Microsoft Exchange Server 2016 Installation Guide

# Install required Windows Server features for Exchange 2016
Install-WindowsFeature NET-Framework-45-Features, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, Web-Mgmt-Console, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation, RSAT-ADDS, ADLDS, Server-Media-Foundation

# Enable additional IIS features
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ManagementScriptingTools,IIS-IIS6ManagementCompatibility,IIS-LegacySnapIn,IIS-ManagementConsole,IIS-Metabase,IIS-WebServerManagementTools,IIS-WebServerRole

# Restart to ensure all features are properly loaded
Restart-Computer

# Create download directory
New-Item -Path "C:\ExchangePrereqs" -ItemType Directory -Force

# Download Microsoft Unified Communications Managed API 4.0 Runtime
Invoke-WebRequest -Uri "https://download.microsoft.com/download/2/C/4/2C47A5C1-A1F3-4843-B9FE-84C0032C61EC/UcmaRuntimeSetup.exe" -OutFile "C:\ExchangePrereqs\UcmaRuntimeSetup.exe"

# Download Visual C++ Redistributable for Visual Studio 2015
Invoke-WebRequest -Uri "https://download.microsoft.com/download/9/3/F/93FCF1E7-E6A4-478B-96E7-D4B285925B00/vc_redist.x64.exe" -OutFile "C:\ExchangePrereqs\vc_redist.x64.exe"

# Install UCMA Runtime
Start-Process -FilePath "C:\ExchangePrereqs\UcmaRuntimeSetup.exe" -ArgumentList "/quiet" -Wait

# Install Visual C++ Redistributable
Start-Process -FilePath "C:\ExchangePrereqs\vc_redist.x64.exe" -ArgumentList "/quiet" -Wait

# Mount Exchange 2016 ISO or extract installation files
# Assuming installation files are in D:\Exchange2016

# Navigate to Exchange installation directory
Set-Location "D:\Exchange2016"

# Run Exchange Setup in unattended mode (modify as needed)
.\Setup.exe /mode:Install /role:Mailbox /OrganizationName:"YourOrganization" /IAcceptExchangeServerLicenseTerms

# For interactive installation with GUI
.\Setup.exe

# Load Exchange Management Shell
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

# Verify Exchange installation
Get-ExchangeServer | Format-List Name,Edition,ServerRole

# Configure accepted domains
New-AcceptedDomain -Name "yourdomain.com" -DomainName "yourdomain.com" -DomainType Authoritative

# Set default email address policy
Set-EmailAddressPolicy -Identity "Default Policy" -EnabledEmailAddressTemplates "SMTP:@yourdomain.com"
Update-EmailAddressPolicy -Identity "Default Policy"

# Generate certificate request for Exchange services
$cert = New-ExchangeCertificate -GenerateRequest -SubjectName "C=US,S=State,L=City,O=Organization,CN=mail.yourdomain.com" -DomainName "mail.yourdomain.com","webmail.yourdomain.com","autodiscover.yourdomain.com" -PrivateKeyExportable $true

# Import certificate after obtaining from CA
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes("C:\Certificates\mail.yourdomain.com.p7b"))

# Enable certificate for Exchange services
Enable-ExchangeCertificate -Thumbprint "YourCertificateThumbprint" -Services IIS,SMTP,POP,IMAP

# Check Exchange service status
Get-Service MSExchange* | Format-Table Name,Status,StartType

# Start Exchange services
Get-Service MSExchange* | Where-Object {$_.Status -eq "Stopped"} | Start-Service

# Stop Exchange services (in proper order)
Stop-Service MSExchangeTransport
Stop-Service MSExchangeIS
Stop-Service MSExchangeADTopology

# Set Exchange services to automatic startup
Get-Service MSExchange* | Set-Service -StartupType Automatic

# Verify critical service dependencies
Get-Service -Name "MSExchangeADTopology","MSExchangeIS","MSExchangeTransport" | Format-Table Name,Status,StartType

# Check Windows services required by Exchange
Get-Service -Name "W3SVC","IISADMIN","WinRM" | Format-Table Name,Status,StartType

# Create additional mailbox database
New-MailboxDatabase -Name "MailboxDB02" -EdbFilePath "D:\Exchange\Databases\MailboxDB02\MailboxDB02.edb" -LogFolderPath "D:\Exchange\Logs\MailboxDB02"

# Mount the database
Mount-Database "MailboxDB02"

# Set database quotas
Set-MailboxDatabase "MailboxDB02" -IssueWarningQuota 1.9GB -ProhibitSendQuota 2GB -ProhibitSendReceiveQuota 2.3GB

# Configure Send Connector for outbound email
New-SendConnector -Name "Internet Send Connector" -Usage Internet -AddressSpaces "SMTP:*;1" -SourceTransportServers "YourExchangeServer" -SmartHosts "smtp.yourprovider.com"

# Configure Receive Connector for inbound email
New-ReceiveConnector -Name "Inbound from Internet" -Usage Internet -Bindings "0.0.0.0:25" -RemoteIPRanges "0.0.0.0-255.255.255.255" -Server "YourExchangeServer"

# Configure message size limits
Set-TransportConfig -MaxReceiveSize 25MB -MaxSendSize 25MB

# Configure Outlook Web App virtual directory
Set-OwaVirtualDirectory -Identity "YourServer\owa (Default Web Site)" -ExternalUrl "https://webmail.yourdomain.com/owa" -InternalUrl "https://webmail.yourdomain.com/owa"

# Configure Exchange Control Panel
Set-EcpVirtualDirectory -Identity "YourServer\ecp (Default Web Site)" -ExternalUrl "https://webmail.yourdomain.com/ecp" -InternalUrl "https://webmail.yourdomain.com/ecp"

# Configure ActiveSync
Set-ActiveSyncVirtualDirectory -Identity "YourServer\Microsoft-Server-ActiveSync (Default Web Site)" -ExternalUrl "https://webmail.yourdomain.com/Microsoft-Server-ActiveSync"

# Configure Autodiscover
Set-ClientAccessService -Identity "YourExchangeServer" -AutoDiscoverServiceInternalUri "https://autodiscover.yourdomain.com/Autodiscover/Autodiscover.xml"

# Install IIS Application Request Routing
# Download and install ARR from Microsoft website

# Configure URL Rewrite rules for load balancing
Import-Module WebAdministration

# Create reverse proxy rule for OWA
New-WebConfigurationProperty -PSPath "IIS:\sites\Default Web Site" -Filter "system.webServer/rewrite/rules" -Name "." -Value @{name="ReverseProxyInboundRule1";patternSyntax="ECMAScript";stopProcessing="True"}

Set-WebConfigurationProperty -PSPath "IIS:\sites\Default Web Site" -Filter "system.webServer/rewrite/rules/rule[@name='ReverseProxyInboundRule1']/match" -Name "url" -Value "owa/(.*)"

Set-WebConfigurationProperty -PSPath "IIS:\sites\Default Web Site" -Filter "system.webServer/rewrite/rules/rule[@name='ReverseProxyInboundRule1']/action" -Name "type" -Value "Rewrite"
Set-WebConfigurationProperty -PSPath "IIS:\sites\Default Web Site" -Filter "system.webServer/rewrite/rules/rule[@name='ReverseProxyInboundRule1']/action" -Name "url" -Value "https://internal-exchange-server/owa/{R:1}"

# /etc/nginx/conf.d/exchange.conf
upstream exchange_servers {
    server 192.168.1.10:443;  # Exchange server IP
    server 192.168.1.11:443 backup;  # Backup Exchange server
}

server {
    listen 80;
    server_name webmail.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name webmail.yourdomain.com;

    ssl_certificate /etc/ssl/certs/yourdomain.com.pem;
    ssl_certificate_key /etc/ssl/private/yourdomain.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;

    location / {
        proxy_pass https://exchange_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_ssl_verify off;
    }

    location /owa/ {
        proxy_pass https://exchange_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_ssl_verify off;
    }
}

# Enable Windows Firewall
netsh advfirewall set allprofiles state on

# Create firewall rules for Exchange
New-NetFirewallRule -DisplayName "Exchange SMTP" -Direction Inbound -Protocol TCP -LocalPort 25 -Action Allow
New-NetFirewallRule -DisplayName "Exchange HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
New-NetFirewallRule -DisplayName "Exchange HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
New-NetFirewallRule -DisplayName "Exchange POP3S" -Direction Inbound -Protocol TCP -LocalPort 995 -Action Allow
New-NetFirewallRule -DisplayName "Exchange IMAPS" -Direction Inbound -Protocol TCP -LocalPort 993 -Action Allow

