Preparing for Cumulative Updates

Purpose: This document is meant to be an abstract guide on what to do before installing Cumulative Updates on Microsoft Exchange Server. There are a few considerations that need to be made ahead of time. This list was put together through shere brute-force while troubleshooting an update issue for a server on 12/16/2024.

Domain Group Membership¶

You have to be logged in with a domain user that possesses the following domain group memberships, if these group memberships are missing, the upgrade process will fail.

• Enterprise Admins
• Schema Admins
• Organization Management

User Rights Management¶

You have to be part of the "Local Policies > User Rights Assignment > "Manage Auditing and Security Logs" security policy. You can set this via group policy management or locally on the Exchange server via secpol.msc. This is required for the "Monitoring Tools" portion of the upgrade.

It's recommended to reboot the server after making this change to be triple-sure that everything was applied correctly.

Running Updater within SeSecurityPrivilege Operational Context¶

At this point, you would technically be ready to invoke setup.exe on the Cumulative Update ISO image to launch the upgrade process, but we are going to go the extra mile to manually "Enable" the SeSecurityPrivilege within a Powershell session, then use that same session to invoke the setup.exe so the updater runs within that context. This is not really necessary, but something I added as a "hail mary" to make the upgrade successful.

Open Powershell ISE¶

The first thing we are going to do, is open the Powershell ISE so we can copy/paste the following powershell script, this script will explicitely enable SeSecurityPrivilege for anyone who holds that privilege within the powershell session.

# Create a Privilege Adjustment
$definition = @"
using System;
using System.Runtime.InteropServices;

public class Privilege
{
    const int SE_PRIVILEGE_ENABLED = 0x00000002;
    const int TOKEN_ADJUST_PRIVILEGES = 0x0020;
    const int TOKEN_QUERY = 0x0008;
    const string SE_SECURITY_NAME = "SeSecurityPrivilege";

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, out IntPtr TokenHandle);

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, int BufferLength, IntPtr PreviousState, IntPtr ReturnLength);

    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public struct TOKEN_PRIVILEGES
    {
        public int PrivilegeCount;
        public long Luid;
        public int Attributes;
    }

    public static bool EnablePrivilege()
    {
        IntPtr tokenHandle;
        TOKEN_PRIVILEGES tokenPrivileges;

        if (!OpenProcessToken(System.Diagnostics.Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out tokenHandle))
            return false;

        if (!LookupPrivilegeValue(null, SE_SECURITY_NAME, out tokenPrivileges.Luid))
            return false;

        tokenPrivileges.PrivilegeCount = 1;
        tokenPrivileges.Attributes = SE_PRIVILEGE_ENABLED;

        return AdjustTokenPrivileges(tokenHandle, false, ref tokenPrivileges, 0, IntPtr.Zero, IntPtr.Zero);
    }
}
"@

Add-Type -TypeDefinition $definition
[Privilege]::EnablePrivilege()

Validate Privilege¶

At this point, we now have a powershell session operating with the SeSecurityPrivilege privilege enabled. We want to confirm this by running the following commands:

whoami # (1)
whoami /priv # (2)

1. Output will appear similar to "bunny-lab\nicole.rappe", prefixing the username of the person running the command with the domain they belong to.
2. Reference the privilege table seen below to validate the output of this command matches what you see below.

Execute setup.exe¶

Finally, at the last stage, we mount the ISO file for the Cumulative Update ISO (e.g. 6.6GB ISO image), and using this powershell session we made above, we navigate to the drive it is running on, and invoke setup.exe, causing it to run under the SeSecurityPrivilege operational state.

D: <ENTER> # (1)
.\Setup.EXE /m:upgrade /IAcceptExchangeServersLicenseTerms_DiagnosticDataON # (2)

1. Replace this drive letter with whatever letter was assigned when you mounted the ISO image for the Exchange Updater.
2. This launches the Exchange updater application. Be patient and give it time to launch. At this point, you should be good to proceed with the update. You can optionally change the argument to /IAcceptExchangeServersLicenseTerms_DiagnosticDataOFF if you do not need diagnostic data.

Post-Update Health Checks¶

After the update(s) are installed, you will likely want to check to ensure things are healthy and operational, validating mail flow in both directions, running Get-Queue to check for backlogged emails, etc.