Exchange Server Edge Support on Windows Server 2016 Update


Today we are announcing an update to our support policy for Windows Server 2016 and Exchange Server 2016. At this time we do not recommend customers install the Exchange Edge role on Windows Server 2016. We also do not recommend customers enable antispam agents on the Exchange Mailbox role on Windows Server 2016 as outlined in Enable antispam functionality on Mailbox servers.

Why are we making this change?

In our post Deprecating support for SmartScreen in Outlook and Exchange, Microsoft announced we will no longer publish content filter updates for Exchange Server. We believe that Exchange customers will receive a better experience using Exchange Online Protection (EOP) for content filtering. We are also making this recommendation due to a conflict with the SmartScreen Filters shipped for Windows, Microsoft Edge and Internet Explorer browsers. Customers running Exchange Server 2016 on Windows Server 2016 without KB4013429 installed will encounter an Exchange uninstall failure when decommissioning a server. The failure is caused by a collision between the content filters shipped by Exchange and Windows which have conflicting configuration information in the Windows registry. This collision also impacts customers who install KB4013429 on a functional Exchange Server. After the KB is applied, the Exchange Transport Service will crash on startup if the content filter agent is enabled on the Exchange Server. The Edge role enables the filter by default and does not have a supported method to permanently remove the content filter agent. The new behavior introduced by KB4013429, combined with our product direction to discontinue filter updates, is causing us to deprecate this functionality in Exchange Server 2016 more quickly if Windows Server 2016 is in use.

What about other operating systems supported by Exchange Server 2016?

Due to the discontinuance of SmartScreen Filter updates for Exchange server, we encourage all customers to stop relying upon this capability on all supported operating systems. Installing the Exchange Edge role on supported operating systems other than Windows Server 2016 is not changed by today’s announcement. The Edge role will continue to be supported on non-Windows Server 2016 operating systems subject to the operating system lifecycle outlined at https://support.microsoft.com/lifecycle.

Help! My services are already crashing or I want to proactively avoid this

If you used the Install-AntiSpamAgents.ps1 to install content filtering on the Mailbox role:

  1. Find a suitable replacement for your email hygiene needs such as EOP or other 3rd party solution
  2. Run the Uninstall-AntiSpamAgents.ps1 from the \Scripts folder created by Setup during Exchange installation

If you are running the Edge role on Windows Server 2016:

  1. Delay deploying KB4013429 to your Edge role or uninstall the update if required to restore service
  2. Deploy the Edge role on Windows Server 2012 or Windows Servers 2012R2 (Preferred)

Support services is available for customers who may need further assistance.

The Exchange Team

Comments (13)

  1. Well, that explains it! I had this problem two days ago and wrote the article, “How to Uninstall Antispam Agents on Exchange Servers”. http://www.expta.com/2017/03/how-to-uninstall-antispam-agents-on.html

  2. This is silly.
    1) No one installed an edge server and used MS’s built in protection. You do an edge server and use a 3rd party spam/antivirus
    2) KB4013429 did blow up my edge server and this is the only post I’ve seen about it and this is over a week after KB4013429 was released. Come on man!

    We are still running exchange 2016 edge on windows 2016. KB4013429 was installed before exchange and everything is working fine. EOP requires Enterprise CALs. Very few of my 600 users have Enterprise CALs and the cost would be stunning to add it.

    This is clearly a bug and instead of trying to sell Office365 crap fix the problem.
    [Rant](WE REALLY DO NOT WANT ANY OF IT! :) It cost more and this stuff isnt’ hard to run in house. Also, we’ve had no major outages in years and MS cloud stuff have massive outages 2 times in the last few weeks!.) [/Rant]

    1. Patrick Glaudemans says:

      Yeah, this most obvious a bug. Nasty behaviour from MS. It’s pure laziness.
      Come on! – when are you going to address this BUG?

      1. WiVM says:

        I just lost a complete day on this! New installation and I was aware of this bug, but didn’t worry too much as it was installed by our WSUS selection. Later I noticed that this KB was replaced by KB4015438 and that one is replaced by KB4016635. My Transport service is crashing until I uninstall the KB4016635! The bug is still there in that KB. What is even worst is that nothing is mentioned about it in the “Known issues section” of either of the KBs. I do strongly agree that Microsoft WAS a company that was trustworthy, but isn’t any longer with too much focus on the cloud and total ignorance of customers and partners.

  3. JaviAl says:

    I like Exchange Server from 2000 versions. I use Exchange Server in all our customers servers because they do not want external services. But beginning deprecating features with Exchange Server 2013, like EMC, and now with this, there are no reason to continue using Exchange Server. Never use Exchange Online Protection (EOP) because they do not want external services, also never pay for a subcription, only pay one time for a license.

    Every day i have less trust in the cloud and more less trust in Microsoft.

    I have plans to migrate in this year all Windows Server 2008 R2 with Exchange Server 2010 to Windows Server 2016 and Exchange Server 2016, but without filtering and antispam i cancel the update. Also seeing a lot of telemetry services, 2 xbox live services, Onedrive, Phone, Contacts, Maps, Mobile devices, Geolocation, Camera, Radios (Phone,Airplane mode) and Wallet services installed by default in Windows Server 2016 with no option to uninstall it, is the best reason to stick with Windows Server 2008 R2 and Exchange Server 2010.

    Now searching to a good Linux server and a good email server program (not service).

  4. Uldrich says:

    Hello, so this article (Enable antispam functionality on Mailbox servers 2016) https://technet.microsoft.com/en-us/library/bb201691(v=exchg.160).aspx is now basically lie? If I do it on Windows Server 2016, my Transport Service will crash ?

    1. If you are not using Windows Server 2016, this article still applies. We are recommending that you not do this on Windows Server 2016 due to a known incompatibility that could lead to a transport crash. The crash will not happen in all cases. The Exchange and Windows teams are working together to resolve the incompatibility. At this time there is not a complete resolution to the issue which can be provided.

  5. Barry A. says:

    Wow!! Thanks guys, that explains a lot. I thought I was being smart moving everything to 2016 everything because MS was deprecating previous versions of everything in favour of Azure. I guess “Hybrid” is a misnomer. I guess the search is on to deprecate MS Exchange. Too many Open Source alternatives without the aggravation of MAPI/RPC/ActiveSync blah, blah, blah.

  6. Come on! says:

    Be good if you actually put this in the Known Issues part of the update KB: https://support.microsoft.com/en-au/help/4013429 – No wonder my EX16 box crashed. Great work guys!

    KB4016635 is much newer and has no mention of any fixes for this. Can we assume it’s still not fixed in this KB? https://support.microsoft.com/en-au/help/4016635

  7. Saigon says:

    It is time to look for alternatives…. unfortunately…

  8. Oliver Tarra says:

    Hi,
    I am sad about this article, because I just installed my new edge Servers and no I have to get rid of them and re-think my security concept.
    I like to use the EOP only in addition to my third party transport scanner.
    EOP is a good product, but is not able to fulfil all our requirements of today’s attacks.
    1. We can not scan for malicious links in mails and check them against WEB reputation databases.
    2. Quarantine time of 7 days ? In Austria, we like to go on vacation for more than one week….
    3. It is taking up to 3 hours before changes of EOP config are applied. i.E. block senders list

    So, please tell me why I should use EOP anymore, if I could buy an other solution which is fulfilling all these requirements?

    regards Oliver

  9. Stout says:

    FYI, the problem patch for April is KB4015217

  10. M.Qassas says:

    Thanks for sharing :)

Skip to main content