Upgrade Exchange Server to the Latest CU: A Friendly, Battle-Tested Guide

By
TechnologyHQ
-

If you’re running Exchange Server 2016 or 2019 and haven’t kept up with updates, 2025 is the year to fix that. Microsoft’s latest cumulative update (CU15 for Exchange Server 2019) is the final CU for the on-premises version before transitioning to the new Exchange Server Subscription Edition (SE).

This guide walks you through how to upgrade Exchange Server 2019 to CU15 2025 step by step, covering preparation, installation, validation, and troubleshooting. It’s written in plain language for busy admins who just want a reliable, copy-paste process that works.

We’ll also discuss best practices, post-upgrade verification, and common pitfalls — so you can complete your upgrade smoothly and stay compliant, secure, and ready for what comes next.

Why You Should Upgrade Now

If your Exchange environment hasn’t seen a major update in years, you’re likely missing critical performance, security, and compatibility fixes. Microsoft’s 2025 CU (CU15) rolls up everything released so far, including fixes for security vulnerabilities, hybrid integration improvements, and new TLS enhancements.

Here’s why upgrading now matters:

  • Security: Only the latest CU receives security updates. Older builds are unsupported.

  • Compatibility: Hybrid deployments and Outlook clients depend on current Exchange builds.

  • Stability: Each CU consolidates all previous fixes, simplifying long-term maintenance.

  • Future readiness: It’s the foundation for migrating to Exchange SE or Microsoft 365.

In short: upgrading to the latest CU means fewer headaches, better performance, and peace of mind.

Understanding CUs and SUs

Before we jump into commands and setup steps, let’s clarify what these updates mean:

  • CU (Cumulative Update): A full build of Exchange that includes all previous updates. You can skip directly to the latest CU — no need to install old ones first.

  • SU (Security Update): A smaller patch released after a CU to fix specific vulnerabilities. You apply the latest SU after installing the CU.

So, if you’re installing CU15, you’ll first install CU15 itself, then the most recent SU that applies to CU15.

Quick Prerequisite Checklist

Here’s a fast readiness checklist before you begin your upgrade. Check every box before starting:

  1. Backups are complete (system state, Exchange volumes, databases, and logs).

  2. Disk space: At least 25–30 GB free on the system drive.

  3. OS and .NET are supported: Verify your Windows Server and .NET versions match what Exchange CU15 requires.

  4. AD and Schema: Active Directory must be healthy and properly replicated.

  5. Exchange HealthChecker run: Run Microsoft’s HealthChecker.ps1 script to find configuration or security issues.

  6. Antivirus exclusions set: Temporarily disable or exclude Exchange paths during setup.

  7. Certificates exported: Backup SSL certificates with private keys.

  8. Maintenance window approved: Expect downtime or limited service during the upgrade.

  9. CU15 and latest SU downloaded: Get the CU15 ISO and the most recent SU installer.

  10. Load balancer / DAG plan ready: If you’re running a DAG, patch one server at a time.

Step 1: Check Your Current Exchange Version

Open the Exchange Management Shell and run:

Get-ExchangeServer | ft Name,Edition,AdminDisplayVersion -Auto

This tells you the build number you’re currently running. Make sure it’s ready for upgrade — you can jump directly to CU15 from any previous CU.

Step 2: Prepare the Environment

1. Run the Health Checker Script

Download and run the HealthChecker.ps1 script from Microsoft’s Exchange GitHub repository. It checks for missing updates, misconfigurations, and prerequisites.

Example:

Set-ExecutionPolicy Bypass -Scope Process -Force
iwr https://aka.ms/ExchangeHealthChecker -OutFile .\HealthChecker.ps1
.\HealthChecker.ps1 -BuildHtmlServersReport

Review the generated HTML report and fix any warnings or errors before continuing.

2. Update Windows and .NET

Install the latest Windows updates and .NET Framework that your target CU supports. A mismatch here is one of the most common upgrade blockers.

3. Verify Active Directory Health

Run the following to confirm replication and schema status:

repadmin /replsummary
dcdiag /q

Fix any replication or DNS issues before running schema updates.

