Installing an Exchange cumulative update without surprises: a pre-flight checklist

A cumulative update (CU) isn't a small patch. It's a complete build of Exchange that replaces the server's binaries, and once it's installed you can't uninstall your way back to the previous CU. The common CU failures trace back to things you can check beforehand: a pending restart, a scanner holding files open, Active Directory not prepared, or setup started the wrong way. Here's the checklist I'd use before, during and after a CU on Exchange Server SE or 2019.

How it works#

• Each CU is a full build of the product, so you go straight to the CU you want without any intermediate ones.
• There's no rollback. Microsoft warns that uninstalling a newer CU removes Exchange from the server completely, so your fallback is a tested backup and a rebuild plan.
• Security updates (SUs) are built for a specific CU, so after the CU you install the SUs released for it. An SU built for a different CU fails with "The upgrade patch cannot be installed by the Windows Installer service...".
• Microsoft's update FAQ explains that security fixes ship for the two most recent CUs (N and N-1). Fall further behind and the fixes stop.

Step-by-step: the pre-flight checklist#

1. Choose the build and read the release notes#

Download the CU ISO and the latest SU for that CU in advance. Read the Exchange Team Blog announcement for known issues and Active Directory changes, and check the Exchange Server supportability matrix for supported .NET Framework and Windows Server versions (.NET versions it doesn't list aren't supported). Test it in a lab first if you can.

2. Back up the server and its customisations#

Have a tested backup of Active Directory and of the Exchange server. Then copy anything a CU overwrites: customised web.config files, EdgeTransport.exe.config or a branded OWA sign-in page. Exchange 2019 CU13 and later back up and restore the most common configuration files, but treat that as a safety net rather than the plan.

robocopy "%ExchangeInstallPath%ClientAccess" D:\PreCU\ClientAccess *.config /S
robocopy "%ExchangeInstallPath%FrontEnd" D:\PreCU\FrontEnd *.config *.aspx /S
robocopy "%ExchangeInstallPath%Bin" D:\PreCU\Bin EdgeTransport.exe.config

3. Run Health Checker and SetupAssist, then restart#

Run the Exchange Health Checker and fix what it reports, such as an unsupported .NET Framework, outdated Visual C++ runtimes or a pending restart. SetupAssist.ps1 from Microsoft's CSS-Exchange scripts checks the server, your account and Active Directory for common setup blockers. Install Windows updates first, then restart right before the CU, as Microsoft's CU best practices recommend. If this message persists after restarts, Microsoft points you to the same two scripts:

Microsoft Exchange Server setup cannot continue because a restart from a previous installation or update is pending.

4. Prepare Active Directory when the CU needs it#

Some CUs extend the schema or update Exchange objects in Active Directory, and the release notes say so. Check your current values with the Active Directory module:

$root = Get-ADRootDSE
Get-ADObject "CN=ms-Exch-Schema-Version-Pt,$($root.schemaNamingContext)" -Properties rangeUpper
Get-ADObject -SearchBase $root.configurationNamingContext `
  -Filter "objectClass -eq 'msExchOrganizationContainer'" -Properties objectVersion

Compare them with the version table in Microsoft's Prepare Active Directory and domains article. If preparation is needed, run it from the CU media with an account in Schema Admins and Enterprise Admins, on a machine in the same Active Directory site as the schema master. Wait for replication before you upgrade any server.

.\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareSchema
.\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD

If you skip this, setup tries to do it during the upgrade, which fails without those rights or from another site. If your schema master is a Windows Server 2025 domain controller, the supportability matrix says it needs the November 2025 or later cumulative update before any PrepareAD operation.

5. Put the server into maintenance mode#

For DAG members, follow the full procedure in patching a DAG without downtime. For a server outside a DAG, at least drain transport (redirecting queued mail if you have another server) and take the server offline:

Set-ServerComponentState -Identity EX01 -Component HubTransport -State Draining -Requester Maintenance
Redirect-Message -Server EX01 -Target EX02.contoso.com
Set-ServerComponentState -Identity EX01 -Component ServerWideOffline -State Inactive -Requester Maintenance

6. Deal with antivirus and other agents#

Microsoft's CU best practices say to disable antivirus temporarily during the update; at minimum, confirm the documented exclusions. Pause backup jobs and other agents that might open Exchange files.

7. Run setup the right way#

• Use an elevated prompt and run setup from the mounted ISO.
• In PowerShell, start it as .\Setup.exe or with a full path. Typed as plain setup.exe, PowerShell can pick up the Setup.exe in Exchange's own Bin folder, which is on the system path. Setup then "succeeds" without updating anything, installs an older CU or fails with error 1619.
• From Exchange 2019 CU14 onwards, and in SE, setup turns on Extended Protection by default. If you have a reason not to run it, read Extended Protection on Exchange Server before reaching for the /DoNotEnableEP opt-out.
• Run it from the console or a session that won't be logged off, don't interrupt it, and restart when it finishes.

Set-Location D:\
.\Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF

8. Install the matching SU#

Straight after the CU, install the latest SU for it from an elevated prompt and restart. Installing Exchange Server security updates covers that step in detail.

Verify#

Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo }
Get-ExchangeServer EX01 | Format-List AdminDisplayVersion
Test-ServiceHealth -Server EX01 | Format-Table Role, RequiredServicesRunning, ServicesNotRunning -AutoSize

Set-ServerComponentState -Identity EX01 -Component ServerWideOffline -State Active -Requester Maintenance
Set-ServerComponentState -Identity EX01 -Component HubTransport -State Active -Requester Maintenance
Get-ServerComponentState -Identity EX01 | Where-Object State -ne 'Active'

Test-ReplicationHealth -Identity EX01      # DAG members only

What good looks like:

• ExSetup.exe shows the exact CU plus SU build; AdminDisplayVersion reflects the CU but not SUs.
• All required services are running, and only ForwardSyncDaemon and ProvisioningRps stay Inactive (normal on-premises).
• On DAG members, Test-ReplicationHealth passes and the database copies are Healthy.
• Health Checker is clean, OWA, ECP and Outlook connect, and test messages flow both ways.

Then move on to the next server.

Tips & gotchas#

• If setup fails, Exchange services can be left Disabled. Don't patch them up by hand: follow Exchange services disabled or not starting after an update.
• The CU writes its log to C:\ExchangeSetupLogs\ExchangeSetup.log; SetupLogReviewer.ps1 turns it into a readable diagnosis.
• If the log reports "Setup encountered a problem while validating the state of Active Directory" and says the computer isn't in the same domain and site as the schema master, run /PrepareAD from a machine that is.
• Don't forget Edge Transport servers and machines that only run the management tools.

References#

• Upgrade Exchange to the latest Cumulative Update (Microsoft Learn)
• Prepare Active Directory and domains for Exchange Server (Microsoft Learn)
• Fix failed Exchange Server updates (Microsoft Learn)