Exchange Server¶

# Check Exchange Server installation details
$setupPath = "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup"
Get-ItemProperty $setupPath |
    Select-Object MsiInstallPath, MsiProductMajor, MsiProductMinor, MsiBuildMajor, MsiBuildMinor

# Determine which Exchange roles are installed on modern versions
$setupPath = "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup"
$roles = @("MBXRoleIsInstalled", "EdgeRoleIsInstalled")

foreach ($role in $roles) {
    $val = Get-ItemProperty $setupPath -Name $role -ErrorAction SilentlyContinue
    if ($val.$role -eq 1) {
        Write-Output "$role : Installed"
    } else {
        Write-Output "$role : Not installed"
    }
}

# Read transport configuration from registry
$transportPath = "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Transport"
Get-ItemProperty $transportPath |
    Select-Object QueueDatabasePath, QueueDatabaseLoggingPath, TemporaryStoragePath

# Move queue database to a dedicated SSD volume
$transportPath = "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Transport"
$newQueuePath = "D:\ExchangeQueue\Data"
$newQueueLogPath = "D:\ExchangeQueue\Logs"

# Create target directories
New-Item -Path $newQueuePath -ItemType Directory -Force | Out-Null
New-Item -Path $newQueueLogPath -ItemType Directory -Force | Out-Null

# Update registry
Set-ItemProperty -Path $transportPath -Name "QueueDatabasePath" -Value $newQueuePath -Type String
Set-ItemProperty -Path $transportPath -Name "QueueDatabaseLoggingPath" -Value $newQueueLogPath -Type String

# Restart the transport service
Restart-Service MSExchangeTransport

# Check current back pressure state
Get-ExchangeDiagnosticInfo -Process EdgeTransport -Component ResourceThrottling |
    Select-Object -ExpandProperty Diagnostics

# Check OWA virtual directory configuration via Exchange cmdlet
Get-OwaVirtualDirectory -Server (hostname) |
    Select-Object Name, InternalUrl, ExternalUrl, FormsAuthentication

# Verify OWA authentication settings in IIS
$owaSitePath = "IIS:\Sites\Default Web Site\owa"
Get-WebConfigurationProperty -Filter "system.webServer/security/authentication/windowsAuthentication" `
    -PSPath $owaSitePath -Name "enabled"
Get-WebConfigurationProperty -Filter "system.webServer/security/authentication/basicAuthentication" `
    -PSPath $owaSitePath -Name "enabled"

# Check ECP virtual directory
Get-EcpVirtualDirectory -Server (hostname) |
    Select-Object Name, InternalUrl, ExternalUrl

# List all mailbox databases with their paths
Get-MailboxDatabase -Server (hostname) -Status |
    Select-Object Name, EdbFilePath, LogFolderPath, DatabaseSize, AvailableNewMailboxSpace

# Read database paths from registry (used at service startup)
$replayPath = "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Replay\State"
Get-ChildItem $replayPath -ErrorAction SilentlyContinue |
    ForEach-Object {
        $props = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            DatabaseGuid  = $_.PSChildName
            DatabasePath  = $props.DatabasePath
            LogPath       = $props.LogPath
            SystemPath    = $props.SystemPath
        }
    }

# Verify disk performance for Exchange database volumes
Get-Counter -Counter "\PhysicalDisk(1 D:)\Avg. Disk sec/Read", `
    "\PhysicalDisk(1 D:)\Avg. Disk sec/Write" -SampleInterval 5 -MaxSamples 3 |
    Select-Object -ExpandProperty CounterSamples |
    Select-Object Path, CookedValue

# Check Edge Transport specific registry keys
$edgePath = "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\EdgeTransportRole"
Get-ItemProperty $edgePath -ErrorAction SilentlyContinue |
    Select-Object AdamLdapPort, AdamSslPort, ConfigDCHostName

# Verify EdgeSync subscription status
Get-EdgeSubscription | Select-Object Name, Domain, EffectiveDate, Duration, Status

# Check AD LDS instance for Edge Transport
Get-Service ADAM_MSExchange -ErrorAction SilentlyContinue |
    Select-Object Name, Status, StartType

# List all transport agents and their status
Get-TransportAgent | Select-Object Identity, Enabled, Priority | Format-Table -AutoSize

# Check content filter configuration
Get-ContentFilterConfig | Select-Object Enabled, SCLRejectEnabled, SCLRejectThreshold, `
    SCLDeleteEnabled, SCLDeleteThreshold, SCLQuarantineEnabled, SCLQuarantineThreshold

# Manage IP Allow/Block lists (Edge or Hub with anti-spam enabled)
# View current IP Allow List
Get-IPAllowListEntry | Select-Object IPRange, ExpirationTime

# Add a trusted partner mail server
Add-IPAllowListEntry -IPRange 203.0.113.50

# View IP Block List
Get-IPBlockListEntry | Select-Object IPRange, ExpirationTime

# Check sender filter configuration
Get-SenderFilterConfig | Select-Object Enabled, BlankSenderBlockingEnabled, BlockedSenders

