Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTo assess an on-premises Exchange Server, identify its exact version and build, confirm its support and update eligibility, compare it with Microsoft’s current build information, install the applicable update, and verify the result with Exchange Server Health Checker. A server working normally—or one protected by a temporary mitigation—is not necessarily patched. The steps below apply to Exchange Server deployments, not Microsoft 365-hosted Exchange Online.
How can you tell whether an Exchange Server needs attention?
Start with each server, not just a vulnerability headline or an organization-wide dashboard. Update applicability depends on the Exchange version, installed cumulative update (CU), security update (SU) state, support status, and—in some cases—ESU eligibility. Practical exposure also depends on the configuration and network environment; the version alone cannot establish whether a particular organization is exposed.
As an Amazon Associate I earn from qualifying purchases.
- Inventory every Exchange server. Record the product version and exact build, server role, installed CU and SU, and whether the server is still in support or covered by an applicable Extended Security Update (ESU). Microsoft recommends Exchange Server Health Checker to identify servers behind on CUs, SUs, or required manual actions. See Microsoft’s Exchange Server update FAQ.
- Check current Microsoft build and release information. Compare each server’s exact build with the applicable release and update details in Exchange Server build numbers and release dates and Updates for Exchange Server. Do not infer applicability from a CVE headline or a server’s apparent functionality.
- Assess the environment as well as the build. Public internet reachability, enabled features, proxy or hybrid architecture, and existing mitigations can affect practical risk. Microsoft’s update guidance does not diagnose an unknown organization’s configuration; assess those details against the relevant security guidance.
What the Microsoft 365 admin center can—and cannot—show
When available, the Software updates (Preview) page can provide an organization-level view of Exchange servers needing CUs or SUs and those marked out of support. Microsoft describes the page as preview documentation, so its availability may be limited or change. Its Exchange tab does not identify which individual servers are one or more builds behind; use a per-server inventory and build comparison for that. See Microsoft’s Exchange Server update-status documentation.
Why update Exchange if it is working normally?
Normal mail flow and a functioning administrative interface do not show that an Exchange server has the latest security fixes. Microsoft recommends keeping on-premises Exchange current and applying available SUs. It also cautions that vulnerabilities of lower severity can be combined into an attack chain, so judging urgency only by visible symptoms or a single issue’s severity can miss broader risk. Check the applicable release information rather than waiting for a problem to appear.
#1 Best Overall
What is the difference between a CU, SU, hotfix, and mitigation?
Microsoft describes three Exchange update types: CUs, SUs, and hotfix updates (HUs). A mitigation is a separate, temporary protective measure—not an Exchange code update.
| Item | Purpose | What to check |
|---|---|---|
| Cumulative Update (CU) | A cumulative Exchange update issued on a regular release cadence. | Confirm the supported version and CU path for the server. Use Microsoft’s current build information and release notes rather than assuming a generic calendar or upgrade path. |
| Security Update (SU) | A security fix released as needed for security issues. | Confirm that the SU applies to the server’s version and installed CU, and that the server is eligible to receive it. |
| Hotfix Update (HU) | An update for a feature issue when a fix is needed sooner than the next CU. | Check Microsoft’s release information to determine whether a particular HU applies. |
| Emergency mitigation | A temporary protective measure for a known threat; it does not fix the vulnerable code. | Check whether the mitigation is present and functioning, but do not treat it as a replacement for the applicable SU. |
Microsoft’s update-type descriptions and best practices are in its Exchange Server update FAQ. Applicability depends on product support and the installed CU, so follow the release-specific instructions.
Do mitigations mean the vulnerability is fixed?
No. Microsoft states: “Mitigations are a temporary form of protection that should be used until the actual code fix is released.” An Exchange Emergency Mitigation (EM) service can apply measures for known threats, including IIS URL Rewrite rules, Exchange service mitigations, and app-pool mitigations. The optional service checks the Office Config Service for available mitigations and validates signed mitigation configuration before applying them. Microsoft explicitly says the service does not replace Exchange SUs.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Administrators can review mitigation state using the Exchange PowerShell Get-ExchangeServer command’s MitigationsApplied property and Microsoft’s Get-Mitigations.ps1 script, which can show applied, blocked, or failed mitigations. A successful mitigation check is evidence about mitigation state, not proof that vulnerable code has been fixed. See Microsoft’s EM service documentation for prerequisites and instructions. The documented Test-MitigationServiceConnectivity.ps1 check must be run on a Mailbox server, not a Management Tools-only server. The service requires outbound connectivity to officeclient.microsoft.com on port 443 and certificate-validation dependencies; confirm Microsoft’s current requirements before changing firewall, proxy, or inspection settings.
How should you apply updates in a live Exchange environment?
- Confirm the supported update path. Use the server’s version, build, installed CU, support status, and any ESU eligibility to identify the applicable update. Follow its Microsoft release notes and prerequisites; do not assume that every SU applies to every Exchange build.
- Plan the maintenance and recovery path. Review the topology, dependencies, backups, and any organization-specific change controls before installation. For high-availability deployments, Microsoft’s FAQ discusses Database Availability Groups (DAGs) and Maintenance mode for a graceful update process. Validate the procedure against the current topology and Microsoft instructions rather than applying a generic sequence to every DAG.
- Install the applicable update and account for Windows. Microsoft advises readiness to apply emergency updates across on-premises products, including Windows. Keep the underlying Windows Server operating system updated as well.
- Use a planned maintenance window where needed. A 24×7 business should use its high-availability and maintenance procedures to manage service continuity; that does not remove the need to schedule, apply, and verify updates. Follow the current Microsoft procedure for the specific environment.
What should you verify after installing an SU?
- Run Exchange Server Health Checker after the SU. Microsoft recommends it to identify whether servers remain behind on updates or need manual follow-up actions.
- Review the Health Checker output and complete any listed actions; installing the SU alone may not finish every required remediation.
- Confirm the server’s resulting build against Microsoft’s build and release information, and verify relevant Windows Server updates.
- If EM mitigations are in use, inspect their state separately. A mitigation report and an Exchange build check answer different questions.
Also assess whether Windows Extended Protection (EP) is appropriate for the environment. EP helps mitigate authentication relay and man-in-the-middle attacks using channel-binding information, including Channel Binding Tokens in TLS connections. Prerequisites and compatibility caveats matter: Microsoft documents Public Folder hierarchy constraints for certain older CUs, and says Exchange Server 2019 CU14 and later enables EP by default. Older configurations may require Microsoft’s management script and careful prerequisite review. Do not enable EP blindly; follow the version-specific guidance in Microsoft’s Extended Protection documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if the server is Exchange Server 2016 or 2019?
Microsoft’s build and release information states that Exchange Server 2016 and Exchange Server 2019 are out of support. According to that information, customers enrolled in the ESU program are eligible for December 2025 and later SUs for those versions; customers outside ESU are directed to Exchange Server Subscription Edition (SE). Because lifecycle and entitlement details can change, verify the current status and the organization’s eligibility directly on Microsoft’s build numbers and release dates page before choosing a patch or migration path.
What should you do if an update causes a problem?
Match the symptom and exact error to Microsoft’s procedure in Fix Failed Exchange Server Updates. For example, Microsoft documents an HTTP 500 issue in Outlook on the web or ECP after a security update that can result from a missing assembly; the documented resolution is to reinstall the SU from an elevated command prompt and restart the server. That is a remedy for the documented symptom, not a general repair for every failed update. Preserve the exact error and build details, then follow the matching troubleshooting steps rather than repeating that fix indiscriminately.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
