20220423: Added TLS 1.3 note.

The Exchange Team released the quarterly half-yearly Cumulative Updates for Exchange Server 2019 and Exchange 2016. You read that right, half-yearly updates are replacing the cadence of quarterly update servicing model for Exchange Server. Effectively, this will be Exchange 2019 only, as Exchange 2016 will be out of mainstream support in H2 of 2022, and will therefor only receive Security Updates after this round. Note that this change also alters the effective ‘current’ state (n-1 or later) of your Exchange Server environment from half year to one year.

And that’s not the only good news that comes with these sets of updates. In short:

• If you run Exchange 2019 in Hybrid only for the purpose of managing recipients, you can now use Exchange 2019 CU12’s Exchange Management Tools to accomplish this; no more need to have an Exchange server running just for this. More details here.
• Exchange 2019 CU12 will reintroduce the Hybrid Key option. Its Hybrid Configuration Wizard supports this licensing method.
• Exchange 2019 CU12 support managing the Hybrid Agent with MFA-enabled accounts.
• Exchange 2019 CU12 adds support for Windows Server 2022, both for its underlying operating system, as well as deployment in environments running Windows Server 2022 Domain Controllers.
• Note that while Windows Server 2022 supports TLS 1.3, Exchange 2019 CU12 on WS2022 does not yet support it. Adding support is scheduled for somewhere next year.
• The supportability matrix has been updated for the supported Windows Server 2022 scenarios.
• Exchange Server is now also part of Microsoft’s Bounty Program, which is an indication of continued focus for customers still running Exchange Servers on-premises.

Links to the updates as well as a description of changes and fixes are described below. The column Schema and AD indicate if the CU contains Schema (/PrepareSchema) and Active Directory (PrepareAD) changes compared to the previous CU. Refer to the Exchange Schema page for schema and related versioning information.

Apart from DST changes and the fixes mentioned below, these Cumulative Updates also contain a change which will not allow using UNC paths with several cmdlets. More information about this change and cmdlets affected can be found here: KB5014278.

Exchange 2019 CU12 fixes:

• 5012757 “Migration user… can’t be found” error when using Start-MigrationUser after batch migration fails
• 5012758 Start-MailboxAssistant is not available in Exchange Server 2019
• 5012760 You can’t access OWA or ECP after installing the July 2021 security update
• 5012761 External attendees see “Send the Response Now” although no response was requested in Exchange Server
• 5012762 PST creation is unexpectedly triggered again during multiple mailbox export
• 5012765 Email stuck in queue starting from “2022/1/1 00:01:00 UTC+0” on all Exchange on-premises servers
• 5012766 Transport Services fail repeatedly because of * Accepted Domain
• 5012768 Start-MigrationUser and Stop-MigrationUser are unavailable for on-premises Exchange Server 2019 and 2016
• 5012769 Invalid New Auth Certificate for servers that are not on UTC time zone
• 5012770 No response from public folder for users migrating to Microsoft Exchange 2019
• 5012772 Items are skipped at the start of a new search page request
• 5012773 OWAMailboxPolicy is bypassed and high resolution profile images can be uploaded
• 5012774 Can’t change default path for Trace log data in Exchange Server 2019 and 2016
• 5012775 No additional global catalog column in the address book service logs
• 5012776 Exchange Server 2019 help link in OWA redirects users to online help for Exchange Server 2016
• 5012777 Can’t find forwarded messages that contain attachments in Exchange Server 2019
• 5012778 Exchange Server stops responding when processing PDF files with set transport rule
• 5012779 Invalid new auth certificate for servers that are not on UTC time zone
• 5012780 Disable-Mailbox does not remove LegacyExchangeDN attribute from on-premises Exchange 2019
• 5012781 Exchange Server 2019 and 2016 DLP doesn’t detect Chinese resident ID card numbers
• 5012782 MS ExchangeDiagnostic Service causes errors during service startup and initialization in Microsoft Exchange 2019
• 5012783 Can’t restore data of a mailbox when LegacyDN is empty in the database
• 5012784 Exchange 2016 CU21 and Exchange 2019 CU10 cannot save “Custom Attributes” changes in EAC
• 5012785 Read Only Domain Controllers (RODCs) in other domains do not get desired permissions
• 5012786 Forwarded meeting appointments are blocked or considered spam
• 5012787 Download domains created per CVE-2021-1730 don’t support ADFS authentication in OWA
• 5012789 Can’t use Copy Search Results after eDiscovery & Hold search
• 5012790 OWA doesn’t remove the “loading” image when a message is opened in Chrome and Edge browsers
• 5012791 MailboxAuditLog doesn’t work in localized (non-English) environments

Exchange 2016 CU23 fixes:

• 5012757 “Migration user… can’t be found” error when using Start-MigrationUser after batch migration fails
• 5012760 You can’t access OWA or ECP after installing the July 2021 security update
• 5012761 External attendees see “Send the Response Now” although no response was requested in Exchange Server
• 5012765 Email stuck in queue starting from “2022/1/1 00:01:00 UTC+0” on all Exchange on-premises servers
• 5012768 Start-MigrationUser and Stop-MigrationUser are unavailable for on-premises Exchange Server 2019 and 2016
• 5012769 Invalid New Auth Certificate for servers that are not on UTC time zone
• 5012774 Can’t change default path for Trace log data in Exchange Server 2019 and 2016
• 5012779 Invalid new auth certificate for servers that are not on UTC time zone
• 5012780 Disable-Mailbox does not remove LegacyExchangeDN attribute from on-premises Exchange 2019
• 5012781 Exchange Server 2019 and 2016 DLP doesn’t detect Chinese resident ID card numbers
• 5012782 MS ExchangeDiagnostic Service causes errors during service startup and initialization in Microsoft Exchange 2019
• 5012783 Can’t restore data of a mailbox when LegacyDN is empty in the database
• 5012784 Exchange 2016 CU21 and Exchange 2019 CU10 cannot save “Custom Attributes” changes in EAC
• 5012786 Forwarded meeting appointments are blocked or considered spam
• 5012787 Download domains created per CVE-2021-1730 don’t support ADFS authentication in OWA
• 5012789 Can’t use Copy Search Results after eDiscovery & Hold search
• 5012791 MailboxAuditLog doesn’t work in localized (non-English) environments
• 5012829 Group metrics generation fails in multidomain environment

Notes:

• If these Cumulative Updates contain schema changes compared to the Cumulative Update you currently have deployed, you need to run Setup with /PrepareSchema. If they contain Active Directory changes, you need to run /PrepareAD. Alternatively, permissions permitting, you can let Setup perform this step. Consult the Exchange schema versions page for schema and related versioning information.
• When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
• Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
• When using Exchange hybrid deployments or Exchange Online Archiving (EOA), support requires you to trail at most one version (n-1).
• If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
• Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
• Once upgraded, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
• The recommended upgrade order is internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.