My environment is in Hybrid mode, 3 node DAG, Exchange 2013 CU23 on Windows Server 2012. Before attempting to apply the patch I ran Windows Update and installed all available updates, rebooted, waited until .Net optimization was done (upgraded from .Net Framework 4.7.2 > 4.8). Took a snapshot of the server (thank goodness), UAC is disabled, ran the update from an elevated command prompt, failed miserably. Update program would only stop the following service: Microsoft Exchange Search Host Controller. Update rolled back automatically and stated that the update ended "prematurely." All other services remained running. Tried again and this time I manually stopped all Exchange services as well as the WWW service before running the update from an elevated command prompt...same thing. Failed. Reverted snapshot, tried second way again...fail. Reverted snapshot again and ran the update through via Windows Update...success! These security updates for Exchange Server always seem to be a crap shoot whether they install gracefully or not.