当管理员打开一个EMS的Session时，Exchange会查找anchor mailbox（不知道怎么翻译），即当前运行这个Session的管理员账号，拥有的邮箱所在的那台服务器，然后默默地把remote PowerShell的会话 proxy过去。实际效果就是你以为你在A服务器上跑脚本，但命令其实是在B服务器上执行的。
Prior to CU11, Exchange 2013 routed Remote PowerShell requests byfinding a random mailbox that is either higher than the ExchClientVer that isspecified in the URL, or if the ExchClientVer is not specified, by using thecurrent CAS version in which the client connected. We refer to this behavior asserver version-based routing.
With CU11, we changed Remote PowerShell to route requests to ananchor mailbox. Typically, this anchor mailbox would be the mailbox of the userattempting the connection. In the event the user attempting the connection didnot have a mailbox, the request would be routed to the organization arbitrationmailbox.
Unfortunately, the changes in CU11 introduced several issues withRemote PowerShell in the on-premises world that we did not anticipate. Afterreviewing each issue and performing an in-depth code review, we made the decision to revertthe CU11 change and return to utilizing server version-based routing for RemotePowerShell requests beginning in Exchange 2013 CU12. Exchange 2016 (including CU1)will also use server version-based routing.