Cumulative update pre-flight checklist

How it works

• Each CU is a full build of the product, so you go straight to the CU you want without any intermediate ones.
• There's no rollback. Microsoft warns that uninstalling a newer CU removes Exchange from the server completely, so your fallback is a tested backup and a rebuild plan.
• Security updates (SUs) are built for a specific CU, so after the CU you install the SUs released for it. An SU built for a different CU fails with "The upgrade patch cannot be installed by the Windows Installer service...".
• Microsoft's update FAQ explains that security fixes ship for the two most recent CUs (N and N-1). Fall further behind and the fixes stop.

Checklist

1. 1

   Choose the build and read the release notes

   Download the CU ISO and the latest SU for that CU in advance. Read the Exchange Team Blog announcement for known issues and Active Directory changes, and check the Exchange Server supportability matrix for supported .NET Framework and Windows Server versions (.NET versions it doesn't list aren't supported).

2. 2

   Back up the server and its customisations

   Have a tested backup of Active Directory and of the Exchange server. Then copy anything a CU overwrites: customised web.config files, EdgeTransport.exe.config or a branded OWA sign-in page.

   cmd

   robocopy "%ExchangeInstallPath%ClientAccess" D:\PreCU\ClientAccess *.config /S
   robocopy "%ExchangeInstallPath%FrontEnd" D:\PreCU\FrontEnd *.config *.aspx /S
   robocopy "%ExchangeInstallPath%Bin" D:\PreCU\Bin EdgeTransport.exe.config

3. 3

   Run Health Checker and SetupAssist, then restart

   Run the Exchange Health Checker and fix what it reports, such as an unsupported .NET Framework, outdated Visual C++ runtimes or a pending restart. SetupAssist.ps1 from Microsoft's CSS-Exchange scripts checks the server, your account and Active Directory for common setup blockers. If this message persists after restarts, Microsoft points you to the same two scripts:

   Microsoft Exchange Server setup cannot continue because a restart from a previous installation or update is pending.

4. 4

   Prepare Active Directory when the CU needs it

   Some CUs extend the schema or update Exchange objects in Active Directory, and the release notes say so. Check your current values with the Active Directory module:

   powershell

   $root = Get-ADRootDSE
   Get-ADObject "CN=ms-Exch-Schema-Version-Pt,$($root.schemaNamingContext)" -Properties rangeUpper
   Get-ADObject -SearchBase $root.configurationNamingContext `
     -Filter "objectClass -eq 'msExchOrganizationContainer'" -Properties objectVersion

   Wait for replication before you upgrade any server.

   powershell

   .\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareSchema
   .\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD

5. 5

   Put the server into maintenance mode

   For DAG members, follow the full procedure in patching a DAG without downtime. For a server outside a DAG, at least drain transport (redirecting queued mail if you have another server) and take the server offline:

   powershell

   Set-ServerComponentState -Identity EX01 -Component HubTransport -State Draining -Requester Maintenance
   Redirect-Message -Server EX01 -Target EX02.contoso.com
   Set-ServerComponentState -Identity EX01 -Component ServerWideOffline -State Inactive -Requester Maintenance

6. 6

   Deal with antivirus and other agents

   Microsoft's CU best practices say to disable antivirus temporarily during the update; at minimum, confirm the documented exclusions. Pause backup jobs and other agents that might open Exchange files.

7. 7

   Run setup the right way

   • Use an elevated prompt and run setup from the mounted ISO.
   • In PowerShell, start it as .\Setup.exe or with a full path. Typed as plain setup.exe, PowerShell can pick up the Setup.exe in Exchange's own Bin folder, which is on the system path. Setup then "succeeds" without updating anything, installs an older CU or fails with error 1619.
   • From Exchange 2019 CU14 onwards, and in SE, setup turns on Extended Protection by default. If you have a reason not to run it, read Extended Protection on Exchange Server before reaching for the /DoNotEnableEP opt-out.
   • Run it from the console or a session that won't be logged off, don't interrupt it, and restart when it finishes.
   powershell

   Set-Location D:\
   .\Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF

8. 8

   Install the matching SU

   Straight after the CU, install the latest SU for it from an elevated prompt and restart. Installing Exchange Server security updates covers that step in detail.

Verify

Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo }
Get-ExchangeServer EX01 | Format-List AdminDisplayVersion
Test-ServiceHealth -Server EX01 | Format-Table Role, RequiredServicesRunning, ServicesNotRunning -AutoSize

Set-ServerComponentState -Identity EX01 -Component ServerWideOffline -State Active -Requester Maintenance
Set-ServerComponentState -Identity EX01 -Component HubTransport -State Active -Requester Maintenance
Get-ServerComponentState -Identity EX01 | Where-Object State -ne 'Active'

Test-ReplicationHealth -Identity EX01      # DAG members only

What good looks like:

• ExSetup.exe shows the exact CU plus SU build; AdminDisplayVersion reflects the CU but not SUs.
• All required services are running, and only ForwardSyncDaemon and ProvisioningRps stay Inactive (normal on-premises).
• On DAG members, Test-ReplicationHealth passes and the database copies are Healthy.
• Health Checker is clean, OWA, ECP and Outlook connect, and test messages flow both ways.

Tips & gotchas

• If setup fails, Exchange services can be left Disabled. Don't patch them up by hand: follow Exchange services disabled or not starting after an update.
• The CU writes its log to C:\ExchangeSetupLogs\ExchangeSetup.log; SetupLogReviewer.ps1 turns it into a readable diagnosis.
• If the log reports "Setup encountered a problem while validating the state of Active Directory" and says the computer isn't in the same domain and site as the schema master, run /PrepareAD from a machine that is.
• Don't forget Edge Transport servers and machines that only run the management tools.