Merge branch 'main' into fix-onpremauth-changes-clean

Author: MarcoLFrancisco

.build/cspell-words.txt

@@ -41,6 +41,8 @@ Eventlog
 evtx
 Exchweb
 exfiltration
+exopf
+exov
 fabrikam
 FIPFS
 fips
@@ -81,6 +83,7 @@ ldifde
 Liant
 Linq
 LOCALAPPDATA
+lockdown
 logman
 lsass
 Lync
@@ -89,6 +92,9 @@ Mbps
 mbxs
 Mddhhmm
 Mddhhmmss
+mepf
+mepfdns
+mepfs
 meso
 mesos
 mfcmapi
@@ -151,6 +157,7 @@ Sids
 Snapin
 SPDLT
 STMP
+subfolders
 syncall
 tcpip
 TDSDSA
@@ -159,6 +166,7 @@ UCMA
 unconfigured
 unrequired
 USERDNSDOMAIN
+validatemepf
 Vianet
 Visio
 vmxnet

.github/CODEOWNERS

@@ -15,8 +15,8 @@
 
 # EXO PF Team
 /PublicFolders/Migration/                               @vishmittal @microsoft/css-exchange-admins
-/PublicFolders/Hybrid/                                  @vishmittal @microsoft/css-exchange-admins
+/PublicFolders/MailPublicFolderSync/                    @vishmittal @microsoft/css-exchange-admins
 /PublicFolders/Update-PublicFolderPermissions.ps1       @vishmittal @microsoft/css-exchange-admins
 /docs/PublicFolders/Migration/                          @vishmittal @microsoft/css-exchange-admins
-/docs/PublicFolders/Hybrid/                             @vishmittal @microsoft/css-exchange-admins
+/docs/PublicFolders/MailPublicFolderSync/               @vishmittal @microsoft/css-exchange-admins
 /docs/PublicFolders/Update-PublicFolderPermissions.md   @vishmittal @microsoft/css-exchange-admins

Diagnostics/HealthChecker/Analyzer/Get-URLRewriteRule.ps1

@@ -37,7 +37,21 @@ function Get-URLRewriteRule {
         $appHostConfigLocations = $ApplicationHostConfig.configuration.Location.path
     }
     process {
-        foreach ($key in $WebConfigContent.Keys) {
+        # Build combined location list: WebConfigContent keys + appHost-only locations.
+        # Some IIS locations (e.g., EAS/Proxy) exist only in applicationHost.config and have
+        # no web.config entry from Get-WebApplication. We still need to walk up inheritance for them.
+        $allLocations = [System.Collections.Generic.List[string]]::new()
+        foreach ($wcKey in $WebConfigContent.Keys) {
+            $allLocations.Add($wcKey)
+        }
+        foreach ($appHostPath in $appHostConfigLocations) {
+            if (-not [string]::IsNullOrEmpty($appHostPath) -and
+                -not $WebConfigContent.ContainsKey($appHostPath)) {
+                $allLocations.Add($appHostPath)
+            }
+        }
+
+        foreach ($key in $allLocations) {
             Write-Verbose "Working on key: $key"
             $continue = $true
             $clearInbound = $false

Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerExchangeInformation.ps1

@@ -335,7 +335,13 @@ function Invoke-AnalyzerExchangeInformation {
                     }
                 }
             } else {
-                $displayMissingGroups.Add("Unable to determine Local System Membership as the results were blank.")
+                if ($null -ne $exchangeInformation.ADComputerObject.LocalGroupMemberException -and
+                    $exchangeInformation.ADComputerObject.LocalGroupMemberException.Exception -is [System.InvalidOperationException] -and
+                    $HealthServerObject.OSInformation.BuildInformation.BuildVersion -lt [System.Version]"10.0.26100") {
+                    $displayMissingGroups.Add("Unable to determine Local System Membership. This can occur when orphaned SIDs exist in the local Administrators group.")
+                } else {
+                    $displayMissingGroups.Add("Unable to determine Local System Membership as the results were blank.")
+                }
             }
 
             if ($null -ne $exchangeInformation.ADComputerObject.ADGroupMembership -and

Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerIISInformation.ps1

@@ -612,6 +612,14 @@ function Invoke-AnalyzerIISInformation {
         $currentSection = $urlRewriteRules[$key]
 
         if ($currentSection.Count -ne 0) {
+            # Collect <remove> entries so inherited rules that are removed at a lower level are excluded.
+            $excludeRules = @()
+            foreach ($section in $currentSection) {
+                if ($null -ne $section.Remove) {
+                    $excludeRules += $section.Remove.Name
+                }
+            }
+
             foreach ($rule in $currentSection.rule) {
 
                 if ($null -eq $rule) {
@@ -621,12 +629,24 @@ function Invoke-AnalyzerIISInformation {
                     # skip over disabled rules.
                     Write-Verbose "skipping over disabled rule: $($rule.Name) for vDir '$key'"
                     continue
+                } elseif ($rule.Name -in $excludeRules) {
+                    Write-Verbose "skipping removed rule: $($rule.Name) for vDir '$key'"
+                    continue
                 }
 
