Exchange Server 2016 cumulative update

Question

Hi All

I am using Exchange Server 2016 CU19 hybrid environment, I have 3 mailbox servers in the DAG. i want to update to Exchange 2016 CU21.
Should i update to Exchange Server 2016 CU21 Jul21SU or Exchange Server 2016 CU21, what the difference.
https://learn.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019

Does 2016 CU21 require any schema updates.

lets say i have 3 mailbox servers in DAG
server01.company.com
server02.company.com
server03.company.com

will the below steps help me update on server01 so that i can perform one after the other.
please validate all the steps, on 4th step when i am on server01, i will give server02, when i do on server02 i will give server03, when i do on server03 i will give server01 is this right approach.

1.Set-ServerComponentState server01.company.com -Component HubTransport -State Draining -Requester Maintenance  
  
2.Restart-Service MSExchangeTransport  
  
3. go the path where i can see StartDagServerMaintenance.ps1 cd C:\Program Files\Microsoft\Exchange Server\V15\  
   .\StartDagServerMaintenance.ps1 -ServerName server01.company.com -MoveComment Maintenance -PauseClusterNode  
  
4. Redirect-Message -Server server01.company.com -Target server02.company.com  
  
5. Set-ServerComponentState server01.company.com -Component ServerWideOffline -State Inactive -Requester Maintenance  
  
6. install the update  
   .\setup.exe /m:upgrade /IAcceptExchangeServerLicenseTerms   
   
7.  Set-ServerComponentState server01.company.com -Component ServerWideOffline -State Active -Requester Maintenance  
  
8.go the path where i can see StopDagServerMaintenance.ps1 cd C:\Program Files\Microsoft\Exchange Server\V15\  
   .\StopDagServerMaintenance.ps1 -ServerName server01.company.com  
  
9. Set-ServerComponentState server01.company.com -Component HubTransport -State Active -Requester Maintenance  
  
10. Restart-Service MSExchangeTransport      
  
After all these steps how do i check the server is healthy and no issues.  
  

Answer 1

Yes CU21 requires schema updates.
RUN EACH UPDATE FROM AN ELEVATED PROMPT

You apply CU21 to each server: (
https://support.microsoft.com/en-us/topic/cumulative-update-21-for-exchange-server-2016-kb5003611-b7ba1656-abba-4a0b-9be9-dac45095d969

THEN you apply the July security update from an elevated prompt:
https://techcommunity.microsoft.com/t5/exchange-team-blog/released-july-2021-exchange-server-security-updates/ba-p/2523421

Pay special attention to the known issues before running the Security Update:

Run the healthchecker on each server to ensure the OAuth cert is valid and exists.
https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/

Your steps look correct.

After you are done:

Run the health checker again
test-servicehealth
get-servercomponentstate <server>
get-queue
test-replicationhealth
get-mailboxdatabasecopystatus

If you encounter any issues:
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/exchange-security-update-issues