Released: July 2021 Exchange Server Security Updates

culmor and Kakemonster I assume this is the scenario where Exchange 2013 is the highest version of Exchange server and schema master is in a different site? A preferred way forward is to move the schema master to the same site, run the schema update and then move it back; it just just a bit of AD replication; the impact should be minimal. There is a different way to handle this also and I almost hesitate to suggest it but will mention it: you could use the June CU for Exchange 2016 / 2019 installation media to do the schema extension. Note that this will do two things: you will have to pass all E2016/2019 setup prerequisites (so let's say if there is an Exchange 2007 server in the org, this will not work) - and, more importantly - from that point on, you will always have to extend the schema using the version that you use for this. This might be an option if you are looking to move to the later version of Exchange anyway. Seeing that we are talking Exchange 2013 here, this might be OK.

EDIT 7/15: In case of "empty root domain" scenario, the following should work:

1) Introduce a VM/Server with Windows 2012 R2 (or any OS that is supported by Exchange Server 2013 Management tools) in same AD site/domain as that of root domain.
2) Install only Exchange 2013 management tools on this machine, using CU23 media
3) Install July 2021 security update
4) Perform PrepareSchema from this machine from \bin\setup.exe