From 9f59613afa23a85556d60db5f6e3fa16bbf3e2dd Mon Sep 17 00:00:00 2001 From: Nicole Rappe Date: Mon, 16 Dec 2024 03:27:09 -0700 Subject: [PATCH] Update Servers/Microsoft Exchange/Preparing for Cumulative Updates.md --- ...iderations.md => Preparing for Cumulative Updates.md} | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) rename Servers/Microsoft Exchange/{Upgrading Considerations.md => Preparing for Cumulative Updates.md} (91%) diff --git a/Servers/Microsoft Exchange/Upgrading Considerations.md b/Servers/Microsoft Exchange/Preparing for Cumulative Updates.md similarity index 91% rename from Servers/Microsoft Exchange/Upgrading Considerations.md rename to Servers/Microsoft Exchange/Preparing for Cumulative Updates.md index c170f0e..aa87adf 100644 --- a/Servers/Microsoft Exchange/Upgrading Considerations.md +++ b/Servers/Microsoft Exchange/Preparing for Cumulative Updates.md @@ -1,5 +1,5 @@ **Purpose**: -This document is meant to be an abstract guide on what to do before upgrading Microsoft Exchange Server (2013/2016/2019). There are a few considerations that need to be made ahead of time. +This document is meant to be an abstract guide on what to do before installing Cumulative Updates on Microsoft Exchange Server. There are a few considerations that need to be made ahead of time. This list was put together through shere brute-force while troubleshooting an update issue for a server on 12/16/2024. !!! abstract "Overview" We are looking to add an administrative user to several domain security groups, adjust local security policy to put them into the "Manage Auditing and Security Logs" security policy, and run the setup.exe included on the Cumulative Update ISO images within a `SeSecurityPrivilege` operational context. @@ -19,12 +19,15 @@ It's recommended to reboot the server after making this change to be triple-sure !!! note "Security Policy Only Required on Exchange Server" While the `Enterprise Admins`, `Schema Admins`, and `Organization Management` security group memberships are required on a domain-wide level, the security policy membership for "Manage Auditing and Security Logs" mentioned above is only required on the Exchange Server itself. You can create a group policy that only targets the Exchange Server to add this, or you can make your user a domain-wide member of "Manage Auditing and Security Logs" (Optional). If no existing policies are in-place affecting the Exchange server, you can just use `secpol.msc` to manually add your user to this security policy for the duration of the upgrade/update (or leave it there for future updates). -## Running Exchange Updater within `SeSecurityPrivilege` Operational Context +## Running Updater within `SeSecurityPrivilege` Operational Context At this point, you would technically be ready to invoke `setup.exe` on the Cumulative Update ISO image to launch the upgrade process, but we are going to go the extra mile to manually "Enable" the `SeSecurityPrivilege` within a Powershell session, then use that same session to invoke the `setup.exe` so the updater runs within that context. This is not really necessary, but something I added as a "hail mary" to make the upgrade successful. -### Open Powershell ISE (As Administrator) +### Open Powershell ISE The first thing we are going to do, is open the Powershell ISE so we can copy/paste the following powershell script, this script will explicitely enable `SeSecurityPrivilege` for anyone who holds that privilege within the powershell session. +!!! warning "Run Powershell ISE as Administrator" + In order for everything to work correctly, the ISE has to be launched by right-clicking "Run as Administrator", otherwise it is guarenteed that the updater application will fail at some point. + ```powershell title="SeSecurityPrivilege Enablement Script" # Create a Privilege Adjustment $definition = @"