4. Disable Real-Time Antivirus Scanning

Turn off real-time scanning or exclude Exchange directories during installation to avoid locked files or corrupted installs.

Step 3: Put the Server in Maintenance Mode

If your Exchange Server is part of a DAG or load-balanced pool, put it into maintenance mode before starting the upgrade.

Set-ServerComponentState -Identity $env:COMPUTERNAME -Component ServerWideOffline -State Inactive -Requester Maintenance
Set-MailboxServer $env:COMPUTERNAME -DatabaseCopyActivationDisabledAndMoveNow $true
Suspend-ClusterNode $env:COMPUTERNAME

Confirm no active databases are mounted:

Get-MailboxDatabaseCopyStatus -Server $env:COMPUTERNAME | ? {$_.Status -eq "Mounted"}

Step 4: Prepare Active Directory Schema (if needed)

Some CUs include schema updates. If required, run these commands once in your forest (on the schema master):

.\Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF
.\Setup.exe /PrepareAD /OrganizationName:"YourOrganizationName" /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF

Wait for AD replication to complete before upgrading the servers.

Step 5: Install the Latest CU (CU15 for 2025)

Mount or extract the CU15 ISO. From an elevated PowerShell window in that directory, run:

.\Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF

The setup process will:

  • Stop Exchange services

  • Upgrade files and configurations

  • Re-register components

  • Restart required services

Depending on hardware and environment, this may take 30–90 minutes per server.

Once setup completes successfully, reboot the server.

Step 6: Apply the Latest Security Update (SU)

After installing CU15 and rebooting, install the most recent Security Update that applies to CU15. This ensures your system is fully protected against known vulnerabilities.

Reboot again once the SU installation completes.

Step 7: Bring the Server Back Online

After rebooting, exit maintenance mode and allow Exchange to resume normal operation:

Resume-ClusterNode $env:COMPUTERNAME
Set-MailboxServer $env:COMPUTERNAME -DatabaseCopyActivationDisabledAndMoveNow $false
Set-ServerComponentState -Identity $env:COMPUTERNAME -Component ServerWideOffline -State Active -Requester Maintenance

Re-enable antivirus protection or real-time scanning now that the installation is complete.

Step 8: Post-Upgrade Validation

Don’t skip validation. Confirm your environment is healthy before moving to the next server or marking the upgrade complete.

1. Run HealthChecker Again

Re-run the HealthChecker script to confirm there are no new issues, missing updates, or security gaps.

2. Verify Exchange Build Number

Run:

Get-ExchangeServer | ft Name,Edition,AdminDisplayVersion -Auto

Check that your version number matches CU15 and the current SU build.

3. Check Exchange Services

Get-Service *Exchange* | ? {$_.Status -ne "Running"} | ft Name,Status

All core Exchange services should show as Running.

4. Test Mail Flow

Test-Mailflow

Confirm messages send and receive normally.

5. Verify Client Access

Test Outlook, OWA, ECP, and mobile clients. Sign in to confirm successful connections.

6. Check DAG Health (if applicable)

Get-MailboxDatabaseCopyStatus *
Test-ReplicationHealth

All copies should be healthy and synchronized.

Step 9: Repeat for Other Servers (if DAG or multi-server)

For multi-server or DAG environments, upgrade one server at a time using the same process. Allow replication to settle between servers to prevent database activation or failover issues.

Step 10: Document and Close Out

Once all servers are upgraded and tested:

  • Update your internal documentation and change records.

  • Record the final build version, CU, and SU installed.

  • Take a new backup after confirming everything is stable.

  • Monitor the environment for 24–48 hours for any anomalies.

Common Issues and Fixes

1. Setup Fails with “Prerequisites Not Met”
Make sure all Windows features required by Exchange are installed. Recheck your OS and .NET versions.

2. “Setup Cannot Continue” During Schema Prep
Ensure you’re running the command on a domain controller with the correct permissions and that replication is healthy.

