Exchange Management Shell fails to load after Exchange SE update KB5071876

Question

Exchange Management Shell fails to load after Exchange SE update KB5071876

Anonymous

Hello,

After installing Exchange Server Subscription Edition update KB5071876, Exchange Management Shell no longer loads correctly and generates PowerShell related errors. The server is currently in maintenance mode.

I tested uninstalling and reinstalling the update, but the issue persists.

I verified the applied Group Policies and did not find any GPO explicitly blocking PowerShell script execution. I have attached screenshots of the error messages, the applied GPO settings, and the PowerShell execution policy output.

PowerShell execution policy result:

MachinePolicy Undefined, UserPolicy Undefined, Process Undefined, CurrentUser Undefined, LocalMachine RemoteSigned.

Despite this configuration, Exchange PowerShell scripts such as RemoteExchange.ps1, CommonConnectFunctions.ps1 and ps1xml files are still blocked and Exchange cmdlets are not available.

Any guidance or similar experience after installing this update would be greatly appreciated.

Thank you in advance.1.png

0 comments

Answer accepted by question author

Hin-V 16,830 Microsoft External Staff Moderator

Hi @Anonymous

Thank you for posting your question in Microsoft Q&A.

As your description, the issue “blocked by software restriction policies” is not related to PowerShell’s execution policy. Your current execution policy (RemoteSigned at LocalMachine) correctly allows local scripts.

Based on my research, this issue typically points to Software Restriction Policies (SRP) configured via Group Policy or Local Security Policy. SRP is a separate Windows security feature from PowerShell execution policy and can block scripts based on path rules, hash rules, or other criteria, even if PowerShell’s execution policy is permissive.

If possible, could you try to:

Check for Active SRP on the Server

Run this on the Exchange server:

gpresult /h c:\gpresult.html

Open the HTML file and search for "Software Restriction Policies". Look under Computer Settings > Security Settings to see if any SRP is applied and what rules exist.

Alternatively, open Local Security Policy (secpol.msc) and navigate to Security Settings > Software Restriction Policies.

If the node exists but no rules are shown, SRP should not block scripts unless a default disallow rule is configured.

Create Explicit Allow Rules

In Group Policy Management Console (or local secpol.msc if local policy):

Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules.

Right-click > New Path Rule.

Add these paths one by one, setting Security Level to Unrestricted:

C:\Program Files\Microsoft\Exchange Server\V15\bin\RemoteExchange.ps1 
C:\Program Files\Microsoft\Exchange Server\V15\bin\CommonConnectFunctions.ps1 
C:\Program Files\Microsoft\Exchange Server\V15\bin\*.ps1 
C:\Program Files\Microsoft\Exchange Server\V15\bin\*.ps1xml (for the type files)

Or broader: C:\Program Files\Microsoft\Exchange Server\V15\bin* (allows everything in the bin folder)

Apply the GPO to the Exchange server OU, run gpupdate /force, and reboot or restart the shell.

Check for Zone Blocking

If Exchange files were copied/downloaded (for example, during patching), they may have a Zone.Identifier marking them as internet-sourced.

Run this command as admin:

Get-Item "C:\Program Files\Microsoft\Exchange Server\V15\bin\*" -Stream *

Look for Zone.Identifier streams on .ps1 or .ps1xml files.

If present, unblock via:

Unblock-File -Path "C:\Program Files\Microsoft\Exchange Server\V15\bin\*.ps1" 
Unblock-File -Path "C:\Program Files\Microsoft\Exchange Server\V15\bin\*.ps1xml"

After applying allow rules and unblocking files, restart the server (or at least IIS/PowerShell sessions) and test the Exchange Management Shell again.

References: Troubleshoot software restriction policies - Windows Server | Microsoft Learn

Please note that this summary is based on my own findings and may not fully address your concerns. To help you reach your goal more effectively, I recommend engaging with tech community forumsfor a deeper technical dive or to connect with individuals who have relevant experience and expertise. Some approaches may behave differently or be restricted depending on your specific environment and configuration. These forums include many experienced developers and Microsoft specialists who can assist with troubleshooting and guidance.

Apologies for redirecting you to the related development team support. As moderators in this community, we do not have access to your specific tenant configuration, and my testing environment is limited. Therefore, my guidance is based on available Microsoft documentation and resources. That said, I’ll do my best to provide additional insight where possible.

If you have any additional concerns, feel free to comment below. I would be more than happy to assist.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hin-V 16,830 Reputation points Microsoft External Staff Moderator

2026-01-06T07:14:41.7233333+00:00

Hi @Anonymous

I hope you are doing well.

Have you had a chance to check the replies provided?

Any update would be appreciated.

1 additional answer

Your answer

Hin-V 16,830 Reputation points Microsoft External Staff Moderator

2026-01-06T07:14:41.7233333+00:00

Hi @Anonymous

I hope you are doing well.

Have you had a chance to check the replies provided?

Any update would be appreciated.

Answer 1

Anonymous

Hello Mr. Hin-V,

First of all, I would like to thank you for the interest you have shown in my request, and I apologize for the delay in my response.

Please find attached the result of the following command: gpresult /h c:\gpresult.html

I have already checked both the local Group Policy and the domain Group Policy, and there are no Software Restriction Policies configured.

Unfortunately, despite applying your recommendations, the error persists. I also attempted to reinstall the management tools, but the SE version does not allow it.

If you have any other suggestions or possible solutions, I would greatly appreciate your guidance.

Thank you in advance for your assistance.

best regards, gpresult 1

domaine strategie.jpg rules Unrestricted

gpresult powershell

error

domaine strategie

Hin-V 16,830 Reputation points Microsoft External Staff Moderator

2026-01-07T12:36:02.3433333+00:00

Hi Benyahia Abdelghani

Thank you for your response.

It appears that no RSPs are affected and explicit allow rules have been created, but the issue still persists.

If possible, could you contact your reseller partner for support or ask them to raise a Unified ticket for on‑premises assistance?

For those using Exchange Server SE, we recommend reaching out to Microsoft Unified Support through the following link: Services Hub. Please note that this portal requires a paid ticket and access is subject to certain conditions, which you can review here: Services Hub sign‑in FAQs | Microsoft Learn.

We apologize for directing you to the development support team, but moderators in this community have limited resources to review backend information. Therefore, the most efficient way to receive faster and more effective assistance is to contact the support team directly.

If you have any additional concerns, please feel free to comment below. I’ll be glad to assist further.

Warm regards,
Anonymous

2026-01-07T15:13:29.2666667+00:00

Hello Hin-V

Thank you for your response and for your guidance.

Unfortunately, I am not able to open a Unified ticket or go through a reseller partner at the moment.

Nevertheless, I appreciate the information provided and the time you took to review this matter.

Best regards,
Hin-V 16,830 Reputation points Microsoft External Staff Moderator

2026-01-08T13:56:34.71+00:00

Hi @Anonymous

Thank you very much for your feedback.

Unfortunately, I’m limited by my environment, so I can’t investigate further and haven’t found additional articles related to this issue yet. If possible, I’d recommend reaching out to the Unified ticket team so they can properly receive and handle it more effectively.

If you’re able, please share any solutions to this issue in this thread so that others who may encounter the same problem can benefit and help build stronger community knowledge. In the meantime, if I come across additional issues or solutions related to EMS blocked by software restriction policies, I’ll make sure to update them here.

I truly appreciate your patience and understanding.

Warm thanks and have a nice day.