[Spacetrucker]

dsb.nepo,

I added this inbound desktop rule, but I still see the drops.
Src---------------Dest--------------Service--------------Action
ExchangeSrv------SC@Any----------UdpHighPorts---------Encrypt

Check me if I'm wrong, but my first inbound rule should do the same thing.
Src---------------Dest--------------Service--------------Action
InternalSubnets---SC@Any-----------Any-----------------Encrypt

I'm guessing I need the 'no nat rule' you speak of. I could create a host object with the public ip address of the Exchange server and then create a desktop rule that allows that particular address through. But that seems a bit risky.