The Exchange Health Checker is an excellent tool to get a quick overview of the status of the Exchange Server. The PowerShell script provided by Microsoft is continuously updated and can generate a report in HTML format. For a fresh Exchange 2019 installation on a Windows Server 2022, the report looks like this, for example:
As can be seen from the report, there are various security vulnerabilities and other warnings about possible optimizations in a fresh Exchange installation. Conveniently, the Exchange Health Checker also provides suitable articles on how to eliminate the problems.
Based on these articles, I have created a small script that automatically makes the most important settings. For example, the script can fix the following problems:
- Set swap file to 32GB
- Deactivate the power-saving functions of the network card
- Set energy saving plan to "High Performance
- Set TCP KeepAlive to 30 min
- Activate TLS 1.2 for SCHANNEL
- Configure TLS 1.2 for .NET Framework
- Deactivate TLS 1.0, TLS 1.1 for SCHANNEL and .NET Framework
- Deactivate TLS 1.3 (currently not supported by Exchange 2019)
- Change download domains to autodiscover hostname
- Deactivate SSL Offloading for Outlook Anywhere
- Download and run Windows Extended Protection Script
The script asks at each step whether the settings should be applied, this then looks as follows, for example:
The script is not dependent on the Health Checker results, but I have simply implemented the recommendations provided by the Health Checker on a newly installed Exchange Server on Windows Server 2022 in this script. The script is on GitHub and I will integrate new recommendations from the Health Checker into the script.
After running the script "Apply-ExchangeHealthChecker-Recommendations.ps1" the Health Checker report looks much better. Here is an example:
As already mentioned, I initially only tested the script on Windows Server 2022 and Exchange 2019. It would therefore be nice if you could send me screenshots or the errors from your reports so that I can extend the script "Apply-ExchangeHealthChecker-Recommendations.ps1". Other errors and warnings will certainly be displayed on Windows Server 2019, so please send them to me or contribute directly via GitHub.
Here is the link to the script: