-
⚙️ Exchange monitoring and performance troubleshooting: where to start and why it is difficult
Exchange monitoring is much more than checking CPU, memory, or whether port 443 responds. In this post, we discuss practical monitoring approaches we repeatedly encounter during real-world troubleshooting: baselines, client experience counters, transport signals, dependency monitoring, Managed Availability, and why early weak signals often matter more than obvious outages.
-
🌐 Monitoring Exchange publication through WAP and ADFS: why simple health checks are often insufficient
Monitoring Exchange publication through WAP and ADFS is significantly more complicated than simply checking whether port 443 responds. In this post, we discuss why WAP servers may appear healthy while Exchange publication is already broken, how claims-based authentication complicates health checks, and what should actually be monitored in complex WAP + ADFS publishing scenarios.
-
🔐 Exchange STARTTLS certificate selection: how a new certificate can break SMTP before it is even enabled
During a routine certificate renewal, Exchange may unexpectedly select the new certificate for STARTTLS – even if it hasn’t been assigned to the SMTP service yet. This article explains why it happens and how to avoid TLS negotiation failed with error InvalidHandle.
-
🔐Exchange and Active Directory permissions: when security hardening conflicts with product architecture
Many Exchange-related Active Directory permissions look excessive from a traditional AD security perspective. As a result, security audits often recommend restricting or removing them. However, Exchange deeply depends on Active Directory permissions as part of its supported architecture. In this post, we discuss why permissions such as Reset Password, Change Password, SACL-related rights, and other…
-
⚠️ Exchange DAG, dynamic quorum and an unexpected datacenter failover behavior
A missing File Share Witness, dynamic quorum vote recalculation, and a real-world datacenter isolation scenario led to unexpected Exchange DAG behavior during a failover event. In this post, we analyze how dynamic quorum adjusted node votes, why the “wrong” datacenter retained quorum, why previous DR tests did not reveal the issue, and how hidden quorum…
-
📦 Exchange troubleshooting and log collection: why time matters
Exchange troubleshooting often begins too late — after important logs have already been overwritten. In this post, we discuss the Microsoft ExchangeLogCollector script, why rapid diagnostic collection matters, and how preserving the right data early can dramatically improve the chances of successful Root Cause analysis.
-
⚠️ Exchange DAG with an even number of nodes and no File Share Witness: a hidden risk
A healthy-looking DAG does not always mean a healthy quorum configuration. In this post, we discuss why an Exchange DAG with an even number of nodes still requires a properly configured File Share Witness, how dynamic quorum can hide the problem for a long time, and why missing witness resources may only become visible during…
-
🛡 Antivirus on Exchange Servers: When “Configured According to Best Practices” Still Isn’t Enough
Antivirus software is mandatory on Exchange servers, but misconfiguration goes far beyond missing folder exclusions. This article explains how antivirus process-level integration can silently affect IIS and Exchange services, why issues may look unrelated to antivirus at first glance, and how Microsoft-provided diagnostic scripts help identify configuration problems.
-
📅 A Second Calendar Took Over: Why New Events Land There and How We Fixed It
A real-world Exchange support case where a second calendar suddenly became the default one. All existing meetings stayed in the old calendar, while new events were created in the new one. We walk through why Exchange can’t tell you who caused it, why third-party mobile apps are often involved, and how to restore the correct…
-
🔐 Why You Cannot “Switch Exchange to LDAPS (636)” — and Why You Don’t Need To
Why Exchange cannot use LDAPS (636) — and why it doesn’t need to. Auditors often require “LDAPS everywhere,” but Exchange relies on LDAP over SASL (Kerberos/NTLM), which already provides encryption and integrity via signing/sealing on ports 389/3268. No plaintext data is ever transmitted. This post explains the architectural reasons, shows packet captures, and provides a…
EWS Free Area 