Exchange Server Subscription Edition (SE) is now the only supported version of on-premises Exchange, and it’s among the most targeted systems in the enterprise. Exchange Server SE hardening should be the first project after migration, not an afterthought.
Microsoft Exchange Server Remains a Prime Target
In May 2026, attackers began actively exploiting CVE-2026-42897, a critical zero-day spoofing and cross-site scripting (XSS) vulnerability in on-premises Exchange Server. The attack is simple: a specially crafted email lands in the target’s mailbox, and when the user opens it in Outlook on the web (OWA), malicious JavaScript runs in their browser. Attackers can then hijack active sessions and steal sensitive data without needing credentials of their own.
Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) issued urgent warnings, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal agencies to apply emergency mitigations.
It’s the latest in a long line of Exchange attacks stretching back to ProxyLogon in 2021. Each time, the organizations that fared best were the ones that had already reduced their exposure and kept their servers current.
Also keep in mind that SE’s first release is essentially the same code as Exchange 2019 CU15. The upgrade changes your licensing and lifecycle, not your security posture. Hardening is still up to you.
To help, we’ve put together 10 essential steps for hardening Microsoft Exchange Server Subscription Edition (SE). They cover the security essentials every server should have in place. For foundational topics like user training, backups, and password policies, see our guide to Exchange Server security best practices.
Reading our article? Try our product:
1. Keep Exchange Server SE on the Latest Updates
Foremost, keep your Exchange SE servers up-to-date. With SE, this is not just good practice, it’s a condition of support.
Exchange SE follows Microsoft’s Modern Lifecycle Policy, so security updates are released only for recent Cumulative Updates (CUs). If you fall behind, you lose support and protection at the same time.
- Apply Security Updates (SUs) as soon as practical after release
- Plan and test each new CU rather than skipping ahead later
- Run the Exchange Health Checker script regularly to catch missing updates and configuration issues
- Keep the Exchange Emergency Mitigation (EM) service enabled so Microsoft can push temporary protections during zero-day events
2. Decommission Legacy Exchange Servers
Old servers are easy to forget and easy to exploit. Once your SE migration is complete, properly decommission any remaining Exchange 2016 or 2019 servers. Don’t leave them running “just in case.” An unsupported server that no longer receives security updates is exactly what attackers look for.
3. Reduce Your Internet-Facing Attack Surface
Every service you publish to the internet is a door someone will try. Publish only what your users need, typically Outlook on the web (OWA), ActiveSync, Autodiscover, and the endpoints Outlook clients rely on.
- Block external access to the Exchange Admin Center (EAC)
- Disable protocols no one uses, such as POP3 and IMAP4
- Place a reverse proxy or web application firewall in front of Exchange
- Block connections from countries where you have no offices or employees
That last point is often overlooked. If your organization operates only in North America, there’s little reason to accept logon attempts from the other side of the world.
4. Enable Modern Authentication and Multi-Factor Authentication
Easy logons are easy access. Basic authentication handles credentials in a way that’s easy to attack, and it can’t be protected by multi-factor authentication (MFA). Modern authentication, available for on-premises Exchange through AD FS or hybrid modern authentication, supports MFA and conditional access.
- Enable modern authentication and confirm your clients support it
- Retire Basic authentication protocol by protocol
- Watch for older mobile devices and third-party apps, which are usually the last holdouts
One important caveat: MFA doesn’t cover everything. Many popular MFA solutions protect Outlook on the web but not Exchange Web Services (EWS), ActiveSync, or Autodiscover. Attackers know this and target those protocols because they’re less protected. MFA is essential, but it isn’t the whole answer.
5. Stop Password Attacks and Active Directory Account Lockouts
Exchange and Active Directory are tightly linked, and attackers take advantage of it. Every failed logon against Exchange counts against that user’s AD account. A brute-force or password spray attack against Exchange can therefore trigger mass account lockouts. Users can’t log on, the help desk is flooded with reset requests, and IT loses hours tracking down the source.
Tuning your AD lockout policy helps, but it’s a balancing act. Set thresholds too low and attackers can lock out your users at will. Set them too high and password guessers get more attempts. The most dangerous attacks don’t trip lockouts at all. Low-volume, targeted attacks deliberately stay below your lockout threshold, guessing slowly and patiently until they land on a valid password for a high-value account.