# Block unnecessary ports
New-NetFirewallRule -DisplayName "Block POP3" -Direction Inbound -Protocol TCP -LocalPort 110 -Action Block
New-NetFirewallRule -DisplayName "Block IMAP" -Direction Inbound -Protocol TCP -LocalPort 143 -Action Block

# Disable unused protocols
Set-PopSettings -ProtocolLogEnabled $false
Set-ImapSettings -ProtocolLogEnabled $false

# Configure authentication policies
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

# Set mailbox audit logging
Set-Mailbox -Identity "Administrator" -AuditEnabled $true -AuditLogAgeLimit 90

# Configure anti-spam settings
Set-ContentFilterConfig -Enabled $true -SCLJunkThreshold 5 -SCLRejectThreshold 7 -SCLDeleteThreshold 9

# Enable malware filtering
Set-MalwareFilterPolicy -Identity Default -Action DeleteMessage -EnableFileFilter $true

# Configure TLS settings for SMTP
Set-ReceiveConnector -Identity "YourServer\Default YourServer" -TlsAuthLevel DomainSecureEnabled -RequireTLS $true

Set-SendConnector -Identity "Internet Send Connector" -RequireTLS $true -TlsAuthLevel DomainSecureEnabled

# Disable weak cipher suites
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128' -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128' -Name 'Enabled' -Value 0 -PropertyType DWORD

# Configure circular logging (reduces log file growth)
Set-MailboxDatabase -Identity "Mailbox Database" -CircularLoggingEnabled $true

# Set database backup settings
Set-MailboxDatabase -Identity "Mailbox Database" -BackgroundDatabaseMaintenance $true

# Check database health
Get-MailboxDatabaseCopyStatus | Format-List

# Configure MSExchangeIS memory usage
Set-MailboxDatabase -Identity "Mailbox Database" -IsExcludedFromProvisioning $false -IsExcludedFromInitialProvisioning $false

# Set transport server limits
Set-TransportService -Identity "YourExchangeServer" -MaxConcurrentMailboxDeliveries 20 -MaxConcurrentMailboxSubmissions 20

# Optimize OWA performance
Set-OwaVirtualDirectory -Identity "YourServer\owa (Default Web Site)" -GzipLevel High

# Move transaction logs to separate drive
Move-DatabasePath -Identity "Mailbox Database" -LogFolderPath "E:\Exchange\Logs"

# Configure database file paths
Move-DatabasePath -Identity "Mailbox Database" -EdbFilePath "D:\Exchange\Databases\MailboxDB.edb"

# Set database maintenance schedule
Set-MailboxDatabase -Identity "Mailbox Database" -MaintenanceSchedule "Sun.1:00 AM-Sun.5:00 AM"

# Check overall Exchange health
Get-ServerHealth | Where-Object {$_.AlertValue -ne "Healthy"}

# Monitor queue status
Get-Queue | Format-Table Identity,Status,MessageCount,DeliveryType

# Check database status
Get-MailboxDatabaseCopyStatus | Format-Table Name,Status,CopyQueueLength,ReplayQueueLength

# Monitor event logs
Get-EventLog -LogName Application -Source "MSExchange*" -EntryType Error -Newest 50

# Monitor key performance counters
Get-Counter "\MSExchange Database(Information Store)\Database Cache % Hit"
Get-Counter "\MSExchange Transport Queues(_total)\Submission Queue Length"
Get-Counter "\Process(Microsoft.Exchange.Store.Worker)\% Processor Time"

# Create custom monitoring script
$Counters = @(
    "\MSExchange Database(Information Store)\Database Cache % Hit",
    "\MSExchange Transport Queues(_total)\Submission Queue Length",
    "\Memory\Available MBytes"
)

Get-Counter -Counter $Counters -SampleInterval 5 -MaxSamples 12

# Configure Exchange logging levels
Set-EventLogLevel -Identity "MSExchange Management\Provisioning" -Level Lowest

# Set message tracking log retention
Set-TransportService -Identity "YourExchangeServer" -MessageTrackingLogMaxAge 30.00:00:00

