Released: September 2019 Quarterly Exchange Updates

[The_Exchange_Team]

Today we are announcing the availability of quarterly servicing cumulative updates for Exchange Server 2016 and 2019. These updates include fixes for customer reported issues as well as all previously released security updates. 

Release Details

The KB articles that describe the fixes in each release and product downloads are available as follows:

• Exchange Server 2019 Cumulative Update 3 (KB4514141), VLSC Download
• Exchange Server 2016 Cumulative Update 14 (KB4514140), Download, UM Lang Packs

Additional Information

Microsoft recommends all customers test the deployment of any update in their lab environment to determine the proper installation process for your production environment. For information on extending the schema and configuring Active Directory, please review the appropriate documentation.

Also, to prevent installation issues you should ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed. To verify the policy settings, run the Get-ExecutionPolicy cmdlet from PowerShell on the machine being upgraded. If the policies are NOT set to Unrestricted you should use the resolution steps in KB981474 to adjust the settings.

Reminder: Customers in hybrid deployments where Exchange is deployed on-premises and in the cloud, or who are using Exchange Online Archiving (EOA) with their on-premises Exchange deployment are required to deploy the currently supported cumulative update for the product version in use, e.g., 2013 Cumulative Update 23; 2016 Cumulative Update 14 or 13; 2019 Cumulative Update 3 or 2.

For the latest information on Exchange Server and product announcements please see What's New in Exchange Server and Exchange Server Release Notes.

Note: Documentation may not be fully available at the time this post is published.

The Exchange Team

[Martin_Aigner]

Thanks guys, seems some long expected fixes are included here. 

Please allow me one question, as it was not 100% clear from the documentation provided. Do we need to run a /PrepareAD /PrepareDomain (/PrepareAllDomains) before we are able to roll out (update to) this release on Exchange 2016 CU13 or can this be skipped this time?

It just includes a known issue in the KB that sounds familiar to me as valid already for previous releases

[Sam_T]

Yet another poorly thought out article. After all these years we're supposed to keep asking the same old questions about schema updates and /prepareAD and the other usual questions ?  After all these years you still cant be bothered to create a helpful article for the poor souls who have to go out and deploy these CUs?  Is the goal perhaps, as someone said earlier, for these updates to fail so that we'll all decide that we'd better move to the cloud asap ?

Is there a button we can press here to express the intense loathing of an article or are we just supposed to just "like" all of these posts ?

[Greg Taylor - EXCHANGE]

@Martin_Aigner - They are not required for either of these CUs. 

@Sam_T  - We always make our best effort to call out when they are required. When they are not, we don't mention it. 

(edited: please see my later reply)

[Thurlog]

i think you should mention it.. or explain why we get

G:\>Setup.exe /mode:upgrade /IAcceptExchangeServerLicenseTerms

Microsoft Exchange Server 2016 Cumulative Update 14 Unattended Setup

Copying Files...
File copy complete. Setup will now collect additional information needed for installation.

Languages
Management tools

Performing Microsoft Exchange Server Prerequisite Check

Configuring Prerequisites COMPLETED
Prerequisite Analysis 100%

Setup will prepare the organization for Exchange Server 2016 by using 'Setup /PrepareAD'. No Exchange Server 2013 roles
have been detected in this topology. After this operation, you will not be able to install any Exchange Server 2013
roles.
For more information, visit: https://docs.microsoft.com/Exchange/plan-and-deploy/deployment-ref/readiness-checks?view=exchserver-...

Setup will prepare the organization for Exchange Server 2016 by using 'Setup /PrepareAD'. No Exchange Server 2010 roles
have been detected in this topology. After this operation, you will not be able to install any Exchange Server 2010
roles.
For more information, visit: https://docs.microsoft.com/Exchange/plan-and-deploy/deployment-ref/readiness-checks?view=exchserver-...

Active Directory needs to be prepared for Exchange Server but the Active Directory management tools aren't installed on
this computer. To install the tools, install the 'RSAT-ADDS' Windows feature. Alternately, you can run setup.exe
/PrepareAD on a domain controller.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.W2K8R2PrepareAdLdifdeNotInsta...

Global updates need to be made to Active Directory, and this user account isn't a member of the 'Enterprise Admins'
group.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.GlobalUpdateRequired.aspx

The local domain needs to be updated. You must be a member of the 'Domain Admins' group and 'Organization Management'
role group, or 'Enterprise Admins' group to continue.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.LocalDomainPrep.aspx

Setup encountered a problem while validating the state of Active Directory: Exchange organization-level objects have
not been created, and setup cannot create them because the local computer is not in the same domain and site as the
schema master. Run setup with the /prepareAD parameter on a computer in the domain adt and site
Default-First-Site-Name, and wait for replication to complete. See the Exchange setup log for more information on this
error.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.AdInitErrorRule.aspx

The forest functional level of the current Active Directory forest is not Windows Server 2003 native or later. To
install Exchange Server 2016, the forest functional level must be at least Windows Server 2003 native.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.ForestLevelNotWin2003Native.a...

