Unable to install security update KB5007012 in exchange server 2019 CU 11

Benard Mwanza 996 Reputation points
2021-11-26T17:36:08.777+00:00

I'm unable to install KB5007012 security update in exchange server 2019 CU 11.

The account that I'm using to install the update is member of enterprise, domain, schema and organisation management role groups. I'm running the security update .msp file in command prompt as administrator, tried three times rebooted the server, even used a different account with the same required permissions but still the same error.

Attached is the ambiguous error. How can i resolve this, Urgent tip will highly be appreciated.

152950-securityupdateissue.png

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,359 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,896 questions
0 comments
Accepted answer
  1. Andy David - MVP 142.3K Reputation points MVP
    2021-11-29T13:57:11.053+00:00

    Do you have any GPOs that sets Powershell access ?

    https://www.collaborationpro.com/exchange-2010-rollup-error-upon-launching/

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yuki Sun-MSFT 40,871 Reputation points
    2021-11-29T02:33:46.603+00:00

    Hi @Benard Mwanza ,

    I noticed that you've also added the tag "office-exchange-hybrid-itpro", so are you in a hybrid environment with both Exchange Online and Exchange 2019?
    Is KB5007012 the one and only security update that failed to be installed? Have you tried directly patching the Nov SU KB5007409?
    If there's a second Exchange server 2019 in your environment, would you try installing the security update on the other machine and see how it goes?

    Besides, according to the discussion in this thread which mentions about a similar error, please make sure the following services are automatic and running:

    • Windows Management Instrumentation
    • Net.Tcp Port Sharing Service

    If the above doesn't help, I'd suggest trying to install the update through Microsoft Update and see if it works.

    Should the error still persists, please have a look at the Exchange Setup log which is by default available at <system drive>:\ExchangeSetupLogs\ExchangeSetup.log to see if there would be any clues for further investigation. You may remove all the sensitive information involved and share part of the log file here.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

  2. Amit Singh 4,846 Reputation points
    2021-11-30T08:49:27.71+00:00

    You need to enable CredSSP JUST FOR THE DURATION OF THE UPDATE so that credentials can be refreshed.

    The GPO settings for this are in three places: 

    Computer Config > Policies > Admin Templates > Windows Components > WIndows Remote Management > WinRM Client > Allow CredSSP (Enabled)    
Computer Config > Policies > Admin Templates > Windows Components > WIndows Remote Management > WinRM Service > Allow CredSSP (Enabled)    
Computer Config > Policies > Admin Templates > System > Credentials Delegation > Allow delegating fresh credentials - Needs to be enabled and configured with WSMAN/*.<fqdn>

    Also, test setting certificates for the winRM service. You can check the config by typing winrm get winrm/config/service. Change "get" to "set" to make changes in there.

    Please mark as "Accept the answer" if the above steps helps you. Your suggestion will help others also !

    0 comments