Installing Cumulative Updates and Service

Packs for Exchange Server 2013

APRIL 6, 2013 BY PAUL CUNNINGHAM

In this article I will demonstrate the step by step process for installing
cumulative updates and service packs for Exchange Server 2013.

PREPARATION TASKS
Before installing any cumulative updates you should:

 Download the CU or Service Pack setup file from the Microsoft Download
Center (do not download from third party sites) and extract it to a folder
on each server. You can download the latest cumulative update and
upgrade an Exchange 2013 server to the latest version in one update.
You do not need to install all of the cumulative updates released between
your current version and the latest version.
 Take a confirmed backup of Active Directory.
 Take a confirmed backup of your existing Exchange 2013 servers and
databases.
 Have documented any customizations such as OWA, config files on
servers, registry changes, Lync integration, or third party add-ons.
 Review this known issue with receive connectors that can cause
upgrades to fail, leaving servers in a non-operational state.
 Verify that your Exchange SSL certificates have not expired.
INSTALLING CUMULATIVE UPDATES AND
SERVICE PACKS
Cumulative updates and Service Packs should be installed in the internet-
facing site first, before installing in other sites in the organization.

 The first servers to be updated in a site are the Mailbox servers.

 The Client Access servers are updated second.
 Edge Transport servers can be updated last.

If you have multi-role CAS/MBX servers installed then setup updates the roles
in the correct order anyway, and you should simply start with the internet-
facing servers.

During the deployment of a cumulative update within a site that contains load-
balanced Client Access server or Database Availability Group members there
will be a period where servers are not at exactly the same version. Although
this is expected and supported, it is not supported to stay in that state for a
long period of time.

In other words, you should plan to update all DAG members within a short
period of time, and not allow them to run at different versions for days, weeks
or months.

UPDATING MAILBOX SERVERS

Mailbox servers in a multi-server environment, whether installed as

standalone or as a multi-role server, should be placed into maintenance mode
before installing the cumulative update.
Note that the redirect target server must be provided as a fully qualified
domain name.

[PS] C:\>Set-ServerComponentState E15MB1 –Component HubTransport –

State Draining –Requester Maintenance

[PS] C:\>Redirect-Message -Server E15MB1 -Target

E15MB2.exchange2013demo.com

Confirm

Are you sure you want to perform this action?

Redirecting messages to "E15MB2.exchange2013demo.com".

[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is
"Y"): y

If the server is a DAG member proceed to the next section which contains
additional steps for DAG members, otherwise put the server into maintenance
mode with the following command.

[PS] C:\>Set-ServerComponentState E15MB1 –Component ServerWideOffline

–State InActive –Requester Maintenance
Exchange MVP Michael Van Horenbeeck has published a script for
automating the process of starting and stopping maintenance mode.

UPDATING MAILBOX SERVERS THAT ARE

DATABASE AVAILABILITY GROUP MEMBERS

In addition to placing Mailbox servers in maintenance mode any DAG

members also need to have active mailbox databases moved to another DAG
member, and be blocked from activation while the cumulative update is being
installed.

Suspend the DAG member from the cluster.

[PS] C:\>Suspend-ClusterNode –Name E15MB1

Name ID State

---- -- -----

E15MB1 1 Paused

Disable database copy activation.

[PS] C:\>Set-MailboxServer E15MB1 –

DatabaseCopyActivationDisabledAndMoveNow $true
Review the existing database copy auto activation policy, so that you can
return it to the same configuration after you’ve completed the upgrade.

[PS] C:\>Get-MailboxServer E15MB1 | Select

DatabaseCopyAutoActivationPolicy

DatabaseCopyAutoActivationPolicy : Unrestricted

Set the auto activation policy to “Blocked”. If the policy is already set to
“Blocked” then there is no action required.

[PS] C:\>Set-MailboxServer E15MB1 –DatabaseCopyAutoActivationPolicy

Blocked

Put the server into maintenance mode.

[PS] C:\>Set-ServerComponentState E15MB1 –Component ServerWideOffline

–State InActive –Requester Maintenance

TAKING SERVERS OUT OF MAINTENANCE MODE

To take the server out of maintenance mode after the upgrade the process is
reversed. Make sure that you return the database auto activation policy to the
original setting if it was not “Unrestricted”.
[PS] C:\>Set-ServerComponentState E15MB1 –Component ServerWideOffline
–State Active –Requester Maintenance

[PS] C:\>Resume-ClusterNode –Name E15MB1

Name ID State

---- -- -----

E15MB1 1 Up

[PS] C:\>Set-MailboxServer E15MB1 –DatabaseCopyAutoActivationPolicy

Unrestricted

[PS] C:\>Set-MailboxServer E15MB1 –

DatabaseCopyActivationDisabledAndMoveNow $false

[PS] C:\>Set-ServerComponentState E15MB1 –Component HubTransport –

State Active –Requester Maintenance

Exchange MVP Michael Van Horenbeeck has published a script for

automating the process of starting and stopping maintenance mode.
UPDATING LOAD-BALANCED CLIENT ACCESS
SERVERS

If you are running load-balanced Client Access servers in a site then you
should configure the load balancer to remove the server from the pool of
hosts, and allow any existing connections to close, before you install the
cumulative update.

The exact steps for this will depend on the load balancing solution that you
use, and you should refer to your vendor documentation for those.

As each Client Access server is updated join it to the pool again and then
repeat the process for the next server.

ACTIVE DIRECTORY PREPARATION TASKS

Some cumulative updates will include Active Directory schema changes. In

those cases the following steps will be required.

