Blog Post

Exchange Team Blog
3 MIN READ

Released: September 2017 Quarterly Exchange Updates

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Sep 19, 2017

The latest set of Cumulative Updates for Exchange Server 2016 and Exchange Server 2013 are now available on the download center.  These releases include fixes to customer reported issues, all previously reported security/quality issues and updated functionality.

Minimum supported Forest Functional Level is now 2008R2

In our blog post, Active Directory Forest Functional Levels for Exchange Server 2016, we informed customers that Exchange Server 2016 would enforce a minimum 2008R2 Forest Functional Level requirement for Active Directory.  Cumulative Update 7 for Exchange Server 2016 will now enforce this requirement.  This change will require all domain controllers in a forest where Exchange is installed to be running Windows Server 2008R2 or higher.  Active Directory support for Exchange Server 2013 remains unchanged at this time.

Support for latest .NET Framework

The .NET team is preparing to release a new update to the framework, .NET Framework 4.7.1.  The Exchange Team will include support for .NET Framework 4.7.1 in our December Quarterly updates for Exchange Server 2013 and 2016, at which point it will be optional.  .NET Framework 4.7.1 will be required on Exchange Server 2013 and 2016 installations starting with our June 2018 quarterly releases.  Customers should plan to upgrade to .NET Framework 4.7.1 between the December 2017 and June 2018 quarterly releases. The Exchange team has decided to skip supporting .NET 4.7.0 with Exchange Server.  We have done this not because of problems with the 4.7.0 version of the Framework, rather as an optimization to encourage adoption of the latest version.

Known unresolved issues in these releases

The following known issues exist in these releases and will be resolved in a future update:
  • Online Archive Folders created in O365 will not appear in the Outlook on the Web UI
  • Information protected e-Mails may show hyperlinks which are not fully translated to a supported, local language

Release Details

KB articles that describe the fixes in each release are available as follows: Exchange Server 2016 Cumulative Update 7 does include new updates to Active Directory Schema.  If upgrading from an older Exchange version or installing a new server, Active Directory updates may still be required.  These updates will apply automatically during setup if the logged on user has the required permissions.  If the Exchange Administrator lacks permissions to update Active Directory Schema, a Schema Admin must execute SETUP /PrepareSchema prior to the first Exchange Server installation or upgrade.  The Exchange Administrator should execute SETUP /PrepareAD to ensure RBAC roles are current. Exchange Server 2013 Cumulative Update 18 does not include updates to Active Directory, but may add additional RBAC definitions to your existing configuration. PrepareAD should be executed prior to upgrading any servers to Cumulative Update 18. PrepareAD will run automatically during the first server upgrade if Exchange Setup detects this is required and the logged on user has sufficient permission.

Additional Information

Microsoft recommends all customers test the deployment of any update in their lab environment to determine the proper installation process for your production environment. For information on extending the schema and configuring Active Directory, please review the appropriate TechNet documentation. Also, to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed. To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded. If the policies are NOT set to Unrestricted you should use the resolution steps in KB981474 to adjust the settings.

Reminder: Customers in hybrid deployments where Exchange is deployed on-premises and in the cloud, or who are using Exchange Online Archiving (EOA) with their on-premises Exchange deployment are required to deploy the most current (e.g., 2013 CU18, 2016 CU7) or the prior (e.g., 2013 CU17, 2016 CU6) Cumulative Update release.

For the latest information on Exchange Server and product announcements please see What's New in Exchange Server 2016 and Exchange Server 2016 Release Notes.  You can also find updated information on Exchange Server 2013 in What’s New in Exchange Server 2013, Release Notes and product documentation available on TechNet.

Note: Documentation may not be fully available at the time this post is published.

The Exchange Team
Published Sep 19, 2017
Version 1.0

48 Comments

  • Anonymous's avatar
    Anonymous
    Sep 11 security update KB4036108 does look like a major issue for Exchange 2013 and Exchange 2016 servers. Its safer to wait until next CU update than to apply it and get screwed. My company recently decided that it will be a really good idea to apply the patches the minute Microsoft releases them, without doing any homework and checking on the Internet to see if other admins ran into any issues. I;m really glad that i managed to convince the upper management and do diligence first before patching. Anyhow for more details regarding this fiasco see this link

    https://social.technet.microsoft.com/Forums/en-US/5e6badad-6f5b-4f98-bd80-aa38eebfe0dd/kb4036108-patch-fails-the-term-stopsetupservice-is-not-recognized?forum=Exch2016SD

    thanks Microsoft

  • Anonymous's avatar
    Anonymous
    KB4036108 broker our Exchange server both times it was installed. The install failed and the only way to get it back is to restore from a backup.
  • Anonymous's avatar
    Anonymous
    Any news for the organizations willing to disable TLS 1.0 and 1.1. And only operate with TLS 1.2?
  • Anonymous's avatar
    Anonymous
    Security hotfix KB4036108 for Exchange 2016 CU6 and Exchange 2013 CU17 kills those servers.

    Is the hotfix in KB4036108 included in Exchange 2016 CU7 and Exchange 2013 CU18 or does Microsoft plan on issuing a separate hotfix that will kill CU7/CU18 installations as well?

    • Anonymous's avatar
      Anonymous
      As noted above, these releases include all previously released security updates. The fixes for KB4036108 are included in today's releases. We are not tracking any known issues with the fixes included in KB4036108. We are investigating reports of the KB4036108 installer leaving search indexes in a failed state. This is related to the installer however, not the actual fixes. The install process invoked by patching is not identical to installing a cumulative update. We have not seen the failed index problem installing today's releases.
      • Anonymous's avatar
        Anonymous
        Probably because it was easier for folks like me to recover my server than open a support incident with MS... the support site is crap... check out this thread: https://social.technet.microsoft.com/Forums/office/en-US/5e6badad-6f5b-4f98-bd80-aa38eebfe0dd/kb4036108-patch-fails-the-term-stopsetupservice-is-not-recognized?forum=Exch2016SD
  • Anonymous's avatar
    Anonymous
    Security hotfix KB4036108 for Exchange 2016 RU6 and Exchange 2013 RU17 kills those servers.

    Is the hotfix in KB4036108 included in Exchange 2016 RU7 and Exchange 2013 RU18 or does Microsoft plan on issuing a separate hotfix that will kill RU7/RU18 installations as well?