# Configure IIS log retention
Set-WebConfigurationProperty -PSPath "IIS:\sites\Default Web Site" -Filter "system.webServer/httpLogging" -Name "dontLog" -Value $false

# Install Windows Server Backup feature
Install-WindowsFeature Windows-Server-Backup -IncludeManagementTools

# Configure backup schedule for Exchange
$BackupPolicy = New-WBPolicy
$BackupTarget = New-WBBackupTarget -VolumePath "F:"
Add-WBBackupTarget -Policy $BackupPolicy -Target $BackupTarget

# Add system state and Exchange volumes
Add-WBSystemState -Policy $BackupPolicy
Add-WBVolume -Policy $BackupPolicy -Volume "C:","D:","E:"

# Set backup schedule
Set-WBSchedule -Policy $BackupPolicy -Schedule 02:00

# Apply the backup policy
Set-WBPolicy -Policy $BackupPolicy

# Prepare for backup (suspend circular logging)
Set-MailboxDatabase -Identity "Mailbox Database" -CircularLoggingEnabled $false

# Backup script using PowerShell
$BackupPath = "\\BackupServer\Exchange\$(Get-Date -Format 'yyyyMMdd')"
New-Item -Path $BackupPath -ItemType Directory -Force

# Export mailbox to PST (for individual mailbox backup)
New-MailboxExportRequest -Mailbox "user@yourdomain.com" -FilePath "$BackupPath\user-$(Get-Date -Format 'yyyyMMdd').pst"

# Database backup using VSS
Start-Process -FilePath "diskshadow.exe" -ArgumentList "/s C:\Scripts\exchange-backup.txt" -Wait

# Document recovery procedures
# 1. Restore Windows Server 2016 from backup
# 2. Restore Exchange binaries
# 3. Restore database files
# 4. Mount databases

# Example database restore
Dismount-Database -Identity "Mailbox Database"
# Restore database files from backup
Mount-Database -Identity "Mailbox Database"

# Verify mailbox accessibility
Test-MAPIConnectivity -Identity "Mailbox Database"

# Check Active Directory preparation status
Get-ExchangeServer | Format-List Name,WhenCreated,AdminDisplayVersion

# Verify schema updates
Get-ADRootDSE | Select-Object schemaNamingContext
Get-ADObject -Identity "CN=ms-Exch-Schema-Version-Pt,CN=Schema,CN=Configuration,DC=yourdomain,DC=com" -Properties rangeUpper

# Test AD connectivity
Test-SystemHealth -Identity "YourExchangeServer" -HealthSet "AD"

# Check service dependencies
sc.exe qc MSExchangeTransport
sc.exe qc MSExchangeIS

# Verify event logs for errors
Get-EventLog -LogName Application -Source "MSExchange*" -EntryType Error -Newest 10

# Test Exchange services health
Test-ServiceHealth | Where-Object {$_.Role -eq "Mailbox"}

# Test mail flow connectivity
Test-MailFlow -TargetEmailAddress "test@external.com"

# Check message tracking logs
Get-MessageTrackingLog -Start (Get-Date).AddDays(-1) -Recipients "user@yourdomain.com"

# Verify transport queues
Get-Queue | Where-Object {$_.MessageCount -gt 0}

# Test SMTP connectivity
Test-SmtpConnectivity -Identity "YourExchangeServer"

# Check certificate status
Get-ExchangeCertificate | Format-List FriendlyName,Subject,Thumbprint,NotAfter,Services

# Test certificate configuration
Test-OutlookConnectivity -ClientAccessServer "YourExchangeServer" -MailboxCredential (Get-Credential)

# Verify SSL configuration
Test-ImapConnectivity -ClientAccessServer "YourExchangeServer" -MailboxCredential (Get-Credential)

# Check database health
Get-MailboxStatistics -Database "Mailbox Database" | Sort-Object TotalItemSize -Descending | Select-Object -First 10

# Monitor RPC latency
Get-RpcClientAccess | Format-Table Server,TotalRequests,AverageLatency

# Check store worker processes
Get-Process -Name "Microsoft.Exchange.Store.Worker" | Format-Table ProcessName,WorkingSet,CPU

# Weekly maintenance script
# Check database health
Get-MailboxDatabaseCopyStatus | Where-Object {$_.Status -ne "Healthy"}

