Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsVerify an Exchange update in layers: match the server’s build and detected security hotfix to Microsoft’s build table, review setup logs, check required services, then test mailbox logon and the Outlook path. Test OWA/ECP and mail flow separately when those are part of the reported problem; a successful update check alone does not prove users can connect.
1. Identify the update the server should have
Before checking the result, note the target server, Exchange generation, installed cumulative update (CU), and the exact security update (SU) or hotfix update (HU) you applied. Compare the server with Microsoft’s Exchange Server build numbers and release dates. That table changes as updates ship, so use it to confirm the applicable target rather than relying on an old build number copied into a checklist.
As an Amazon Associate I earn from qualifying purchases.
A CU-level version match does not establish that an SU or HU is installed. Microsoft’s Software updates status view in the Microsoft 365 admin center is not a definitive per-server check: the documentation describes it as a preview, and its Exchange tab does not list specific servers that are behind on builds.
Recommended Free Tools
2. Confirm the installed build and security update
In Exchange Management Shell, get the server’s CU-level version with:
#1 Best Overall
Get-ExchangeServer -Identity <server> | Format-List Name,Edition,AdminDisplayVersionReplace <server> with the Exchange server identity. AdminDisplayVersion is useful for checking the CU build, but Microsoft notes that it does not show whether an SU or HU is installed.
For a more complete update check, run Microsoft’s HealthChecker script and inspect the report’s Build Number and Exchange IU or Security Hotfix Detected fields. Microsoft also documents checking the file version of ExSetup.exe. Use the build table to interpret the reported version and hotfix; do not treat a CU match by itself as confirmation of the security update.
3. Review installation evidence and required services
Inspect Exchange setup and Windows logs
Review <system drive>:ExchangeSetupLogsExchangeSetup.log, the default Exchange Setup log path documented by Microsoft. It records readiness checks, installation progress, and configuration changes. Search for errors, then read the surrounding entries to understand when and where the failure occurred. Also inspect the Windows Application log for related setup events. See Microsoft’s Exchange installation verification guidance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check services for the server’s configured roles
Run this in Exchange Management Shell:
Test-ServiceHealth -Server <server>The cmdlet checks whether services required by the server’s configured Exchange roles are running. Microsoft describes its result this way: “The Test-ServiceHealth cmdlet returns an error for any service required by a configured role when the service is set to start automatically and isn’t currently running.” Investigate each named service and its role rather than assuming a correct build means the server is ready. Microsoft documents an important limitation: Test-ServiceHealth is unsupported on Exchange 2013 Client Access servers because the output can be unexpected. See Microsoft’s Test-ServiceHealth documentation.
4. Prove mailbox access and the Outlook connection path
Test mailbox-level access with MAPI
Use Test-MAPIConnectivity to test a specific mailbox:
Test-MAPIConnectivity -Identity <mailbox>Alternatively, use the cmdlet’s database or server parameter set to test the relevant system mailbox or active databases. Microsoft describes the test as logging on, retrieving Inbox items, and exercising MAPI- and LDAP-related authentication and mailbox/database operations. It provides direct mailbox/database evidence, not proof that an external client can connect. See Microsoft’s Test-MAPIConnectivity documentation.
Use a deep Outlook probe for user-facing connectivity
Run a suitable Test-OutlookConnectivity deep probe for the Outlook protocol used in your deployment, such as MAPI over HTTP or Outlook Anywhere. A self-test checks whether an endpoint can receive traffic; it does not log in to a mailbox. A deep probe attempts a mailbox connection and logon, so it is the more relevant check when users report that Outlook cannot access mail. Make sure the probe’s protocol, identity, and mailbox/database selection match the environment. See Microsoft’s Test-OutlookConnectivity documentation.
5. Check OWA, ECP, and mail delivery as separate symptoms
Test web access directly if OWA or ECP is affected
If users report that Outlook on the web (OWA) or the Exchange admin center (ECP) fails, test those URLs directly after the update. A working MAPI test does not establish that either web surface works. Microsoft documents a failure case in which a security update installed without elevation on a server with User Account Control enabled leaves files or configuration inconsistent. Follow the version-specific repair instructions only after confirming the matching symptoms; example paths in Microsoft’s procedure assume a particular Exchange installation layout and may need to be adapted to the server’s actual version and installation directory. See Microsoft’s OWA/ECP update troubleshooting guidance.
Test message delivery separately
Test-Mailflow checks delivery between Exchange system mailboxes; it does not prove that a user can sign in. If the reported issue concerns mail between Microsoft 365 and on-premises Exchange, also validate the configured connector route using Microsoft’s Exchange Online connector validation process. Neither delivery check replaces a user mailbox logon test. See Microsoft’s Test-Mailflow documentation.
Quick Recap
What each check proves
| Check | Evidence it provides | What it does not prove by itself |
|---|---|---|
HealthChecker build report or ExSetup.exe version |
Installed build; HealthChecker can also detect an interim update or security hotfix. | That a user can sign in or receive mail. Microsoft build guidance |
Get-ExchangeServer AdminDisplayVersion |
Exchange CU-level version. | Whether an SU or HU is installed. Microsoft build guidance |
| Exchange Setup and Windows Application logs | Setup actions, progress, and recorded errors. | Current client connectivity. Microsoft installation verification |
Test-ServiceHealth |
Whether required services for configured roles are running. | Mailbox access or a successful client path. Microsoft cmdlet documentation |
Test-MAPIConnectivity |
Mailbox/database access using MAPI-related authentication. | External Outlook or web access. Microsoft cmdlet documentation |
Deep Test-OutlookConnectivity probe |
Outlook protocol path and mailbox logon. | Delivery through every external connector. Microsoft cmdlet documentation |
Test-Mailflow or connector validation |
Internal system-mailbox delivery or delivery on the configured connector route. | User-facing mailbox sign-in. Test-Mailflow; connector validation |
Trace a failure to the layer that failed
- Build matches, but a service check fails: investigate the required service identified by
Test-ServiceHealthand the server role that requires it. - Services pass, but MAPI fails: investigate mailbox/database access and the authentication or directory dependency exercised by the test.
- MAPI passes, but Outlook fails: use a deep probe for the deployed Outlook protocol and verify the selected probe mailbox/database.
- OWA or ECP fails after a manually installed SU: check whether the update was installed elevated and whether the reported file or configuration symptoms match Microsoft’s documented case before using its repair steps.
- Mailbox logon succeeds, but messages do not arrive: run a separate mail-flow check and validate the configured connector route when applicable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
