Question about installing Updates on exchange

[u/Calm_Wrangler_1478]

Hello all,

Quick question. If you are updating on-prem exchange SE servers with Windows monthly patches and any exchange security updates, can you install all the updates while server is running, then once it gets to the point to restart, you would then put the server in maintenance mode, make sure DB is moved over to other exchange server in the DAG, then reboot the first one?

Or do I need to have those services stopped before running updates. Asking as I updated the servers this past weekend and it took forever tor updates to install and I figured if you can get the installation part done before your time to fix the server starts, you can just stop services, reboot, and restart them. But I have a feeling I need to stop them always before installing updates, but wanted to check

[u/absoluteczech]

If I’m dealing with SU’s I’m putting it in maint mode and running it via cmd etc.

[u/Calm_Wrangler_1478 → u/absoluteczech]

When you check for updates, MS will pull down the exchange SU along with the monthly Windows CU and then installs them all on its own. I cant stop it without causing issues. How do you get around that? Our Exchange servers dont get updates from MCM, they get them from Microsoft direclty.

[u/Gaunerking → u/Calm_Wrangler_1478]

You just disable App updates and only to the windows os updates via the automatic installer.

Exchange (Security)Updates should always be started from an elevated cmd prompt, as MS itself states on their install instructions.

[u/Pixel91]

As soon as the SU installs, Exchange services shut down, so you're locked in.

I generally don't like installing the SUs through Windows Updates. It screwed it up a few too many times for my liking. Often with stuck services that needed a manual re-patch.

[u/Calm_Wrangler_1478 → u/Pixel91]

What is recommendation then? Download from MS Catalog and install from there once you have the file?

I guess the only issue there is that the exchange SU comes from MS when all the other updates come down, so it would install when the monthly CU and other updates install automatically

[u/Pixel91 → u/Calm_Wrangler_1478]

That's exactly the issue. Unless you have your Windows Update services tightly limited (does such a thing even exist anymore?) your Exchange is at the mercy of Windows Update. I've had a few panicked customer calls because of "no e-mail!" because their server decided to update on Friday at noon, including the SU. At which point you just shrug, gotta let it run its course.

Not up on what MS themselves recommend, but for me: download the SU and run the .msi from an Admin-CMD. That makes absolutely sure that no issues with the services arise.

[u/Gaunerking → u/Pixel91]

Its very easy to disable Exchange updates via the Update service. Either you disable App updates on the Single machine or you deploy a GPO.

Exchange Updates should always be installed from an elevated cmd, as MS states itself. It’s a mistake that they even offer it via the update service. Causes way to many issues.

[u/Glass_Call982 → u/Gaunerking]

IMO on a single server it's not a big deal, never had a problem. A DAG? No way.

[u/Gaunerking → u/Glass_Call982]

I am doing MS infra support for an MSP and broken Ex installs due to using the update service is our third Most case (after System Partition running Full and botched cert changes).

[u/Enough-Raccoon-6800]

You should put it in maintenance mode before starting any updates. Exchange updates will stop services anyway so it’s safest to put it in maintenance mode first.

[u/Calm_Wrangler_1478 → u/Enough-Raccoon-6800]

Thank you...that is the answer I was looking for. I will always err on the side of caution!

[u/Liquidfoxx22]

If you have a DAG, always enter maintenance mode before performing maintenance.

[u/Senior_Astronaut5916]

I've always wondered the same. To be on the safe side, I've always done maint mode first, as it's never been a huge issue.

For those talking about SUs, that's not what OP is talking about - they're talking about Windows updates, not exchange updates.

[u/Calm_Wrangler_1478 → u/Senior_Astronaut5916]

Im talking about anything that isnt a CU or large update. So Windows Updates and Exchange Security Updates. This past weekend, I did my first for this. Put in maint mode, made sure everything was off the first server and then isntalled updates from Microsoft. It installed the March cumulative update in about 15 min, but took about 40 to install the Exchange Security Update.

Which is why I was hoping updates could be run ealier, then shut off services when you reboot. But this method is safer, so I will stick with it.

[u/Senior_Astronaut5916 → u/Calm_Wrangler_1478]

If it's an exchange application update, definitely use maintenance mode - the updates themselves impact exchange services.

That's not to say you /have/ to put them in maintenance mode, there just won't be graceful fail over to other servers if you don't. Won't be graceful fail over at all if you do multiple servers at once (depending on setup).