Exchange 2013 CU7 debuts along with security fixes and updates for Exchange 2010 and Exchange 2007

Exchange 2013 CU6 appeared on August 26  Eleven weeks later Microsoft was all set to release Exchange 2013 CU7 until some late-breaking issues forced the correct decision to delay CU7 until everything was right. A month on, build 1044.25 (KB2986485) is now available for your download pleasure. The usual and hopefully now-well understood caveat that you need to test any new build of Exchange thoroughly before deploying it into production applies to CU7.

Microsoft has also released Exchange 2010 SP3 RU8 and Exchange 2007 SP3 RU15 to address the issues identified in security bulletin MS14-075 plus support for some new Russian time zones. In addition, specific updates for MS14-075 are now available for Exchange 2013 SP1 and Exchange 2013 CU6 (KB3011140) to allow customers to close off known security vulnerabilities without having to perform a full update while preparing to deploy CU7. In line with Microsoft support policy, a security update for CU5 is not provided.

My testing of CU7 builds show that the software is stable. However, a staggering variation of co-existence scenarios exist in the real world and I can provide no guarantee that you won’t hit an issue in your environment. Experience indicates that it’s a good idea to leave the bits aside for a week or so before you start your own testing, just to allow others to experience the unique joy of living on the bleeding edge of new software. Apart from anything else, the additional time will allow you to prepare for the testing - for instance, you might need to obtain updates for third-party products to run alongside CU7.

Exchange 2013 CU6 was all about restoring some performance and scalability to public folders. Leaving aside some pesky co-existence and other bugs, CU6 started the ball rolling by raising the limit to 100,000. CU7 moves the number further to allow deployments to support up to 250,000 public folders, another step in the march towards the declared goal of being able to support environments that contain 1 million public folders, a number that should satisfy even the most demanding deployment. 

Another aspect of public folders being tackled in CU7 is co-existence with legacy public folders. The approach taken will come as no surprise to anyone who has had to configure support for legacy public folders in a hybrid deployment because (quite logically) Microsoft has taken the same approach for pure on-premises deployments. It makes sense to reuse an method that has proved viable in practice, especially as it also solves a problem that appeared after the release of MAPI over HTTP in Exchange 2013 SP1

In a nutshell, the problem that Microsoft seeks to alleviate is that sometimes Outlook 2013 SP1 clients are unable to connect to legacy public folders after MAPI over HTTP was deployed. According to Microsoft, some legacy code in Exchange and in Outlook combined to redirect inbound connections to a public folder database, all of which seems good news until you realize that the server and client should not be working in this manner. Exchange provides Outlook clients with information about resources to which they can connect in the XML manifest generated by Autodiscover. All recent Outlook clients are designed to use the information provided by Autodiscover to connect to server resources. Having code in place that redirects connections might do the right thing now, but it could create instability further down the line when the older RPC over HTTP code is eventually retired from both Exchange and Outlook.

Detailed information about how to effect the changes necessary to support legacy public folder co-existence is posted on the EHLO blog.

CU7 includes a fix to the OWA problem that allowed users to get around in-place holds. The fix has already been in place in Office 365 for some time now and has proven to be both stable and effective. Another feature transferred from the cloud is BCC and DL preservation in message headers. I doubt that this change will make much difference to anyone who has already invested in a journaling solution, but it is good to have the same behavior on both sides of the cloud/on-premises divide, especially in hybrid deployments.

If you're using Apple iOS 8.1 email clients to synchromize Exchange mailboxes with ActiveSync, keep an eye on "out-of-date meeting" notifications generated by the Calendar Repair Assistant (CRA). This problem surfaced in Office 365 in late October and is expected to appear for on-premises customers as CU7 is deployed - unless Apple fixes the bugs that have caused CRA to have to fix time zones for meetings. As I covered last week, the nice people in Cupertino haven't moved on this issue so far.

Another interesting bug fixed in CU7 is the restoration of the "new mail" sound for OWA. Apparently, since SP1 OWA has been silent when new mail arrived. This sad state of affairs has been addressed and busy mailboxes can once more broadcast news of their activity to all and sundry.

Microsoft's blog post recommends that you backup servers once CU7 is deployed (unless you're a fan of native data protection and are not using traditional backups). Apparently some problems turned up during testing when attempts to restore backups taken with prior versions of Exchange 2013 failed to generate a good copy of a database. No great hue and cry on this topic has emerged in the field all indications are that the problem is an edge condition that is not encountered very often - or that we simply haven't noticed (but everyone tests backups, don't they?). In any case, Microsoft has updated the ESE database engine to address the problem that they identified, but just to be sure you should follow their advice and take a full backup of all databases as soon as is convenient after CU7 is deployed.

The final change worth noting is an update to OAB distribution. Microsoft changed the way that Exchange 2013 generates the OAB in CU5 and has now returned to this area to introduce shadow copies for OABs. Essentially, this allows for OAB copies to be distributed to servers in closer network proximity to users. The feature is disabled by default and has to be enabled on a per-OAB basis. More details about the OAB changes can be found on the EHLO blog. 

As you’d expect, CU7 also includes a number of bug fixes that are described in Microsoft Knowledge Base articles that will appear over the next few days.

Overall, CU7 continues to refine, tune, update, and improve Exchange 2013. Test it thoroughly, especially in co-existence scenarios, and make sure that all third party software works well with CU7 before deployment. A measured approach is always best.

Follow Tony @12Knocksinna