Infrastructure 2025

Exchange HA Infrastructure Audit

Finding the hidden failures in an "everything's fine" Exchange environment

0→100% Failover Restored
800+ Users Protected
5min Remediation

The Problem

Inherited an Exchange 2019 environment with minimal documentation. Services running, mail flowing, databases mounted—everything looked healthy. Surface metrics don't tell the whole story.

  • Four-node DAG with 8 databases serving 800+ users
  • No recent infrastructure validation or health checks
  • Previous maintenance activities with unclear rollback status
  • Zero documentation of expected failover behavior
  • No disaster recovery testing on record

Mail was flowing. But would it survive a server failure?

Environment Overview

Exchange 2019

CU14 (Build 15.02.1544.009) on four-node Database Availability Group

8 Databases

~5TB total mailbox data with 2 copies each (primary + passive)

Dual Networks

Dedicated MAPI and Replication network segments for traffic isolation

File Share Witness

Quorum configuration for automatic failover decisions

How DAG Replication Works

Diagram: Exchange DAG showing database copies, replication flow, and failover relationships across four servers DATABASE AVAILABILITY GROUP Each database has 2 copies: 1 Active (mounted) + 1 Passive (replica) EX-01 DB1 DB2 DB3 DB4 DB5 DB6 DB7 DB8 EX-02 DB1 DB2 DB3 DB4 DB5 DB6 DB7 DB8 EX-03 BLOCKED DB1 DB2 DB3 DB4 Can't activate! EX-04 INACTIVE DB5 DB6 DB7 DB8 Excluded from HA! Replicates but can't failover → MAPI Network — Client connections (Outlook, OWA) Replication Network — Database log shipping File Share Witness Provides quorum vote in split-brain scenarios (even node count) Active (Mounted) Passive (Replica) Replication Critical Issue Blocked

Critical Findings

Finding 1: Auto-Activation Blocked

Server: Passive Node #1

Issue: DatabaseCopyAutoActivationPolicy set to 'Blocked'

Impact: If primary server fails, its 4 databases won't fail over. Extended outage requiring manual intervention.

Root Cause: Set during maintenance, never reverted

Finding 2: HighAvailability Offline

Server: Passive Node #2

Issue: HighAvailability component state set to 'Inactive'

Impact: Server excluded from all failover operations. Databases cannot activate here.

Root Cause: Maintenance mode never fully restored

Finding 3: Autodiscover Not Configured

Servers: All four nodes

Issue: InternalUrl and ExternalUrl blank on all Autodiscover virtual directories

Impact: Outlook auto-configuration fails; new client setups require manual configuration

Finding 4: Certificate Expiration

Certificate: Third-party EV certificate

Issue: Expiring in less than 3 months

Impact: OWA, ActiveSync, and Outlook connectivity failures if not renewed

Validation Framework

Diagram: DAG validation workflow from initial checks through remediation Member Status Component States Database Copies Network Health Issues Found? Generate Remediation DAG Healthy ✓ Yes No

Validation Script Features

DAG Member Status

Checks auto-activation policies and HA component states on all nodes

Database Replication

Validates copy status, content index health, and replay/copy queue lengths

Network Health

Verifies MAPI and Replication networks are operational with correct subnets

Witness Configuration

Confirms file share witness accessibility and quorum participation

Certificate Monitoring

Alerts on expiring certificates before they cause service outages

Auto-Remediation

Generates ready-to-run PowerShell commands for any issues found

Results

Metric Before Audit After Remediation
Automatic Failover Capability 0% (broken) 100% (restored)
DAG Members Available for Failover 2 of 4 4 of 4
Expected Recovery Time (Server Failure) Hours (manual) < 30 seconds
Infrastructure Documentation None Complete
Time to Remediate N/A 5 minutes

Technologies

Exchange 2019 PowerShell DAG Windows Failover Clustering SSL/TLS Certificate Management Email Security Gateway Technical Documentation

Lessons Learned

Verify after maintenance

Both critical issues stemmed from incomplete maintenance mode restoration. "Put it back" needs validation.

Green lights lie

Services running and mail flowing masked fundamental HA failures. Surface metrics aren't the whole story.

Schedule validation

Quarterly DAG health checks should be standard practice. Configuration drift happens silently.

Document the expected state

As-built documentation enables future audits and makes "is this right?" answerable.