Enable support for AES256-CBC-encrypted content in Exchange Server August 2023 SU

Enable support for AES256-CBC mode of encryption in Exchange Server 

The August 2023 SU for Exchange Server supports decryption of AES256-CBC mode-encrypted email messages and attachments. To enable this support, follow these steps: 

1. Install the August 2023 SU on all your Exchange 2019 and 2016 servers.

2. Run the following cmdlets on all Exchange 2019 and 2016 servers.

   Note: Complete step 2 on all Exchange 2019 and 2016 servers in your environment before you continue to step 3.

   $acl = Get-Acl -Path "HKLM:\SOFTWARE\Microsoft\MSIPC\Server" 

   $rule = New-Object System.Security.AccessControl.RegistryAccessRule((New-Object System.Security.Principal.SecurityIdentifier("S-1-5-20")), 983103, 3, 0, 0)

   $acl.SetAccessRule($rule) 

   Set-Acl -Path "HKLM:\SOFTWARE\Microsoft\MSIPC\Server" -AclObject $acl 

   Note: The -AclObject $acl key is added to the registry during the installation of the August SU. 

3. If you are using AzRMS, the AzRMS Connector must be updated on all Exchange servers. Run the updated GenConnectorConfig.ps1 script to generate the registry keys that are introduced for AES256-CBC mode support in the Exchange Server August 2023 SU and later Exchange versions. Download the latest GenConnectorConfig.ps1 script from the Microsoft Download Center.

   For more information about how to configure Exchange servers to use the connector, see Configuring servers for the Microsoft Rights Management connector. The article discusses specific configuration changes for Exchange Server 2019 and Exchange Server 2016. 
   
   For more information about how to configure servers for the Rights Management connector, including how to run it and how to deploy the settings, see Registry settings for the Rights Management Connector. 

4. If you have the August 2023 SU installed, there is support only to decrypt AES-256 CBC-encrypted email messages and attachments in Exchange Server. To enable this support, run the following setting override:
   
   New-SettingOverride –Name “EnableMSIPC” -Component Encryption –Section UseMSIPC –Parameters @(“Enabled=true”) -Reason “Enabling MSIPC stack”
   
   In addition to the changes that were made in the August 2023 SU, the October 2023 SU adds support to encrypt email messages and attachments in AES256-CBC mode. If you have the October 2023 SU installed, run the following setting overrides:
   
   New-SettingOverride –Name “EnableMSIPC” -Component Encryption –Section UseMSIPC –Parameters @(“Enabled=true”) -Reason “Enabling MSIPC stack” 
   
   New-SettingOverride -Name "EnableEncryptionAlgorithmCBC" -Parameters @("Enabled=True") -Component Encryption -Reason "Enable CBC encryption" -Section EnableEncryptionAlgorithmCBC  

5. Refresh the VariantConfiguration argument. To do this, run the following cmdlet:
   
   Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh

6. To apply the new settings, restart the World Wide Web Publishing service and the Windows Process Activation Service (WAS). To do this, run the following cmdlet:
   
   Restart-Service -Name W3SVC, WAS -Force

If you have Exchange hybrid deployment (mailboxes in both on-premises and Exchange Online) 

Organizations that use Exchange Server together with the Azure Rights Management Service Connector (Azure RMS) will be automatically opted out of the AES256-CBC mode update in Exchange Online until at least January 2024. However, if you want to use the more secure AES-256 CBC mode to encrypt email messages and attachments in Exchange Online, and decrypt such email messages and attachments in Exchange Server, complete these steps to make necessary changes to your Exchange Server deployment.  

After you complete the required steps, open a support case, and then request the Exchange Online setting to be updated to enable AES256-CBC mode.  

If you are using Microsoft 365 Apps with Exchange Server 

By default, all your M365 applications, such as Microsoft Outlook, Microsoft Word, Microsoft Excel, and Microsoft PowerPoint, will use AES256-CBC mode encryption starting in August 2023. 

The following section describes how to force AES128-ECB for the users who use registry settings and Group Policy.

You can configure Office and Microsoft 365 Apps for Windows to use ECB or CBC mode by using the Encryption mode for Information Rights Management (IRM) setting under Configuration/Administrative Templates/Microsoft Office 2016/Security Settings. By default, CBC mode is used starting in version 16.0.16327 of Microsoft 365 Apps. 

For example, to force CBC mode for Windows clients, set the Group Policy setting as follows: 

Encryption mode for Information Rights Management (IRM): [2, Electronic Codebook (ECB)]

To configure settings for Office for Mac clients, see Set suite-wide preferences for Office for Mac. 

For more information, see the "AES256-CBC support for Microsoft 365" section of Technical reference details about encryption.