                 #multiple match type possibilities, but should only be one per rule.
-                $propertyType = ($rule.match | Get-Member | Where-Object { $_.MemberType -eq "Property" }).Name
-                $isUrlMatchProblem = $propertyType -eq "url" -and $rule.match.$propertyType -eq "*"
-                $matchProperty = "$propertyType - $($rule.match.$propertyType)"
+                $allProperties = @(($rule.match | Get-Member | Where-Object { $_.MemberType -eq "Property" }).Name)
+                # When <match> has extra attributes (negate, ignoreCase), Get-Member returns multiple properties.
+                # Filter to the actual match target property for display and the URL Match Problem check.
+                $propertyType = ($allProperties | Where-Object { $_ -eq "url" -or $_ -eq "serverVariable" } | Select-Object -First 1)
+
+                if ($null -eq $propertyType) {
+                    $propertyType = $allProperties | Select-Object -First 1
+                }
+
+                $matchValue = $rule.match.$propertyType
+                $isUrlMatchProblem = $propertyType -eq "url" -and $matchValue -eq "*"
+                $matchProperty = "$propertyType - $matchValue"
 
                 $displayObject = [PSCustomObject]@{
                     RewriteRuleName = $rule.name
@@ -682,6 +702,13 @@ function Invoke-AnalyzerIISInformation {
         $currentSection = $urlOutboundRewriteRules[$key]
 
         if ($currentSection.Count -ne 0) {
+            $excludeOutboundRules = @()
+            foreach ($section in $currentSection) {
+                if ($null -ne $section.Remove) {
+                    $excludeOutboundRules += $section.Remove.Name
+                }
+            }
+
             foreach ($rule in $currentSection.rule) {
 
                 if ($null -eq $rule) {
@@ -690,6 +717,9 @@ function Invoke-AnalyzerIISInformation {
                 } elseif ($rule.enabled -eq "false") {
                     Write-Verbose "skipping over disabled outbound rule: $($rule.Name) for vDir '$key'"
                     continue
+                } elseif ($rule.Name -in $excludeOutboundRules) {
+                    Write-Verbose "skipping removed outbound rule: $($rule.Name) for vDir '$key'"
+                    continue
                 }
 
                 $displayObject = [PSCustomObject]@{

Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1

@@ -400,15 +400,15 @@ function Invoke-AnalyzerOsInformation {
             $displayWriteType2012 = "Green"
             $displayValue2012 = "$($installed2012.DisplayVersion) Version is current"
         } elseif (Test-VisualCRedistributableInstalled -Year 2012 -Installed $osInformation.VcRedistributable) {
-            $displayValue2012 = "Redistributable ($($installed2012.DisplayVersion)) is outdated"
+            $displayValue2012 = "Redistributable is outdated ($($installed2012.DisplayVersion)). Update the Visual C++ 2012 version."
             $displayWriteType2012 = "Yellow"
         }
 
         if (Test-VisualCRedistributableUpToDate -Year 2013 -Installed $osInformation.VcRedistributable) {
             $displayWriteType2013 = "Green"
             $displayValue2013 = "$($installed2013.DisplayVersion) Version is current"
         } elseif (Test-VisualCRedistributableInstalled -Year 2013 -Installed $osInformation.VcRedistributable) {
-            $displayValue2013 = "Redistributable ($($installed2013.DisplayVersion)) is outdated"
+            $displayValue2013 = "Redistributable is outdated ($($installed2013.DisplayVersion)). Update the Visual C++ 2013 version."
             $displayWriteType2013 = "Yellow"
         }
     }
@@ -435,7 +435,7 @@ function Invoke-AnalyzerOsInformation {
         $displayWriteType2012 -eq "Yellow") {
 
         $params = $baseParams + @{
-            Details                = "Note: For more information about the latest C++ Redistributable please visit: https://aka.ms/HC-LatestVC`r`n`t`tThis is not a requirement to upgrade, only a notification to bring to your attention."
+            Details                = "Note: Exchange requires the Visual C++ 2012 and 2013 Redistributable specifically. These are not replaced by newer versions.`r`n`t`tFor more information please visit: https://aka.ms/HC-LatestVC"
             DisplayWriteType       = "Yellow"
             DisplayCustomTabNumber = 2
         }

Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCveCheck.ps1

@@ -144,6 +144,7 @@ function Invoke-AnalyzerSecurityCveCheck {
         "Oct25SU" = (NewCveEntry @("CVE-2025-59249") @($ex2016, $ex2019, $exSE))
         "Dec25SU" = (NewCveEntry @("CVE-2025-64666", "CVE-2025-64667") @($ex2016, $ex2019, $exSE))
         "Feb26SU" = (NewCveEntry @("CVE-2026-21527") @($ex2016, $ex2019, $exSE))
+        "Jun26SU" = (NewCveEntry @("CVE-2026-42897", "CVE-2026-45500", "CVE-2026-45501", "CVE-2026-45502", "CVE-2026-45503", "CVE-2026-45504", "CVE-2026-47631") @($ex2016, $ex2019, $exSE))
     }
 
     # Need to organize the list so oldest CVEs come out first.

Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityMitigationService.ps1

@@ -129,7 +129,7 @@ function Invoke-AnalyzerSecurityMitigationService {
                 }
 
                 $params = $baseParams + @{
-                    Details                = "Run: 'Get-Mitigations.ps1' from: '$ExScripts' to learn more."
+                    Details                = "Run: 'Get-Mitigations.ps1' from: '$([System.IO.Path]::Combine($exchangeInformation.RegistryValues.MsiInstallPath, "Scripts"))' to learn more."
                     DisplayCustomTabNumber = 2
                 }
                 Add-AnalyzedResultInformation @params

Diagnostics/HealthChecker/Analyzer/Tests/Get-URLRewriteRule.Tests.ps1

@@ -96,6 +96,32 @@ Describe "Get-URLRewriteRule" {
         }
     }
 
+    Context "AppHost-only locations (no web.config entry)" {
+
+        It "Should process Proxy location that only exists in appHost" {
+            # EAS/Proxy exists in applicationHost.config but is not returned by Get-WebApplication
+            # so it has no entry in $webConfigContent. The fix adds it from appHost locations.
+            $Script:result.Inbound.ContainsKey("Default Web Site/Microsoft-Server-ActiveSync/Proxy") | Should -Be $true
+            $Script:result.Outbound.ContainsKey("Default Web Site/Microsoft-Server-ActiveSync/Proxy") | Should -Be $true
+        }
+
+        It "Should inherit parent rules for appHost-only Proxy location" {
+            # Proxy has no rules at its own appHost level. Walk-up should reach DWS web.config
+            # (CVE-2022-41040) and DWS appHost (disabled HTTPS redirect, AppHost Only Rule) and global.
+            $proxyRules = $Script:result.Inbound["Default Web Site/Microsoft-Server-ActiveSync/Proxy"]
+            $proxyRuleNames = @($proxyRules.rule.name | Where-Object { $null -ne $_ })
+            $proxyRuleNames | Should -Contain "CVE-2022-41040 Mitigation"
+            $proxyRuleNames | Should -Contain "Global Block Bad User Agents"
+        }
+
+        It "Should not duplicate keys that exist in both WebConfigContent and appHost" {
+            # "Default Web Site" exists in both $webConfigContent and appHost locations.
+            # It should appear exactly once in the result, not duplicated.
+            $dwsCount = @($Script:result.Inbound.Keys | Where-Object { $_ -eq "Default Web Site" }).Count
+            $dwsCount | Should -Be 1
+        }
+    }
+
     Context "Clear stops inheritance" {
 
         It "Should stop at clear in appHost location for Default Web Site/mapi" {

Diagnostics/HealthChecker/DataCollection/ExchangeInformation/Invoke-JobExchangeInformationLocal.ps1

@@ -124,6 +124,7 @@ function Invoke-JobExchangeInformationLocal {
                 $localGroupMember = Get-LocalGroupMember -SID "S-1-5-32-544" -ErrorAction Stop
             } catch {
                 Write-Verbose "Failed to run Get-LocalGroupMember. Inner Exception: $_"
+                $localGroupMemberException = $_
                 Invoke-CatchActions
             }
         }
@@ -210,6 +211,7 @@ function Invoke-JobExchangeInformationLocal {
             IanaTimeZoneMappingsRaw                  = $ianaTimeZoneMappingContent
             FileContentInformation                   = $fileContentInformation
             LocalGroupMember                         = $localGroupMember
+            LocalGroupMemberException                = $localGroupMemberException
             RemoteJob                                = $true -eq $PSSenderInfo
             JobHandledErrors                         = $jobHandledErrors
             AllErrors                                = $Error