 4.7.1 in our December Quarterly updates for Exchange Server 2013 and 2016, at which point it will be optional.  .NET Framework 4.7.1 will be required on Exchange Server 2013 and 2016 installations starting with our June 2018 quarterly releases.  Customers should plan to upgrade to .NET Framework 4.7.1 between the December 2017 and June 2018 quarterly releases.

The Exchange team has decided to skip supporting .NET 4.7.0 with Exchange Server.  We have done this not because of problems with the 4.7.0 version of the Framework, rather as an optimization to encourage adoption of the latest version.

Known unresolved issues in these releases

The following known issues exist in these releases and will be resolved in a future update:

  • Online Archive Folders created in O365 will not appear in the Outlook on the Web UI
  • Information protected e-Mails may show hyperlinks which are not fully translated to a supported, local language

Release Details

KB articles that describe the fixes in each release are available as follows:

Exchange Server 2016 Cumulative Update 7 does not include new updates to Active Directory Schema.  If upgrading from an older Exchange version or installing a new server, Active Directory updates may still be required.  These updates will apply automatically during setup if the logged on user has the required permissions.  If the Exchange Administrator lacks permissions to update Active Directory Schema, a Schema Admin must execute SETUP /PrepareSchema prior to the first Exchange Server installation or upgrade.  The Exchange Administrator should execute SETUP /PrepareAD to ensure RBAC roles are current.

Exchange Server 2013 Cumulative Update 18 does not include updates to Active Directory, but may add additional RBAC definitions to your existing configuration. PrepareAD should be executed prior to upgrading any servers to Cumulative Update 18. PrepareAD will run automatically during the first server upgrade if Exchange Setup detects this is required and the logged on user has sufficient permission.

Additional Information

Microsoft recommends all customers test the deployment of any update in their lab environment to determine the proper installation process for your production environment. For information on extending the schema and configuring Active Directory, please review the appropriate TechNet documentation.

Also, to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed. To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded. If the policies are NOT set to Unrestricted you should use the resolution steps in KB981474 to adjust the settings.

Reminder: Customers in hybrid deployments where Exchange is deployed on-premises and in the cloud, or who are using Exchange Online Archiving (EOA) with their on-premises Exchange deployment are required to deploy the most current (e.g., 2013 CU18, 2016 CU7) or the prior (e.g., 2013 CU17, 2016 CU6) Cumulative Update release.

For the latest information on Exchange Server and product announcements please see What’s New in Exchange Server 2016 and Exchange Server 2016 Release Notes.  You can also find updated information on Exchange Server 2013 in What’s New in Exchange Server 2013, Release Notes and product documentation available on TechNet.

Note: Documentation may not be fully available at the time this post is published.

Cumulative Update 2 for Exchange Server 2016

.Net 4.6.1 Support

Support for .Net 4.6.1 is now available for Exchange Server 2016 and 2013 with these updates. We fully support customers upgrading servers running 4.5.2 to 4.6.1 without removing Exchange. We recommend that customers apply Exchange Server 2016 Cumulative Update 2 or Exchange Server 2013 Cumulative Update 13 before upgrading .Net FrameWork. Servers should be placed in maintenance mode during the upgrade as you would do when applying a Cumulative Update. Support for .Net 4.6.1 requires the following post release fixes for .Net as well.

Note: .Net 4.6.1 installation replaces the existing 4.5.2 installation. If you attempt to roll back the .Net 4.6.1 update, you will need to install .Net 4.5.2 again.

AutoReseed Support for BitLocker

Beginning with Exchange 2013 CU13 and Exchange 2016 CU2, the Disk Reclaimer function within AutoReseed supports BitLocker. By default, this feature is disabled. For more information on how to enable this functionality, please seeEnabling BitLocker on Exchange Servers.

SHA-2 Support for Self-Signed Certificates

The New-ExchangeCertificate cmdlet has been updated to produce a SHA-2 certificate for all self-signed certificates created by Exchange. Creating a SHA-2 certificate is the default behaviour for the cmdlet. Existing certificates will not automatically be regenerated but newly installed servers will receive SHA-2 certificates by default. Customers may opt to replace existing non-SHA2 certificates generated by previous releases as they see fit.

Migration to Modern Public Folder Resolved

The issue reported in KB3161916 has been resolved.

 

This cumulative update fixes the following issues:

This cumulative update also fixes the issues that are described in the KB 3160339 MS16-079: Security update for Microsoft Exchange: June 14, 2016 and KB 3134844 Cumulative Update 1 for Exchange Server 2016

Microsoft Knowledge Base articles.
This update also includes new daylight saving time (DST) updates for Exchange Server 2016. For more information about DST, go to Daylight Saving Time Help and Support Center.

Download: https://www.microsoft.com/en-us/download/details.aspx?id=52968

Configure your Exchange 2013 server with Configure-Echange2013.ps1 Updated to V3.2

Updated to V3.2

Change List:

# V1.0 Begin
# V1.1 Added Some New Options 12-10-2014
# V1.2 Added Hyper-V Best Practise & NTFS Partition Offset
# V1.3 Added KB2995145 .NET Framework 4.5 garbage collector heap Fix
# V1.4 Added Set Minimum Disk Space Warning level (180GB Default CU6 200GB CU5)
# V1.5 Added Some new features
# V1.6 Changed the Layout & Add Move Arbitration Mailbox
# V1.7 Added PST Export & KB2990117
# V1.8 Added Full backup, Database in GB and Mailbox Size in GB Export CSV
# V1.9 Added Outlook AnyWhere & SafetyNetHoldTime
# V2.0 Added Check DatacenterActivationMode, Get-DatabaseAvailabilityGroupNetwork, Add Static Route, Disable Replation Network on DAG, Database Copies Per Volume (AutoReseed)
# V2.1 Added Edge Subscription
# V2.2 Added Check Transaction Log Growth
# V2.3 Changed the Menu to Submenu’s
# V2.4 Added Check Database White Space
# V2.5 Added MAPI HTTP External URL
# V2.6 Fixed OWA Virtual URL & HTTP URL
# V2.7 Added Fixes & Mountpoints & Changed Set Minimum Disk Space Warning Level from REG to GlobalOverride
# V2.8 Maintaince Added
# V2.9 Set Power to Highperformance
# V3.0 Check of Microsoft.Exchange.Management.PowerShell.SnapIn is loaded
# V3.1 Added Set-OutlookProvider -Identity EXPR -CertPrincipalName msstd:*.domain.com & Set-OutlookProvider -Identity EXCH -CertPrincipalName msstd:*.domain.com
# V3.2 VMware Best Practises & Fixed soms things

Download: https://gallery.technet.microsoft.com/scriptcenter/Configure-Exchange-2013-e0ffb2a6

Translate »