The Windows component RSAT-ADDS-Tools isn't installed on this computer and needs to be installed before Exchange Setup
can begin.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.RsatAddsToolsInstalled.aspx

Either Active Directory doesn't exist, or it can't be contacted.
For more information, visit: http://technet.microsoft.com/library(EXCHG.150)/ms.exch.setupreadiness.CannotAccessAD.aspx

The Exchange Server setup operation didn't complete. More details can be found in ExchangeSetup.log located in the
<SystemDrive>:\ExchangeSetupLogs folder.

[Sjaak_Rovers]

My first check based on your output: looks like you logged on to the server using a local account and not a domain account with the right permissions.

[Thurlog]

nope, we don't have 2016 edge servers yet :)

all others (including consoles) are domainjoined and run by a domain account

after running (on the schemamaster)

Setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms
Setup.exe /PrepareAllDomains /IAcceptExchangeServerLicenseTerms

waiting a few moments and then retrying the setups it works flawless on all servers

(except the usual pending reboot and whatnot crap, but no "AD upgraded needed" errors)

[benoitrando]

Hello ,

Just finished to update my test exchange environment from Exchange 2016 CU13 to Exchange 2016 CU14.

Please find some comments :

1. Before the update , I updated from DOT NET 4.7.2 to DOT 4.8 , as it will be mandatory for the CU release December 2019 (see previous announcement)

2. No need to perform any AD schema update when you are updating from CU13 to CU14.

However if you are updating from CU12 to CU14 , then AD schema update is mandatory due to CU13 in the middle which is requiring schema update.

See below the different AD object to verify for each version for the lastest exchange 2016 CU

* Prepare Ad Organization
Setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms

Verification with Powershell command

"Exchange Schema Version = " + ([ADSI]("LDAP://CN=ms-Exch-Schema-Version-Pt," + ([ADSI]"LDAP://RootDSE").schemaNamingContext)).rangeUpper

* Prepare All Domains
Setup.exe /PrepareAllDomains /IAcceptExchangeServerLicenseTerms

Verification in Powershell command

$RootDSE= ([ADSI]"").distinguishedName
([ADSI]"LDAP://CN=Microsoft Exchange System Objects,$RootDSE").objectVersion

Verification with ADSI edit for the following object

CN=Configuration,DC=xxxxx,DC=yyyyy

   CN=Services

     CN=Microsoft Exchange

       CN=Name of the exchange org

ObjectVersion = 16217

                    Forest             Domain
                    Range Upper Object Ver.      Object Ver.

2016 CU12 15332              16215              13236
2016 CU13 15332              16217              13237
2016 CU14 15332              16217              13237

Hope it will help some people

[Thurlog]

we're upgrading from CU12.. so that explains it.. (and it shows that the comment "They are not required for either of these CUs. " is wrong...)

[Martin_Aigner]

@Thurlog No, it shows you‘re not fully aware what CU means. 

[benoitrando]

@Thurlog Please always read the previous CU announcement and their pre-requirement .

If you didn't apply the exchange 2016 CU13 , this means that all necessary steps explained in the release of CU13 must be applied before installation directly from CU12 to CU14 . That's why skipping a CU is never a good idea . Or at least have always the same test environment than the production one .

In the case of updating from CU12 to CU 14 , then a AD schema is mandatory as it was required in CU13 . Read carefully as well the CU13, 3 main changes are described there and could impact your environment 

[Greg Taylor - EXCHANGE]

To add to my earlier comment, and @benoitrando is spot on - this CU itself doesn't require /PrepareAD or /PrepareDomain, but the previous CU's did. So if you installed the last CU's and ran them then, no need to run those commands this time. However, if you skipped CU13/CU2, then yes, you need to run them.

Apologies for any confusion I may have caused there. We'll try and make that clearer in subsequent posts. 

[jordanl17]

@Greg Taylor - EXCHANGE, How soon before I actually upgrade to CU14 can I run /PrepareAD?  (we are going from CU12 to CU14)  I'd like to get some steps out of the way before upgrading, to make the upgrade as simple as possible.   I know that it's recommended to upgrade .NET right before you install the CU.  (I'm going to upgrade to .NET 4.8).  thanks!  (first blog post here!) 

ps, these 2016 CU's are much more frightening than the CU's for Exchange 2010.  Those seems much simpler.. (not like an ENTIRE reinstall of Exchange for every CU)

[Greg Taylor - EXCHANGE]

Generally doing that ahead of time should be fine, though we did make some AD permission changes over the last few CU's - so I'd keep them as close together as you can. No sense in adding a delay if you can avoid it. 

Yes CU's are full builds, but there are many advantages to that approach. It's much simpler to stay up to date and security patched that way, though the full install of course takes longer.