What are the two main methods for detecting the version of a Microsoft Exchange server?

The two methods are accessing the EWS interface to get the exact build number from the `X-OWA-Version` response header, and accessing the OWA interface to parse an approximate version from the HTML content. The exact method is preferred for precision, but if it fails, the approximate method provides a usable version range. For more details, see Penetration Basics - Exchange Version Detection and Vulnerability Scanning. Similar version detection techniques can be applied to other services like Minio or Zimbra.