What used to take days of manual work — researching best practices, applying hardening guides, tuning performance settings — EXpress completes automatically, while you do something else.
🔁
AutoPilot — Zero-Touch Install
Automatically reboots and resumes at the correct phase via RunOnce. State is persisted to XML — safe against crashes and power failures.
🛡
Security Hardening
TLS 1.2/1.3, SMBv1/WDigest/NetBIOS disabled, LSA Protection, Extended Protection, IPv4 over IPv6 preference, MRS Proxy and MAPI encryption hardened, Serialized Data Signing, LM level 5, SMTP banner, unnecessary Windows services disabled (Print Spooler, Fax, Secondary Logon, Smart Card, Windows Search), Shutdown Event Tracker disabled — all applied automatically with reference links in the report.
⬇
Automatic Prerequisites & Security Updates
.NET 4.8/4.8.1, VC++ 2012 & 2013, UCMA 4.0, URL Rewrite — downloaded and installed automatically, skipped if already present. Windows security updates applied via Windows Update in Phase 1. The current Exchange Security Update is detected dynamically via HealthChecker's build dictionary and installed in Phase 5 without manual KB hunting.
⚡
Performance Tuning
High Performance power plan, pagefile sizing, TCP settings, RSS + NIC queues, Netlogon MaxConcurrentAPI, Exchange Search affinity — per Microsoft & CSS-Exchange recommendations.
📋
HTML + PDF Installation Report
Comprehensive post-install report: Exchange config, virtual directory URLs, certificates, security settings with best-practice comparison, HealthChecker results embedded.
📄
Word Installation Document
Pure-PowerShell OpenXML engine — no Office required. 15-chapter .docx covering configuration, hardening, runbooks, and open items. DE/EN language selection. -CustomerDocument redacts sensitive values for external sharing.
🖥
Interactive Menu
Start without parameters for a guided installation menu. Instant toggle switches, credential validation, auto-detected config.psd1, and PS2Exe-compiled .exe support.
🔄
Swing Migration Ready
Export config from source server, import virtual directory URLs and connectors, import PFX certificate, join a Database Availability Group — all in one run.
🔒
Certificate Management
Import PFX certificate, enable for IIS + SMTP (+ IMAP/POP for non-wildcard), configure HSTS on OWA/ECP. Wildcard vs. named cert detection.
🧰
CSS-Exchange Integration
HealthChecker auto-downloaded and run in Phase 6. SetupAssist triggered on Phase 4 failure. EOMT for CVE mitigation. Auth Certificate monitoring setup.
📦
.exe Compilation
Build.ps1 wraps the script into a self-contained Windows executable via PS2Exe — runs elevated, preserves all parameters, includes version metadata.
⬇
Pre-staged Downloads
tools/Get-EXpressDownloads.ps1 pre-fetches all prerequisite packages (.NET 4.8/4.8.1, VC++ 2012 & 2013, UCMA, URL Rewrite) and CSS-Exchange scripts (HealthChecker, EOMT, SetupAssist, ExchangeExtendedProtectionManagement, MEAC) into a local sources/ folder. Idempotent — skips files already present. Run once before carrying the folder into an air-gapped or proxy-restricted network.
🌐
Remote Server Documentation
The Word installation document queries every Exchange server in the organisation via CIM over WinRM (TCP 5985/5986, Kerberos) — hardware, pagefile, volumes, NICs — without DCOM or dynamic RPC ports. tools/Enable-EXpressRemoteQuery.ps1 enables WinRM on a target server in one command; optional -EnableHttps and -RestrictToGroup switches harden the endpoint. Unreachable servers get an interactive Retry / Skip prompt; Autopilot skips silently.
🎨
Branded Document Templates
Supply a -TemplatePath .docx to inject your company branding — cover page, header, and footer come from the template; all 18 chapters are generated by EXpress and injected into a {{document_body}} placeholder. tools/Build-InstallationTemplate.ps1 generates the starter DE/EN templates. Tokens like {{Organization}}, {{Author}}, {{Classification}} are filled at runtime. Automatic fallback to the built-in cover page when no template is provided.
✉
Access Namespace Mail Config
Automatically registers the access namespace root domain (e.g. contoso.com derived from mail.contoso.com) as an Authoritative Accepted Domain and updates the default Email Address Policy to use it as the primary SMTP address — removing internal suffixes like .local or .lan. Configured via -MailDomain or derived automatically from -Namespace.