# Update Exchange cumulative updates
# Download CU from Microsoft
# Run: .\Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

# Monthly cleanup tasks
# Clean up IIS logs older than 30 days
Get-ChildItem "C:\inetpub\logs\LogFiles" -Recurse | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)} | Remove-Item -Force

# Clean up Exchange logs
Get-ChildItem "C:\Program Files\Microsoft\Exchange Server\V15\Logging" -Recurse -File | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)} | Remove-Item -Force

# Check current Exchange version
Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

# Download and install Cumulative Updates
# 1. Stop Exchange services (except AD Topology)
# 2. Run CU installer: .\Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms
# 3. Restart server
# 4. Verify functionality

# Post-update verification
Test-SystemHealth
Get-ServerComponentState -Identity "YourExchangeServer"

# Migrate to new Exchange server
# 1. Install new Exchange server in same organization
# 2. Move mailboxes using migration batches

New-MigrationBatch -Name "UserMigration1" -SourceEndpoint $SourceEndpoint -TargetDeliveryDomain "yourdomain.com" -CSVData ([System.IO.File]::ReadAllBytes("C:\Migration\users.csv"))

Start-MigrationBatch -Identity "UserMigration1"

# Monitor migration progress
Get-MigrationBatch | Format-List Identity,Status,TotalCount,CompletedCount

# Create new mailbox
New-Mailbox -Name "John Doe" -UserPrincipalName "john.doe@yourdomain.com" -Password (ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force)

# Set mailbox quotas
Set-Mailbox -Identity "john.doe@yourdomain.com" -IssueWarningQuota 1.9GB -ProhibitSendQuota 2GB -ProhibitSendReceiveQuota 2.3GB

# Grant full access permissions
Add-MailboxPermission -Identity "shared@yourdomain.com" -User "john.doe@yourdomain.com" -AccessRights FullAccess

# Configure distribution groups
New-DistributionGroup -Name "IT Department" -Alias "IT" -Members "john.doe@yourdomain.com","jane.smith@yourdomain.com"

# Exchange Web Services (EWS) example
Add-Type -Path "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"

$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2013_SP1)
$service.Credentials = New-Object System.Net.NetworkCredential("username","password","domain")
$service.AutodiscoverUrl("user@yourdomain.com", {$true})

# Get inbox folder
$folderid = New-Object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox)
$inbox = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service, $folderid)

# Query Exchange recipients via LDAP
$searcher = New-Object DirectoryServices.DirectorySearcher
$searcher.SearchRoot = "LDAP://CN=Users,DC=yourdomain,DC=com"
$searcher.Filter = "(&(objectCategory=person)(mail=*))"
$searcher.PropertiesToLoad.Add("mail")
$searcher.PropertiesToLoad.Add("displayName")

$results = $searcher.FindAll()
foreach ($result in $results) {
    Write-Host "$($result.Properties.displayname) - $($result.Properties.mail)"
}

# Create Database Availability Group
New-DatabaseAvailabilityGroup -Name "DAG01" -WitnessServer "FileServer01" -WitnessDirectory "C:\DAG\DAG01"

# Add servers to DAG
Add-DatabaseAvailabilityGroupServer -Identity "DAG01" -MailboxServer "EX01"
Add-DatabaseAvailabilityGroupServer -Identity "DAG01" -MailboxServer "EX02"

# Add database copy
Add-MailboxDatabaseCopy -Identity "Mailbox Database" -MailboxServer "EX02" -ActivationPreference 2

# Configure network settings
Set-DatabaseAvailabilityGroup -Identity "DAG01" -DatabaseAvailabilityGroupIpAddresses "192.168.1.100"

# Configure Client Access load balancing
Set-ClientAccessService -Identity "EX01" -OutlookAnywhereInternalHostname "mail.yourdomain.com"
Set-ClientAccessService -Identity "EX02" -OutlookAnywhereInternalHostname "mail.yourdomain.com"

# Set up namespace load balancing
Set-OwaVirtualDirectory -Identity "EX01\owa (Default Web Site)" -InternalUrl "https://mail.yourdomain.com/owa"
Set-OwaVirtualDirectory -Identity "EX02\owa (Default Web Site)" -InternalUrl "https://mail.yourdomain.com/owa"