KB5049233: Security update for Exchange Server 2016 CU14, November 2024. Transport and DLP rules work again after the earlier update

Exchange Transport Rules and Data Loss Prevention rules work again after the earlier November update. The rerelease also addresses a publicly disclosed Exchange Server vulnerability.

Does it affect you? Applies to: Organizations enrolled in the Extended Security Update program that run Exchange Server 2019 CU14 or CU13, or Exchange Server 2016 CU23.

For servers running Cumulative Update 14: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fixes 10 changes

Exchange Transport Rules and Data Loss Prevention rules

Exchange Transport Rules and Data Loss Prevention rules work again after they stopped working with the first November security update.¹
The rerelease addresses the issue in which Exchange Server stops processing ETR and DLP rules.

Journal report decryption

For: Exchange Server administrators using journal report decryption

Journal report decryption can decrypt attachments in the journal mailbox again.²

AES256-CBC-encrypted content

An error related to AES256-CBC-encrypted content is fixed.³
The issue followed the addition of support for AES256-CBC-encrypted content in the August 2023 security update.

IRM messages

For: Exchange Server administrators using IRM

Exchange can decrypt IRM messages again.⁴

PowerShell ISE

For: Exchange Server administrators using PowerShell ISE

A server using PowerShell ISE can serialize when connecting to EMS again.⁵
The listed issue concerns serialization when connecting to Exchange Management Shell (EMS).

Pickup folder

For: Exchange Server administrators using the Pickup folder

Messages sent through the Pickup folder no longer display the administrator version.⁶

Certificate signing requests

Exchange-created certificate signing requests no longer use the outdated encryption algorithm described in the issue.⁷

Outlook on the web

For: Exchange Server users in Amman

Outlook on the web no longer displays the incorrect time zone for Amman.⁸

Time zones

For: Exchange Server administrators and users in Kazakhstan

Exchange supports Kazakhstan’s change to a single time zone in 2024.⁹

Moderated messages

For: Exchange Server users and administrators using message moderation

Moderated messages are no longer marked as expired after they are approved or rejected.¹⁰

New features 3 changes

MSIPC

MSIPC is enabled by default in Exchange Server 2019 and 2016.¹¹
MSIPC means Microsoft Information Protection Client.

AMSI

AMSI integration adds support for scanning message bodies.¹²

P2 FROM header detection

Exchange can detect P2 FROM headers that do not follow the RFC standard.¹³

Improvement 1 change

ECC certificates

For: Exchange Server administrators using ECC certificates

Exchange adds improvements to support for ECC certificates.¹⁴
ECC means elliptic curve cryptography.

Known issues

Open Affects: Organizations and IT administrators

A time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2)

After either version of the November 2024 security update, calendar files might not preview or add to calendars. The issue can also affect processing of messages with calendar attachments.¹⁵

How to apply the workaround Workaround

The mapping file has a duplicate entry for Asia/Bishkek. Removing one copy works around the resulting time zone exception.¹⁵
Step-by-step instructions, command & download kit
4 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Back up IanaTimeZoneMappings.xml in the Exchange V15\Bin folder.
2. Open the file and find the two copies of <Map IANA="Asia/Bishkek" Win="Central Asia Standard Time" />.
3. Delete one copy and save the file.
4. In an elevated PowerShell window, restart the web and transport services.
powershell.exe · Administrator

> Restart-Service -Name W3SVC, WAS -Force> Restart-Service -Name MSExchangeTransport
Open Affects: Organizations and IT administrators

The Edge Transport service stops responding after installing November 2024 SU

The Edge Transport service might stop responding and restart after this security update when it decrypts certain externally protected messages. The issue is resolved by the May 29, 2025 hotfix for the applicable Exchange version.¹⁶