Note: The AD preparation tasks are not required to be run separately to the
upgrade of Exchange, unless in circumstances where you need to separate
the tasks to different teams with different permissions, or if you have a multi-
domain forest and want to control the AD changes.

Before applying the schema update follow the steps provided by Michael B
Smith to retrieve the existing Exchange schema version, so that you can
compare it before and after the AD preparation steps have been completed to
verify that the schema update was applied.
 1. Run setup.exe /PrepareSchema
/IAcceptExchangeServerLicenseTerms (requires Enterprise Admins
and Schema Admins permissions, and must be performed in the same
AD Site as the Schema Master on a server with the RSAT-ADDS-Tools
feature installed – the Schema Master itself would meet these
requirements)
2. Run setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms
3. Run setup.exe /PrepareDomain
/IAcceptExchangeServerLicenseTerms in each domain in your forest
that contains Exchange servers or mailboxes

When the Active Directory changes have been applied, on each server run the
upgrade.

UPGRADING THE SERVERS

Cumulative updates can be applied using either the command line or

graphical setup, whichever you prefer. Both options are demonstrated below.

 Follow the pre-installation processes outlined earlier in this article

depending on the server roles installed.
 Do not run the upgrade from the Exchange Management Shell as this will
cause it to fail due to locked files. Run the upgrade from an elevated cmd
prompt.
 If you receive a warning that the Office Filter Pack is not installed this can
be ignored, as it is not a required component for Exchange Server 2013.
 Set the PowerShell execution policy on each server being upgraded to
Unrestricted, as this may sometimes cause issues with update. Refer
to KB981474.
Caution: a cumulative update is a full reinstall of Exchange Server 2013. If it
is interrupted, or fails part way through the installation, you may need to
perform a server recovery. There is also no way to uninstall a cumulative
update.

Note: Exchange 2013 cumulative updates stop the “Microsoft Exchange

FrontEnd Transport” and “Microsoft Exchange Transport” services during the
pre-requisites check. If you do not proceed with the installation you will need
to manually restart the Microsoft Exchange Transport service.

UPGRADING USING THE COMMAND LINE

In an elevated command prompt run the following command from the

location where you extracted the cumulative update files.

Setup /m:upgrade /IAcceptExchangeServerLicenseTerms

The command prompt window will display the progress as the upgrade
proceeds. The upgrade itself is a lengthy process so you should allow plenty
of time for each server.

After the cumulative update has been install restart the server if prompted to
do so.

If you had placed the server into maintenance mode then you can run the
commands or the script for stopping maintenance mode after the installation is
finished (refer to the notes above).
UPGRADING USING THE GRAPHICAL SETUP

From the location that you extracted the cumulative update files
run Setup.exe. It is recommend to allow setup to connect to the internet and
check for updates.

When the update check has completed click Next to continue.

Setup will begin copying files. This can take several minutes depending on
your server’s performance capacity.
Setup will detect that this is an upgrade installation.

You will need to accept the license agreement each time you upgrade a
server.
Setup will perform a pre-requisites check. If any pre-requisites are not met
setup will stop and warn you about them, otherwise you will be able to
proceed with the upgrade.

The upgrade itself is a lengthy process and you may find that some steps
appear to have hung with no progress. This may be a bug with the graphical
setup, whereas the command line setup will typically show the percentage
progress as it goes.

When setup is complete you will be prompted to restart the server if required.
After the cumulative update has been install restart the server if prompted to
do so.

If you had placed the server into maintenance mode then you can run the
commands or the script for stopping maintenance mode after the installation is
finished (refer to the notes above).
POST-INSTALLATION TASKS
After deploying an Exchange 2013 cumulative update there are a number of
post-installation tasks that may be required.

REBALANCE THE DATABASE AVAILABILITY GROUP

After you’ve updated all of your DAG members there is a good chance that
the active databases will not be evenly distributed across the DAG, or won’t
be on their first activation preference. This process is the same for Exchange
2013 as it is for Exchange 2010.

[PS] C:\>cd $exscripts

[PS] C:\Program Files\Microsoft\Exchange

Server\V15\scripts>.\RedistributeActiveDatabases.ps1 -DagName E15DAG -
BalanceDbsByActivationPreference

RESTORING CUSTOMIZATIONS

After you have completed updating your servers you will need to re-apply any
customizations that you had documented during the preparation steps above.
VERIFYING SERVER HEALTH

Here are some suggestions for health checking your Exchange 2013 servers
after applying updates.

1. Check the cluster nodes are all up – verify that you have not left any
DAG members suspended in the cluster by running the Get-ClusterNode
cmdlet on one of the DAG members.
2. Test service health – use the Test-ServiceHealth cmdlet to verify that all
required services are running on each server.
3. Test MAPI connectivity to every database – use the Test-
MAPIConnectivity cmdlet to verify that all databases are mounted and
accessible.
4. Check the database copy status for DAGs – use the Get-
MailboxDatabaseCopyStatus cmdlet to verify that all database copies,
copy/replay queues, and content indexes are healthy.
5. Test replication health for DAGs – use the Test-
ReplicationHealth cmdlet on each DAG member to verify replication
health is good.
6. Check the database activation policy for each Mailbox server – verify
that each Mailbox server that is in a DAG has the correct database
activation policy for your environment.
7. Check server component status – use Get-ServerComponent to verify
that you have not left any servers in maintenance mode.
8. Run Exchange Analyzer to check for best practices compliance.

You can also use Test-ExchangeServerHealth.ps1 to review the health of

your environment.