3. OWA or ECP Won’t Load After Upgrade
Restart IIS or recycle the application pools:

iisreset /stop
iisreset /start

4. Databases Won’t Mount
Confirm that the server is not still in maintenance mode and that Active Directory replication has completed.

5. Outlook Keeps Asking for Credentials
Recheck your Autodiscover and EWS virtual directory URLs and SSL bindings.

6. Antivirus Blocking Setup
If Exchange setup logs mention locked files, disable real-time AV temporarily and re-run setup.

Post-Upgrade Security Practices

After every CU installation, always apply the latest Security Update. Microsoft releases SUs separately from CUs to address newly discovered vulnerabilities.

Also, consider:

  • Enabling automatic Windows Updates for OS security patches.

  • Regularly running HealthChecker to catch drift and configuration changes.

  • Monitoring the Exchange Team Blog for future security announcements.

  • Reviewing TLS and cipher suite configurations annually.

Keeping your server fully patched is the single most effective way to protect against Exchange exploits.

Future Planning: Exchange SE and Beyond

With Exchange 2019 CU15 being the final CU, organizations will soon move toward Exchange Server Subscription Edition (SE) or Microsoft 365.

Here’s how to prepare:

  1. Stay current — only servers on CU15 + latest SU will be supported for transition.

  2. Evaluate licensing — Exchange SE will use a subscription-based model.

  3. Review hardware — older systems might not meet new OS requirements.

  4. Plan migration — Hybrid and Microsoft 365 migration paths are simplest from the latest CU.

The bottom line: getting your on-prem Exchange up to CU15 keeps you in compliance and future-ready.

Long-Tail Keyword Strategy

For SEO optimization, the best-performing long-tail keyword for this topic is:

“how to upgrade exchange server 2019 to cu15 2025 step by step”

This phrase hits several SEO sweet spots:

  • It’s specific and time-relevant (2025).

  • It captures action intent (how to upgrade).

  • It targets the exact product/version (Exchange Server 2019 CU15).

  • It includes user intent wording (step by step).

Sprinkle variations throughout the article naturally, like:

  • “Exchange Server 2019 CU15 installation guide”

  • “Exchange 2019 cumulative update 2025 process”

  • “Exchange Server CU15 step-by-step tutorial”

Use it in:

  • The H1 title (already optimized)

  • The intro paragraph

  • A few H2 subheadings

  • The meta description

Quick FAQ Section (optional for rich snippets)

Q: Do I need to install older CUs before CU15?
No, Exchange CUs are cumulative. You can upgrade directly to CU15.

Q: Should I run /PrepareSchema for CU15?
Yes, if the CU includes schema updates. Always check release notes and run it once per forest.

Q: What if my environment is hybrid with Microsoft 365?
Upgrade on-prem to the latest CU before running the Hybrid Configuration Wizard.

Q: How long will Exchange 2019 be supported?
Exchange 2019 reaches end of support in October 2025, with limited Extended Security Updates (ESUs) available afterward.

Final Step-by-Step Summary Checklist

Use this list to confirm your upgrade is done right:

  • Backups verified

  • HealthChecker run (pre-upgrade)

  • OS, .NET, and AD prerequisites confirmed

  • Maintenance window approved

  • Antivirus disabled or paths excluded

  • Server placed in maintenance mode

  • AD schema prepared (if required)

  • CU15 installed successfully

  • Server rebooted

  • Latest SU installed and rebooted again

  • Server removed from maintenance mode

  • HealthChecker run (post-upgrade)

  • Services verified and mail flow tested

  • DAG replication and database health confirmed

  • Documentation updated and final backup taken

Conclusion

Upgrading an outdated Exchange Server might sound intimidating, but with the right plan and patience, it’s straightforward. Following this step-by-step guide to upgrade Exchange Server 2019 to CU15 in 2025 ensures your environment is secure, stable, and ready for the future.

By staying current with cumulative and security updates, you protect your organization’s communication backbone and make future migrations — whether to Exchange SE or Microsoft 365 — far smoother.

Take your time, follow each step carefully, and you’ll have your Exchange environment fully upgraded and future-proofed in no time.

RELATED ARTICLESMORE FROM AUTHOR