> ## Documentation Index
> Fetch the complete documentation index at: https://helpdocs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Liongard Exchange On-Prem Read

> Interrogate a client's on-premises Microsoft Exchange through the Liongard Exchange inspector — server version/CU/build, databases, mailbox inventory, connectors, and admin access. Use for "what's their Exchange config?", CU/patch-currency checks, database/mailbox inventory, or mail-flow triage context.

<Info>
  **Category:** Liongard Inspectors · [View source ↗](https://github.com/bryan-getthread/skills/blob/main/skills/liongard-inspectors/liongard-exchange-on-prem/SKILL.md)
</Info>

**Connectors:** `Liongard`

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Risk & Compliance, Faster Resolution & Response

**When to use:** "What CU/build is \<client>'s Exchange server on?" (Exchange CVEs are commonly build-gated), "what mailbox databases exist and how big are they?", mailbox inventory, "what send/receive connectors and mail-flow routing are configured?", or "did a connector or database setting change?". For Exchange Online, use the M365 tenant read.

**Run it:** on one client — name the client and the Exchange question.

## Prompt

```
Read on-premises Microsoft Exchange state for CLIENT_NAME from the Liongard Exchange inspector. Read-only — Exchange config, connectors, and mailboxes are a technician's job via EMS/ECP.

1. Resolve the client's environment, then find the on-prem Exchange inspector (confirm it's the on-prem one, not Exchange Online) and confirm it ran recently — carry "as of <timestamp>." Mail config changes, so an old data read on an active mail-flow incident deserves a "verify live" caveat.
2. Read the values from its latest dataprint for the angle you need, verifying every field angle against the live dataprint (schemas vary by inspector version):
   - Version: server version/CU/build — report verbatim; compare against Microsoft's current CU and known-vuln advisories rather than asserting from memory.
   - Databases: database list with size and mount status — flag large/dismounted.
   - Mailboxes: mailbox count per database.
   - Connectors: send/receive connector list with smart-host/routing.
   - Admins: Exchange admin role assignments.
3. "What changed?" → check what changed on Exchange: CU/build upgrades, connector changes, database adds/removes, admin changes — ordered against the incident window (time-adjacency, not proven cause).
4. Sanity-check surprising zeros (zero databases) — usually a wrong field angle or partial inspection; re-probe broadly. Never paste connector credentials or smart-host secrets into notes — reference "credentials on file in <doc platform>." Exchange CU/build currency is a high-priority security finding (on-prem Exchange has repeatedly been actively exploited) — surface with the as-of date and recommend the tech patch.
5. Output: a compact table, source + data age line, flags (outdated CU/build, dismounted databases, unexpected connectors, excess admins). Offer to leave a plain-text note. Degradation: no on-prem Exchange inspector → documentation → ticket history → "verify on server."
```


## Related topics

- [Exchange On-Prem Mail Flow](/skill-library/troubleshooting-playbooks/exchange-onprem-mailflow.md)
- [Exchange Hybrid Issues](/skill-library/troubleshooting-playbooks/exchange-hybrid-issues.md)
- [Liongard Active Directory Read](/skill-library/liongard-inspectors/liongard-active-directory.md)