Exchange 2013 CU23 Released

Exchange 2013 CU23 has been released to the Microsoft download centre!  Exchange 2013 has a different servicing strategy than Exchange 2007/2010 and utilises Cumulative Updates (CUs) rather than the Rollup Updates (RU/UR) which were used previously.    CUs are a complete installation of Exchange 2013 and can be used to install a fresh server or to update a previously installed one.  Exchange 2013 SP1 was in effect CU4.

Update 28-4-2021 The main package download is currently broke.  Use this direct link in the interim.

Download Exchange 2013 CU23

This is build 15.00.1497.002 of Exchange 2013 and the update is helpfully named Exchange2013-x64-cu23.exe.  Which is a great improvement over the initial CUs that all had the same file name!  Details for the release are contained in KB 4489622.

Exchange 2007 is no longer supported, updates are not provided once a product has exited out of extended support.

Exchange 2010 will transition out of support on the 14th of January 2020.

Updates Of Particular Note

While Exchange 2013 CU21 was the last planned CU for this version of Exchange, a new CU was required to address issues.

For details please see:

4503028 Description of the security update for Microsoft Exchange Server 2013 and 2010: June 11, 2019

ADV190018 | Microsoft Exchange Server Defense in Depth Update

.NET Framework 4.7.2 Support was added to Exchange 2013 CU21 previously and is now required.

Note that /PrepareAD should be manually executed as part of this installation.

Issues Resolved

In addition to containing the latest DST updates for Exchange 2013, the additional fix below is also listed:

  • 4502131 "TLS negotiation failed with error UnknownCredentials" error after updating TLSCertificateName on Office 365 send connector in Exchange Server 2013 hybrid environment

Some Items For Consideration

As with previous CUs, this one also follows the new servicing paradigm which was previously discussed on the blog.  The CU package can be used to perform a new installation, or to upgrade an existing Exchange Server 2013 installation.  You do not need to install Cumulative Update 4 or 5 for Exchange Server 2013 when you are installing the latest CU.  Cumulative Updates are well, cumulative.  What else can I say…

For customers with a hybrid Exchange deployment, must keep their on-premises Exchange servers updated to the latest update or the one immediately prior ( N or N-1).

After you install this cumulative update package, you cannot uninstall the cumulative update package to revert to an earlier version of Exchange 2013. If you uninstall this cumulative update package, Exchange 2013 is removed from the server.

  • Test the CU in a lab which is representative of your environment

  • Review this post to also factor in AD preparation which is to be done ahead of installing the CU onto the first Exchange server

  • Follow your organisation’s change management process, and factor the approval time into your change request

  • Provide appropriate notifications as per your process.  This may be to IT teams, or to end users.

  • After you install this cumulative update package, you cannot uninstall the cumulative update package to revert to an earlier version of Exchange. If you uninstall this cumulative update package, Exchange is removed from the server.

  • Place the server into SCOM maintenance mode prior to installing, confirm the install then take the server out of maintenance mode

  • Place the server into Exchange maintenance mode prior to installing, confirm the install then take the server out of maintenance mode

  • I personally like to restart prior to installing CUs.  This helps identifies if an issue was due to the CU or happened in this prior restart, and also completes any pending file rename operations.  3rd party AV products are often guilty of this

  • Restart the server after installing the CU

  • Ensure that all the relevant services are running

  • Ensure that event logs are clean, with no errors

  • Ensure that you consult with all 3rd party vendors which exist as part of your messaging environment.  This includes archive, backup, mobility and management services

  • Ensure that you do not forget to install this update on management servers, jump servers/workstations and application servers where the management tools were installed for an application.  FIM and 3rd party user provisioning solutions are examples of the latter

  • Ensure that the Windows PowerShell Script Execution Policy is set to “Unrestricted” on the server being upgraded or installed.  See KB981474

  • Disable file system antivirus prior to installing.  Do this through the appropriate console.  Typically this will be a central admin console, not the local machine

  • Verify file system antivirus is actually disabled

  • Once server has been restarted, re-enable file system antivirus

  • Note that customised configuration files are overwritten on installation.  Make sure you have any changes fully documented!

Please enjoy the update responsibly!

What do I mean by that?  Well, you need to ensure that you are fully informed about the caveats with the CU  and are aware of all of the changes that it will make within your environment.  Additionally you will need to test the CU your lab which is representative of your production environment.



Rhoderick Milne [MSFT]


  1. Question
    Sign in to vote
    Sign in to vote
    A brief summary of this post for other forum members could easily find useful information:

    [Exchange 2013 CU22 and CU23 are failing during prerequisite check - Summary]

    Issue Symptom:

    After installing .net 4.7.2 and trying to run CU22 or CU23 from the elevated command prompt get the following errors:

    The Mailbox server role isn't installed on this computer.
    Global updates need to be made to Active Directory, and this user account isn't a member of the 'Enterprise Admins' group.
    You must be a member of the 'Organization Management' role group or a member of the 'Enterprise Admins' group to continue.
    You must use an account that's a member of the Organization Management role group to install or upgrade the first Mailbox server role in the topology.
    The forest functional level of the current Active Directory forest is not Windows Server 2003 native or later. To install Exchange Server 2013, the forest functional level must be at least Windows Server 2003 native
    Either Active Directory doesn't exist, or it can't be contacted.

    run the following command:
    Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms
    Setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms
    on the domain controller holding FSMO roles, then force the replication to other DCs or wait for the replication to run as scheduled.
    Then run the setup.exe on the Exchange server and the upgrade no longer finds any problems

    Reference Links:


    • Thanks Kani!

      That is not an official site, so I can not comment on the integrity of the downloads.

      The proper link should be fixed now. The PG folks were already working to address this.


Leave a Reply

Your email address will not be published. Required fields are marked *