What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Installing an out-of-band Exchange Server security update (SU) safely starts with identifying the exact Exchange version, cumulative update (CU), server roles, and topology on every server. Then use the SU and instructions that match that CU, install with elevation, restart as directed, and verify the result. “Out-of-band” describes the emergency timing of a release—not a different universal installation method.
Before you install: identify the servers and the release
Do not choose a package from the vulnerability name alone. The correct SU depends on the Exchange CU installed, and a CU/SU mismatch can stop setup. Microsoft says SUs are released when needed, typically on Patch Tuesday, but emergency releases can occur outside that schedule. SUs apply to supported CUs and are cumulative for the CU they target. Eligibility generally covers the last CU for Exchange in Extended support or the last two CUs in Mainstream support; confirm the current lifecycle and release details rather than relying on older CU examples. See Microsoft’s Exchange Server update FAQ.
As an Amazon Associate I earn from qualifying purchases.
Build an inventory for every Exchange server
- Exchange version, installed CU/build, and current SU/update state.
- Windows Server version and Exchange server roles.
- Whether each server belongs to a database availability group (DAG), and the relevant topology.
- Any release-specific prerequisites, installation instructions, or post-install manual actions.
Microsoft recommends Exchange Health Checker to identify servers that are behind on CUs or SUs or need manual actions. Run it across the environment before planning the change, and use its findings alongside the release-specific instructions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose the matching SU and plan the order
Obtain the update through Microsoft’s Exchange update channel and read the notes for that exact release. Confirm that the package targets the CU installed on the server. Do not substitute another update because it appears to address a similar vulnerability.
#1 Best Overall
Microsoft’s general guidance is to update front-end Exchange Mailbox servers first, followed by back-end servers. That is not a complete DAG runbook: maintenance steps depend on the actual topology and release. Follow the applicable procedure for your environment rather than applying a generic command sequence.
Install with elevation and restart
- Prepare the server using the release-specific instructions. Check its prerequisites and any required maintenance steps before starting setup.
- Open an elevated Command Prompt. Run the update setup from that elevated prompt, using the package and procedure specified for the release. Do not assume a non-elevated launch is sufficient.
- Restart before and after installing the update. Microsoft recommends a restart before installation and another afterward, even if the installer does not request the final restart. Schedule the work with the service order and topology in mind.
Elevation matters when User Account Control (UAC) is enabled. Microsoft documents an OWA/ECP failure that can occur after manually applying an SU without elevation; its recovery guidance is to reinstall the update from an elevated prompt and restart. Check that the guidance applies to your Exchange version before using it: OWA or ECP stops working after an update.
Verify Exchange after the restart
- Run Exchange Health Checker again. Review its output for remaining updates and required manual actions.
- Test Outlook on the web (OWA) and the Exchange admin center (EAC, formerly ECP) as appropriate for your environment.
- Verify mail flow and confirm that relevant Exchange services are running.
- If mail flow is impaired, check whether stopped Exchange services are started and set to automatic, whether the server remains in maintenance mode, and whether the queue database has adequate free space.
Microsoft’s Exchange update FAQ recommends Health Checker for update-status review; its troubleshooting guidance covers failed installations and post-update issues.
If setup fails, troubleshoot the observed error
Start with the exact error and the instructions for the Exchange version and release in use. Microsoft’s failed-update guidance identifies issues such as a CU/SU package mismatch and a pending-restart condition. Resolve the specific cause before retrying; use SetupAssist when the applicable guidance directs you to it. Avoid improvised or destructive repair steps based on a generic checklist.
Check applicability carefully: Microsoft’s retrieved failed-update article identifies Exchange Server Subscription Edition (SE) as its scope, while other troubleshooting articles may cover older versions. Confirm that an article applies to your server before following its steps. See Microsoft’s Exchange update troubleshooting guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What an emergency mitigation does—and does not do
The Exchange Emergency Mitigation (EM) service can apply temporary mitigations for some threats. A mitigation may help protect a server while an administrator prepares the update, but it does not install the fixing SU or replace it. Apply the SU that addresses the vulnerability according to its release instructions. Microsoft explains the distinction in its Exchange Emergency Mitigation service overview.
New-server deployment is a separate case
For a new Exchange server, Microsoft’s deployment overview recommends installing the latest Exchange CU and latest SU before bringing the server online, running updates elevated, and checking status with Health Checker. That general advice does not identify the correct package for an existing server with an unspecified CU; select updates using the server’s actual version and the named release’s instructions. See Microsoft’s update deployment overview.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