# Check recipient filter configuration
Get-RecipientFilterConfig | Select-Object Enabled, BlockListEnabled, RecipientValidationEnabled

# Check connectivity logging configuration
Get-TransportService -Identity (hostname) |
    Select-Object ConnectivityLogEnabled, ConnectivityLogPath, ConnectivityLogMaxAge, `
    ConnectivityLogMaxDirectorySize

# Enable protocol logging on Send and Receive connectors
Get-SendConnector | Set-SendConnector -ProtocolLoggingLevel Verbose
Get-ReceiveConnector -Server (hostname) | Set-ReceiveConnector -ProtocolLoggingLevel Verbose

# Check protocol log paths
Get-TransportService -Identity (hostname) |
    Select-Object SendProtocolLogPath, ReceiveProtocolLogPath

# Search protocol logs for delivery failures to a specific domain
$logPath = "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend"
Get-ChildItem $logPath -Filter "*.LOG" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 5 |
    ForEach-Object {
        Select-String -Path $_.FullName -Pattern "partner\.com" -SimpleMatch |
            Select-Object -First 10
    }

# List all Exchange certificates
Get-ExchangeCertificate | Select-Object Thumbprint, Subject, Services, NotAfter, Status |
    Format-Table -AutoSize

# Assign a certificate to Exchange services
$thumbprint = "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2"
Enable-ExchangeCertificate -Thumbprint $thumbprint -Services IIS,SMTP,POP,IMAP -Force

# Check TLS settings on Send Connectors
Get-SendConnector | Select-Object Name, RequireTLS, TlsAuthLevel, TlsDomain

# Check TLS settings on Receive Connectors
Get-ReceiveConnector -Server (hostname) |
    Select-Object Name, RequireTLS, TlsCertificateName

# Enable opportunistic TLS on the Internet Send Connector
Set-SendConnector -Identity "To Internet" -RequireTLS $false
# TLS will be used when the remote server supports STARTTLS

# Force TLS for a specific partner domain
Set-SendConnector -Identity "To Partner" -RequireTLS $true `
    -TlsAuthLevel DomainValidation -TlsDomain "partner.com"

# Check transport queues for stuck messages
Get-Queue -Server (hostname) | Where-Object { $_.MessageCount -gt 0 } |
    Select-Object Identity, DeliveryType, Status, MessageCount, NextHopDomain, LastError |
    Format-Table -AutoSize

# Resolve MX record for the target domain
Resolve-DnsName -Name partner.com -Type MX | Select-Object NameExchange, Preference

# Test SMTP connectivity to the remote server
Test-NetConnection -ComputerName mail.partner.com -Port 25

# Enable verbose protocol logging if not already active
Set-SendConnector -Identity "To Internet" -ProtocolLoggingLevel Verbose

# Search recent SMTP Send logs for partner.com transactions
$logPath = "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend"
$recentLogs = Get-ChildItem $logPath -Filter "SEND*.LOG" |
    Sort-Object LastWriteTime -Descending | Select-Object -First 3

foreach ($log in $recentLogs) {
    Select-String -Path $log.FullName -Pattern "partner\.com" |
        Select-Object -First 20 Line
}

# Check Exchange certificates for expiration
Get-ExchangeCertificate | Where-Object { $_.Services -match "SMTP" } |
    Select-Object Thumbprint, Subject, NotAfter, Status

# Import the renewed certificate (PFX file)
$certPassword = ConvertTo-SecureString -String "P@ssw0rd2026" -AsPlainText -Force
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes("\\fileserver\certs$\mail-corp-com-2026.pfx")) `
    -Password $certPassword

# Get the new certificate thumbprint
$newCert = Get-ExchangeCertificate | Where-Object {
    $_.Subject -match "mail.corp.com" -and $_.Status -eq "Valid"
} | Sort-Object NotAfter -Descending | Select-Object -First 1

# Assign the new certificate to Exchange services
Enable-ExchangeCertificate -Thumbprint $newCert.Thumbprint -Services IIS,SMTP,POP,IMAP -Force

Write-Output "New certificate assigned: $($newCert.Thumbprint), expires: $($newCert.NotAfter)"

# Retry all messages in the stuck queue
Get-Queue -Server (hostname) | Where-Object { $_.NextHopDomain -eq "partner.com" } |
    Retry-Queue -Confirm:$false

# Monitor queue drainage
Start-Sleep -Seconds 30
Get-Queue -Server (hostname) | Where-Object { $_.NextHopDomain -eq "partner.com" } |
    Select-Object Identity, Status, MessageCount

# Verify TLS is now working in protocol logs
Start-Sleep -Seconds 60
$logPath = "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend"
Get-ChildItem $logPath -Filter "SEND*.LOG" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 1 |
    ForEach-Object { Select-String -Path $_.FullName -Pattern "TLS" | Select-Object -Last 5 Line }