For more on this, see our articles on: AD account lockouts and finding the source of AD account lockouts.
The better approach is to stop password attacks at Exchange, before they reach Active Directory. That’s what Messageware Exchange Protocol Guard (EPG) was built to do. EPG analyzes logon activity in real time across nine of the most widely used Exchange protocols. It catches both high-volume brute-force attacks and low-volume password guessing, then isolates the attack source. EPG maintains its own lockout system independent of AD, so legitimate users stay logged on and the help desk isn’t buried in password resets. It also closes the MFA gap on EWS, ActiveSync, and Autodiscover described above.
6. Tighten Administrative Permissions with RBAC
Exchange’s Role-Based Access Control (RBAC) lets you give administrators exactly the permissions they need and nothing more.
- Review membership of high-privilege groups like Organization Management regularly
- Give admins separate, dedicated accounts for administrative work
- Never use admin accounts for email or web browsing
- Remove access promptly when roles change or staff leave
Remote administrative access deserves extra care. See our guide to Exchange Server security best practices for more on limiting admin access to internal users.
7. Enforce Strong Encryption
All connections to and between Exchange servers should use TLS 1.2 or later. Disable older protocols such as SSL 3.0, TLS 1.0, and TLS 1.1. Use certificates from a trusted certificate authority and track expiration dates so nothing lapses unexpectedly.
Also confirm that Extended Protection is enabled. It helps defend against credential relay and man-in-the-middle attacks. It’s on by default in current Exchange versions, but it’s worth verifying in environments carried forward from older deployments.
8. Harden the Underlying Windows Server
Exchange is only as secure as the operating system it runs on. Deploy SE on a current, supported version of Windows Server and keep it patched.
- Apply Microsoft’s recommended security baselines (available in the Security Compliance Toolkit)
- Run endpoint protection that supports Exchange’s Antimalware Scan Interface (AMSI) integration
- Configure Microsoft’s recommended antivirus exclusions for Exchange, no more and no less
- Remove unnecessary software and roles; Exchange servers should do one job
9. Monitor Logons and Audit Exchange Activity
Hardening reduces risk, but it doesn’t eliminate it. Visibility is what lets you catch what gets through.
Enable administrator audit logging and mailbox audit logging, and forward Exchange, IIS, and Windows security logs to your SIEM. Then watch for the warning signs:
- Spikes in failed logon attempts
- Logons from unusual locations or unfamiliar devices
- Unexpected mailbox permission changes
- New inbox rules that forward mail externally
Delays in detection are costly. Automated alerts, such as the password failure alerts and blocked-connection digests in EPG, put this information in front of your security team before small problems become incidents.
10. Build an Exchange-Specific Incident Response Plan
When an Exchange zero-day hits, there’s no time to figure out the plan as you go. Document how you’ll isolate a compromised server, where your tested backups are, who has authority to take Exchange offline, and how you’ll communicate with users while email is down.
See: Microsoft’s What is incident response?
Test the plan with tabletop exercises, and consider periodic penetration testing to find weaknesses before attackers do.
Frequently Asked Questions
Is Exchange Server SE more secure than Exchange 2019?
Not inherently. SE’s first release is essentially the same code as Exchange 2019 CU15. SE’s security advantage is that it continues to receive security updates, as long as you stay current.
How often should Exchange Server SE be updated?
Apply Security Updates promptly after release and plan for each new Cumulative Update. Under the Modern Lifecycle Policy, falling behind means losing access to security fixes.
How do I prevent AD account lockouts caused by attacks on Exchange?
Tuning lockout thresholds helps but involves trade-offs, and low-volume attacks are designed to stay under them. The most reliable approach is to stop password attacks at the Exchange server before they reach Active Directory.
Fortify Your Server with Messageware Security
Data breaches have increased by 72%, servers are compromised in under 90 minutes. Ensure you have multiple layers of security software protecting your Windows Servers.
Server Threat Guard (STG) for All Windows Servers: Next-gen server protection, providing detection, alerting, and response (MDR) to zero-day and server penetration cyber-attacks. No need to research complicated deployments and no learning curve to install and manage.
EPG Guard for Exchange Servers: Real-time security. Stop AD account lockouts, eliminate password attacks, intelligent GEO blocking, and prevent Exchange Server vulnerability probing.
Don’t leave your critical infrastructure vulnerable, be proactive and stay ahead of evolving threats.