question

Gary-1162 avatar image
0 Votes"
Gary-1162 asked Gary-1162 edited

MS Exchange 2016 CU23 updated by "KB5014261" shows different build numbers, is it OK or not?

Hello!
I had MS Exchange 2016 Standard CU23.
On premises server. (Not cloud server)
One server with all roles (I don't want to discuss its is good or bad, this is not topic right now...server protected bu cloud anti-spam and antivirus and firewall of course)

Everything was fine.
Version number was:
short format:15.1.2507.6
long format: 15.01.2507.006
I decided update it "Exchange Server 2016 CU23 May22SU"
I downloaded "Security Update For Exchange Server 2016 CU23 (KB5014261)" as "Exchange2016-KB5014261-x64-en.exe"
I run cmd (not Power Shell) with elevated prompt (run cmd as Admin) and put path for "Exchange2016-KB5014261-x64-en.exe", like c:\Exchange2016-KB5014261-x64-en.exe
Everything installed successfully. Update asked me to reboot, I did it.
Then I made this step:
"C:\Program Files\Microsoft\Exchange Server\V15\Bin\Setup.exe" /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareAllDomains

( see: https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2016-and-2019-may-10-2022-kb5014261-cd5ecb59-a0eb-47ef-ae35-f62b13c8b817 )

And this did it again successfully.
All tests works fine. Mail flow OK (internal and external).
I used "HealthChecker.ps1" power shell script... - everything (except small problems) was fine.

NOTE:
15.01.2507.006 <- build number for "Exchange Server 2016 CU23 (2022H1)" withOut "...CU23 May22SU" - before update.
15.01.2507.009 <- build number for "Exchange Server 2016 CU23 (2022H1)" with "...CU23 May22SU" - it means PROPER build number, after update!

Proper Version for
"Security Update For Exchange Server 2016 CU23 (KB5014261)" as "Exchange2016-KB5014261-x64-en.exe"
is: short format: 15.1.2507.9 long format: 15.01.2507.009


But AFTER installed update I have:

In Active Directory server:


DSQUERY.exe * "CN=CompanyDomain,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=CompanyDomain,DC=com" -Scope base -Attr msExchProductId
msExchProductId
15.01.2507.006 <-wrong, old build number

In MS Exchange (one single server with all roles):


"Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion" gives this: "AdminDisplayVersion : Version 15.1 (Build 2507.6)" <-wrong, old build number

GUI (Exchange Control Panel ->Servers ->Servers->Version ) gives me "Version 15.1 ‎(Build 2507.6)‎" <-wrong, old build number

"GCM exsetup |%{$_.Fileversioninfo}" gives this:

ProductVersion FileVersion FileName


15.01.2507.009 15.01.2507.009 C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetup.exe <-correct, new, updated build number!

in registry on Exchange, here:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\442189DC8B9EA5040962A6BED9EC1F1F\Patches\2DBA4A03E20C50240BB449DC957C8F72]
"DisplayName"="Security Update for Exchange Server 2016 Cumulative Update 23 (KB5014261) 15.1.2507.9" <-correct, new, updated build number!

File version checking in explorer gives version: 15.01.2507.009 <-correct, new, updated build number!

So...some version numbers are outdated - ".006"
others - OK, updated, correct - ".009"



My questions are:
1) why it is happened?
2) did I do everything proper? Or I have to be ready for problems?
3) how can I fix this?


P.S.:
I've read a lot of information about similar problems...
Some of people speak - don't worry, It happens, not always proper build version (in case of SU) is set correctly.
Some of them told - perhaps it was not enough rights (of course I did update from account with Domain Admin, Enterprise Admin and max Exchange Admin account!)
Some of them gives advice use ADSIEdit to edit version in AD here: CN=configuration,DC=CompanyDomain,DC=com -> CN=Services ->CN=CompanyDomain->Properties
->msExchProductID = 15.01.2507.006 to correct->15.01.2507.009
of course I can edit it, and DSQUERY.exe will show new edited version.....but I'm not sure this is REALLY solve problem...and this will be CONSISTENT...and in this case "AdminDisplayVersion" still shows wrong old version (I guess AdminDisplayVersion is coded in different place)
Some of them told about Edge Transport wrong version - this is not my case, I have only one exchange server, there are no any dedicated edge servers.

and of course I've read a lot of other information...

office-exchange-server-administration
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KyleXu-MSFT avatar image
0 Votes"
KyleXu-MSFT answered

@IgorNizambiev-1162

This is normal, it isn't the issue for Exchange 2016 CU 23 + May22SU.

The command below only shows the CU version:

 Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

If you want to know the patch version, you need to use the command below:

 Get-Command Exsetup.exe | ForEach {$_.FileVersionInfo}    

Here is the result for Exchange 2016 CU 22
205356-qa-kyle-13-39-06.png

As you tested, Microsoft suggests using the HealthChecker script to check build number. It also could tell use all security hotfix for current CU.


If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AndyDavid avatar image
0 Votes"
AndyDavid answered AndyDavid edited

Whew!

Yea the ADminDisplayVersion can be ignored

https://techcommunity.microsoft.com/t5/exchange-team-blog/dude-where-039-s-my-rollup/ba-p/595028

GCM exsetup |%{$_.Fileversioninfo} is the way to go
or

the HealthChecker ( My preference)
If that shows the correct version, then you are good.


I wouldnt mess with anything or change anything in ADSIEDIT :)

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gary-1162 avatar image
0 Votes"
Gary-1162 answered Gary-1162 commented

This is my info:
205435-exchangeversion-1.jpg



· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Picture

205408-finalstep.jpg


0 Votes 0 ·
finalstep.jpg (77.1 KiB)

Could You give me some additional comments please?
It seems OK?

0 Votes 0 ·
Gary-1162 avatar image
0 Votes"
Gary-1162 answered

205329-exchangeversion-2.jpg



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gary-1162 avatar image
0 Votes"
Gary-1162 answered

205419-exchangeversion-3.jpg



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gary-1162 avatar image
0 Votes"
Gary-1162 answered

205377-exchangeversion-4.jpg



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gary-1162 avatar image
0 Votes"
Gary-1162 answered

205407-exchangeversion-5.jpg



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Gary-1162 avatar image
0 Votes"
Gary-1162 answered KyleXu-MSFT commented

Thank You very much, Guys!
I've posted here information from my Server.
Could You tell me please, is it OK that information in Active Directory outdated too?
(15.01.2507.006 instead of 15.01.2507.009)

Might be this step:
"C:\Program Files\Microsoft\Exchange Server\V15\Bin\Setup.exe" /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareAllDomains
did not do all proper? or something went wrong?

But I definitely read info from Server screen that was OK

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Here doesn't exist issue with your organization.

As I posted above. Some of them only show the CU version (Doesn't mean you don't have the patch installed, I guess they don't need the exact value such as Control Panel) and another show the CU + Security hotfix.

For Exchange admin, if you want to know the correct information to check whether the Security hotfix is installed, you need to use the command below to check it.

 Get-Command Exsetup.exe | ForEach {$_.FileVersionInfo}
0 Votes 0 ·
Gary-1162 avatar image
0 Votes"
Gary-1162 answered Gary-1162 edited

OK!
I understood!
Thank You very much Guys!
And...Perhaps it can be useful for other Exchange Admins!

Thanks a lot!!!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.