Exchange HA Infrastructure Audit
Finding the hidden failures in an "everything's fine" Exchange environment
The Problem
Inherited an Exchange 2019 environment with minimal documentation. Services running, mail flowing, databases mounted—everything looked healthy. Surface metrics don't tell the whole story.
- Four-node DAG with 8 databases serving 800+ users
- No recent infrastructure validation or health checks
- Previous maintenance activities with unclear rollback status
- Zero documentation of expected failover behavior
- No disaster recovery testing on record
Mail was flowing. But would it survive a server failure?
Environment Overview
Exchange 2019
CU14 (Build 15.02.1544.009) on four-node Database Availability Group
8 Databases
~5TB total mailbox data with 2 copies each (primary + passive)
Dual Networks
Dedicated MAPI and Replication network segments for traffic isolation
File Share Witness
Quorum configuration for automatic failover decisions
How DAG Replication Works
Critical Findings
Finding 1: Auto-Activation Blocked
Server: Passive Node #1
Issue: DatabaseCopyAutoActivationPolicy set to 'Blocked'
Impact: If primary server fails, its 4 databases won't fail over. Extended outage requiring manual intervention.
Root Cause: Set during maintenance, never reverted
Finding 2: HighAvailability Offline
Server: Passive Node #2
Issue: HighAvailability component state set to 'Inactive'
Impact: Server excluded from all failover operations. Databases cannot activate here.
Root Cause: Maintenance mode never fully restored
Finding 3: Autodiscover Not Configured
Servers: All four nodes
Issue: InternalUrl and ExternalUrl blank on all Autodiscover virtual directories
Impact: Outlook auto-configuration fails; new client setups require manual configuration
Finding 4: Certificate Expiration
Certificate: Third-party EV certificate
Issue: Expiring in less than 3 months
Impact: OWA, ActiveSync, and Outlook connectivity failures if not renewed
Validation Framework
Validation Script Features
DAG Member Status
Checks auto-activation policies and HA component states on all nodes
Database Replication
Validates copy status, content index health, and replay/copy queue lengths
Network Health
Verifies MAPI and Replication networks are operational with correct subnets
Witness Configuration
Confirms file share witness accessibility and quorum participation
Certificate Monitoring
Alerts on expiring certificates before they cause service outages
Auto-Remediation
Generates ready-to-run PowerShell commands for any issues found
Results
| Metric | Before Audit | After Remediation |
|---|---|---|
| Automatic Failover Capability | 0% (broken) | 100% (restored) |
| DAG Members Available for Failover | 2 of 4 | 4 of 4 |
| Expected Recovery Time (Server Failure) | Hours (manual) | < 30 seconds |
| Infrastructure Documentation | None | Complete |
| Time to Remediate | N/A | 5 minutes |
Technologies
Lessons Learned
Verify after maintenance
Both critical issues stemmed from incomplete maintenance mode restoration. "Put it back" needs validation.
Green lights lie
Services running and mail flowing masked fundamental HA failures. Surface metrics aren't the whole story.
Schedule validation
Quarterly DAG health checks should be standard practice. Configuration drift happens silently.
Document the expected state
As-built documentation enables future audits and makes "is this right?" answerable.