skip to Main Content

May 2022 Exchange Server Security Updates

Microsoft released several Security Updates (SUs) for Microsoft Exchange Server to address vulnerabilities. Due to the critical nature of these vulnerabilities, we recommend that customers apply the updates to affected systems immediately to protect the environment.

Note: These vulnerabilities affect Microsoft Exchange Server. Exchange Online is not affected.

Exchange Server Security Updates

Microsoft has released Security Updates for vulnerabilities found in:

  • Exchange Server 2013
  • Exchange Server 2016
  • Exchange Server 2019

These Security Updates are available for the following specific versions of Exchange:

Read more on how to Install Exchange Security Update.

If you are not at these Exchange Server CU versions, please update right now and apply the above patch.

Read more on how to Install Exchange Cumulative Update.

Vulnerabilities addressed in the May 2022 Security Updates were responsibly reported by security partners and found through Microsoft’s internal processes. Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment.

Manual run of /PrepareAllDomains is required

Because of additional security hardening work for CVE-2022-21978, the following actions should be taken after installing the May 2022 security updates:

Latest version of Exchange Server installed in the organizationAdditional steps needed
Exchange Server 2019 CU11 or CU12Install the May 2022 SU first and then run the following Command Prompt command once using Setup.exe in your Exchange Server installation path (e.g., …\Program Files\Microsoft\Exchange Server\v15\Bin):

Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAllDomains

or

Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareDomain
Exchange Server 2016 CU22 or CU23Install the May 2022 SU first and then run the following Command Prompt command once using Setup.exe in your Exchange Server installation path (e.g., …\Program Files\Microsoft\Exchange Server\v15\Bin):

Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAllDomains

or

Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareDomain
Exchange Server 2013 CU23Install the May 2022 SU first and then run the following Command Prompt command once using Setup.exe in your Exchange Server installation path (e.g., …\Program Files\Microsoft\Exchange Server\v15\Bin):

Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareAllDomains

or

Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareDomain
Any older version of Exchange Server not listed aboveUpdate your Exchange server to the latest CU, install May 2022 SU, and follow the above steps.

You need to run /PrepareAllDomains or /PrepareDomain only once per organization, and those changes will apply to all versions of Exchange Server within the organization.

When you run /PrepareAllDomains or /PrepareDomain, your account needs to be a member of the Enterprise Admins security group. This might be a different account from the one you use to install the SU.

Note: If you’ve just added yourself to the Enterprise Admins security group, you’ll need to log out and back into the server for the new group membership to take effect.

FAQs

My organization is in Hybrid mode with Exchange Online. Do I need to do anything?
While Exchange Online customers are already protected, the May 2022 security updates do need to be applied to your on-premises Exchange Servers, even if they are used only for management purposes. You do not need to re-run the Hybrid Configuration Wizard (HCW) after applying updates.

Do I need to install the updates on “Exchange Management Tools only” workstations?
Servers or workstations running only Microsoft Exchange Management Tools (no Exchange services) do not need to apply these updates.

Instructions seem to indicate that we should /PrepareAllDomains or /PrepareDomain after May 2022 SU is installed; is that correct?
Yes. The May 2022 SU package updates files in Exchange server folders when it is installed. That is why once those files are updated (SU is installed) – we ask you to go and explicitly /PrepareAllDomains or /PrepareDomain using setup from \v15\Bin folder.

In our organization we never ran /PrepareAllDomains. We only prepared several of our domains. Do we still need to run /PrepareAllDomains to address CVE-2022-21978?
If your organization has prepared only a subset of all your Active Directory domains, then you can choose to use the /PrepareDomain switch in those specific domains only.

Does the /PrepareAllDomains or /PrepareDomain have to be done after ALL our Exchange Servers have been updated, or can it be done immediately after the first has been updated?
You can run the /PrepareAllDomains or /PrepareDomain as soon as any one of your Exchange servers is updated with May 2022 SUs. You do not need to wait until all Exchange servers are updated.

We have different Exchange Server versions in our organization running. Do we need to run the /PrepareAllDomains or /PrepareDomain on both the Exchange Server versions?
Just run it once after installing the SU for the latest version.

Further information

ALI TAJRAN

ALI TAJRAN

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

This Post Has 5 Comments

  1. Hi Ali! Thanks for your posts, I always enjoy reading them! Are you planning to conduct exchange training on youtube channel?

    1. Hi Stanislav,

      Glad that you enjoy the articles.

      I thought about it, and I know that videos are excellent. The disadvantage is that the tech changes every time, and it’s time-consuming to edit the videos.

      By providing the articles, it’s easier to update them and have them up to date with the latest tech changes. Also, it’s easier for the readers to read the commands and copy them when you have them in an article instead of a video.

      I will keep it in mind, and I might create and upload tech videos in the future.

  2. Hi ali ,
    we have upgraded our exchange server 2019 from CU 9 to Cu12 every thing working fine except to Exchange admin center ,it become is so slowly, once press any tab its stating “please wait” .is it known issue in this CU ?

    1. This is not an issue in the May 2022 Exchange Server Security Updates. But, this starts to happen after you install the May 2022 Security Updates for Windows Server on the Domain Controllers.

      Microsoft released out-of-band updates for affected Windows Server versions. Download the update for your Windows Servers below and install it on your Domain Controllers.

      Cumulative Updates:

      KB5015013: Windows Server 2022
      ​KB5015020: Windows Server Version 20H2
      KB5015018: ​Windows Server 2019
      KB5015019: ​Windows Server 2016

      Standalone Updates:

      KB5014986: ​Windows Server 2012 R2
      ​KB5014991: Windows Server 2012
      KB5014987: ​Windows Server 2008 R2 SP1
      ​KB5014990: Windows Server 2008 SP2

Leave a Reply

Your email address will not be published.