FSRM SMTP TLS update issue

Patel Vihaan 0 Reputation points
2026-09-01T06:39:33.2166667+00:00

Hi everyone

  1. Tried updating FSRM email settings, Failed
  2. Modified mail gateway configuration, Failed
  3. Restarted FSRM service, Failed

netsh winhttp show proxy

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\FSRM\Email" -Name SmtpUseTLS -Value 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\FSRM\Email" -Name SmtpPort -Value 587

Restart-Service SrmSvc

So, any other ways to make FSRM quota warning emails work properly after the corporate mail gateway started enforcing TLS 1.2+ authentication ?

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 42,425 Reputation points Independent Advisor
    2026-09-01T08:03:18.9+00:00

    Hi Patel,

    FSRM cannot send emails directly to modern mail gateways because its notification engine is hardcoded to plain-text, unauthenticated SMTP on TCP port 25, rendering registry keys like ⁠SmtpUseTLS⁠ ineffective. The standard solution is to route FSRM notifications through an intermediate internal SMTP relay (such as IIS SMTP or an Exchange connector) that receives the messages locally on port 25 and forwards them outbound with required TLS 1.2 encryption and authentication. Alternatively, you can configure FSRM to log Event IDs 8229 or 8230 to the Application Event Log and trigger a custom PowerShell script or Microsoft Graph API call to send authenticated notification emails.

    Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

    VPHAN

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-01T06:39:53.33+00:00

    If the mail gateway now requires TLS 1.2+, the supported path in the provided guidance is to enable TLS 1.2 on the Windows server that sends the email.

    Because this requires registry changes, back up the registry first. Incorrect registry changes can cause serious problems.

    1. Install the latest Windows updates. Some Windows versions require current updates before TLS 1.2 can be enabled.
    2. Check these registry paths:
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
    3. Set DisabledByDefault to 0.
    4. Set Enabled to 1.
    5. Restart the server.

    If the component sending mail is a .NET-based application, TLS 1.2 may also need to be re-enabled as the machine-wide default protocol by setting SchUseStrongCrypto=1 under the appropriate .NET Framework registry path:

    • HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node\]Microsoft\.NETFramework\<VERSION>
    • Use v4.0.30319 for .NET Framework 4 and later, or v2.0.50727 for .NET Framework 3.5.
    • Add Wow6432Node if the application runs as a 32-bit process on a 64-bit OS.

    The provided guidance also notes that TLS 1.0 and TLS 1.1 deprecation can cause secure connection and authentication failures, and servers must be able to use TLS 1.2.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.