How to apply the workaround Exchange Management Shell

MSIPC is enabled by default in the November 2024 security update. Disabling it works around the service failure described in the issue.¹⁶
Step-by-step instructions, command & download kit
2 steps Exchange Management Shell Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. In an elevated Exchange Management Shell window, run the commands in order.
2. After installing the applicable May 29, 2025 hotfix, remove the setting override and refresh configuration as shown in the undo commands.
Exchange Management Shell

> New-SettingOverride –Name "DisableMSIPC" -Component Encryption –Section UseMSIPC –Parameters @("Enabled=false") -Reason "Disabling MSIPC stack"> Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh> Restart-Service MSExchangeTransport
Open Affects: Organizations and IT administrators

A file version error occurs when you try to install Exchange Server November 2024 SU

Installing the November 2024 security update might fail with a file version error. If the first workaround does not help, the article provides a second method.¹⁷

How to apply the workaround Workaround

Restart the server, check Exchange service startup types and .NET Framework 4.8, then retry the installation. If Exchange services are disabled, restore their startup configuration first.¹⁷
Step-by-step instructions, command & download kit
5 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Restart the Exchange server.
2. Check the Exchange services with the listed Get-Service command.
3. If their StartType is Disabled, run the setup commands to restore the services, then check their status again.
4. Check for the .NET Framework 4.8 update with Get-Hotfix. If it is missing, install it through Windows Update.
5. Retry the November 2024 security update installation. If this method does not help, follow Workaround 2 in the linked article.
powershell.exe · Administrator

> Get-Service -DisplayName "Microsoft exchange*" | ft DisplayName,Starttype ,Status> cd "C:\Program Files\Microsoft\Exchange Server\V15\Bin"> Add-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.Setup -ErrorAction SilentlyContinue> .\ServiceControl.ps1 AfterPatch> Get-Hotfix

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-11-27
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU14
Replaces: KB5044062
Replaced by: KB5050673

Version	Build	Channel
2016	15.1.2507.44	General availability
2019	15.2.1258.39	General availability
2019	15.2.1544.14	General availability

Security

1 vulnerability fixed

1 important

Vulnerability	Severity	CVSS
CVE-2024-49040 Microsoft Exchange Server Spoofing Vulnerability	Important	7.5

Sources

Updated Nov 8, 2026

Cited passages from Microsoft's official notes (17)

1. Exchange Transport Rules and Data Loss Prevention rules don't work after installing November 2024 SU V1 support.microsoft.com
2. Journal report decryption doesn't decrypt attachments in the journal mailbox support.microsoft.com
3. An error occurs after adding support for AES256-CBC–encrypted content in August 2023 SU support.microsoft.com
4. Exchange can't decrypt IRM messages support.microsoft.com
5. Server with PowerShell\_ISE doesn't serialize when connecting to EMS support.microsoft.com
6. Email messages that are sent through the Pickup folder display the administrator version support.microsoft.com
7. CSRs that are created by Exchange Server are signed by using outdated Encryption algorithm support.microsoft.com
8. OWA displays an incorrect time zone for Amman support.microsoft.com
9. Kazakhstan changes to a single time zone in 2024 support.microsoft.com
10. Moderated messages are marked as expired after they're approved or rejected support.microsoft.com
11. MSIPC enablement by default in Exchange Server 2019 and 2016 support.microsoft.com
12. AMSI integration body scanning support support.microsoft.com
13. Non-RFC-compliant P2 FROM header detection support.microsoft.com
14. ECC certificate support improvements support.microsoft.com
15. This issue occurs because Exchange Server uses a duplicate entry in the IanaTimeZoneMappings.xml file. support.microsoft.com
16. The Edge Transport service (EdgeTransport.exe) stops responding and then restarts after the Microsoft Exchange Server November 2024 Security Update (SU) (Version 1 or Version 2) or Exchange Server 2019 CU15 is installed. support.microsoft.com
17. When you try to install the November 2024 Security Update (SU) for Microsoft Exchange Server 2019 or 2016, the installation fails and you receive the following error message. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 17 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake