How To Repair Failed Installations of Exchange Cumulative and Security Updates

To patch the Exchange Servers against known threats and fix bugs and vulnerabilities, Microsoft releases Cumulative and Security updates on a regular basis. These updates also provide new features, security patches, and various other fixes. Usually, the installation of these updates goes smoothly if done with proper planning and process. However, sometimes, you may encounter issues during and post installation of these updates. In this article, we will list some common issues that you may encounter when installing CU and SU and the possible solutions to fix them.

Common Issues and Errors When Installing Exchange Updates and Their Solutions

Below, we have mentioned some common issues that you may encounter when installing Cumulative and Security updates on the Exchange Server, along with their solutions. 

HTTP 400 Errors When Browsing OWA and ECP

After installing the Cumulative Updates (CU), you may notice that both Outlook Web Access (OWA) and Exchange Control Panel (ECP) are not loading, even after entering the right credentials. You may see the following error.

HTTP 400 - bad request 

Cannot serialize context

When you open the Exchange Management Shell (EMS), you would get the following message.

ErrorCode : -2144108477 TransportMessage : The WS-Management service cannot process the request because the XML is invalid. ErrorRecord : Connecting to remote server srv01.exchange.local failed with the following error message : For more information, see the about_Remote_Troubleshooting Help topic.

The issue could occur if you have a user whose name ends with a dollar ($) sign. 

Solution: To resolve this issue, you can rename the username and remove the dollar ($) sign.

Images Are Missing in OWA and ECP

After the updates, you may notice that images in Outlook Web Access (OWA) and Exchange Control Panel (ECP) are not showing. It looks like they are missing from the source. It indicates that something went wrong during the installation of the Cumulative Update. 

Solution: A possible solution is to uninstall the Cumulative Update and re-install it from the command prompt running as Administrator. After that, reboot your server.

Blank Page in All Portals

This is a most common issue on Exchange Server 2016 and 2013. When you open Exchange Control Panel (ECP) or Outlook Web Access (OWA), you may just see a blank page. When you check the event viewer, you will notice that an event with ID 15021 is recorded.

This happens due to some misconfiguration or issues with the SSL bindings on 0.0.0.0 with port 443. The possible causes are misconfiguration, wrong certificate assigned, and incorrect information.

Solution: To resolve the issue, you need to check the SSL certificate and restart the Internet Information Services (IIS). Follow the below steps.

• Open the Internet Information Services (IIS).
• Open Sites, click on DefaultWebSite, and then click on Bindings.
  
  
• Click on the https443 binding and open it. Confirm that the right certificate is assigned and the certificate is still valid and matches the Exchange Server.

• Now, restart the services. For this, open PowerShell and run the following command.

Restart-Service WAS, W3SVC 

Note: If you have a separate server for mailbox services, open the IIS from the server and check the certificate being used in the bindings on the Exchange Back End site. Check for the https 444 binding.

Error During Update Rollup Installation

When installing the update on a server where there is no internet connection, the installation would take a long time to finish. You may also face an error saying:

Creating Native images for .Net assemblies.

This issue is caused when the installation fails to access the below URL:

http://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl 

This is used to access the Certificate Revocation List on the native image generation (Ngen). As the server is not connected to the internet, each request needs to wait for time out before it can continue. This would take a long time and may time out the entire installation and cause issues.

You might also encounter the same issue with the error saying.

Installation cannot continue. The Setup Wizard has determined that this Interim Update is incompatible with the current Microsoft Exchange Server 2013 Cumulative Update 23 configuration.

Solution: In situations where the internet connection is unavailable, you can disable the Check for Publisher’s Certificate Revocation option. For this, open Internet Explorer and go to Tools > Internet Options > Advanced > Security. After the installation is complete, you can re-enable the option.

The other solution is to uninstall the previously installed Interim Update (IU) before installing the Cumulative Update.

Upgrade Patch Can’t Be Installed

You may get the “Upgrade patch cannot be installed” error if you’re installing the incorrect version of the Cumulative Update or Security Update. 

Solution: You can visit Microsoft’s website to check and install the correct update.

Installation Failed Because Services Did Not Stop

During the installation of the update, the setup may fail if the Exchange Services does not stop. This could happen due to the performance of the server, antivirus not having the proper exclusions in place, or any other process hindering the services.

Solution: You can check that the Exchange Servers are set to automatic, rename or remove the C:\ExchangeSetupLogs folder, and restart the installation of the update.

Restart From Previous Installation Is Pending

When running the update, it may fail and display the following error message.

Microsoft Exchange Server setup cannot continue because a restart from a previous installation or update is pending.

This issue may occur if a previous installation failed or was canceled. 

Solution: You can run the HealthChecker script to check the health and detect any issues with the installation or configuration. You can also run the SetupAssist script that can assist in resolving the issue.

No Mail Flow After Update

After installation of the update, you may face a situation where the mail flow stops working. It may happen if,

• The services didn’t start automatically after the update.
• The services fail to start after the update.

Solution: First, you can try to manually start the services. Then, look at the event viewer. There could be underlying issues with the installation that might have corrupted the configuration or the services’ executables. This would have stopped the services from starting.

It is also suggested to check if the server has enough storage to run the services. You can also check that the server is not in maintenance mode and ensure that the services are not set as disabled.

To Conclude

Above, we have mentioned some common issues that you may encounter when installing Cumulative and Security updates on the Exchange Server. In addition, various issues might occur during the installation of the updates, such as:

• Hardware failures
• Sudden loss of power
• Human errors
• Conflict with third-party applications 

These issues may stop the process in the middle of an update, rendering the Exchange Server setup unusable. Since there are multiple points of failure, it is difficult to recover from such situations. In such cases, you can try to re-install the Exchange Server with the recovery mode and then restore the databases. However, if transaction logs or databases are damaged or corrupted, you will not be able to restore the databases.

In such a case, you can use specialized tools like Stellar Repair for Exchange. With this tool, you can scan and repair the corrupt databases (EDB files) from any version of the Exchange Server. After repair, you can granularly export the EDB data directly to a live Exchange Server database with automatic mailbox matching. You can also use the application to export EDB data to Office 365, PST, and other file formats.