The way that Exchange 2007 updates are delivered differs from the way that earlier versions of Exchange are serviced. The new service method offers many advantages over earlier methods. Before you install an Exchange 2007 service pack or update rollup, we recommend that you review the Exchange 2007 Servicing topic. This topic contains more information about the updates that are included in a service pack or update rollup, and the methodology behind the Exchange update process.

Additionally, verify that your account has the appropriate permissions to install a service pack or update rollup. When you install an update rollup, the account that you use must be a member of the Local Administrators group and have permission to read Active Directory on the Exchange object. The account must also have server-level permissions. This is because the update program must determine which server roles are installed on the server. If the account does not have the required permissions, Outlook Web Access may not be updated correctly.

Note:

Applying service packs and update rollups to clustered Mailbox servers requires specific planning and application steps. For more information about how to apply service packs to Exchange 2007 clustered Mailbox servers, see Upgrading Clustered Mailbox Servers to Exchange 2007 SP1 or SP2. For more information about how to apply update rollups to Exchange 2007 clustered Mailbox servers, see Applying Exchange 2007 Update Rollups to Clustered Mailbox Servers.

You can use the following list as a pre-deployment checklist to help you deploy an Exchange 2007 service pack or update rollup:

1. Determine the service pack level of Exchange.
   
   Update rollups are service pack dependent. For example, an Update Rollup 5 package is available for Exchange 2007 and for Exchange 2007 Service Pack 1. To determine the service pack level of Exchange, examine the ExchangeVersion property. For more information about how to view the ExchangeVersion property and about the build number that is associated with each Exchange version, see Exchange Server 2007: Platforms, Editions, and Versions.
   
   
2. Determine which update rollup packages are installed on the computer.
   
   Installed update rollup packages appear in the Add or Remove Programs dialog box in Control Panel. To see the list of installed updates on Windows Server 2003, you must click to select the Show updates check box. On Windows Server 2008, you must click View installed updates. Update rollup packages appear as "Update Rollup N for Exchange Server 2007 KBNNNNNN." You can use this information to help determine whether any update rollup packages are installed on the computer.
   
   
3. Determine whether any interim updates are installed on the computer.
   
   The Exchange 2007 servicing strategy allows for out-of-band fixes for certain Exchange issues. These fixes are known as interim updates. The issue or issues that an interim update resolves may be fixed in a later update rollup package. Before you install an update rollup package or a service pack, you must remove any interim updates from the computer. Interim updates appear in the Add or Remove Programs dialog box in Control Panel. These updates appear as "Interim Update for Exchange Server 2007 KBNNNNNN."
   
   

   Note:
   You can remove the interim updates on a per-computer basis. You do not have to remove all the interim updates from all the computers in the organization before you install an update rollup or a service pack.

4. Locate addressed interim updates.
   
   Examine any interim updates to determine whether they are addressed in the update rollup or service pack that you plan to install. To do this, examine the Microsoft Knowledge Base article that corresponds to the interim update.
   
   
   • If the Knowledge Base article mentions that the issue is resolved in the update rollup package or service pack that you plan to install or in an earlier update rollup package or service pack, you can remove the interim update and then install the update rollup or service pack without the risk of experiencing the particular issue that the interim update resolves. In this scenario, you do not have to obtain a replacement interim update.
     
     
   • If the Knowledge Base article does not mention that the issue is resolved in the update rollup package or service pack that you plan to install, you must obtain a replacement interim update from Microsoft Customer Support Services (CSS). In this scenario, you must remove the interim update, install the particular update rollup package or service pack, and then install an interim update that is appropriate for the update rollup or service pack level of the computer.
     
     

   Important:

   Interim updates are created for a particular Exchange build. Therefore, an interim update that is suitable for Exchange 2007 Update Rollup 5 is not suitable for Exchange 2007 SP1 Update Rollup 6. You must contact CSS to obtain an interim update that is appropriate for the particular Exchange build that you are running. If the issue that the interim update resolves is fixed in the particular update rollup or service pack that you install, you do not have to obtain and install a replacement interim update.

5. Obtain the latest update rollup package.
   
   For information about how to obtain the latest update rollup package that is available for the intended service pack level of the Exchange system, see How to Obtain the Latest Service Pack or Update Rollup for Exchange 2007. After you install a service pack, you should install the appropriate update rollup for that service pack. For example, if you are running Exchange 2007 with Update Rollup 5, and you install Exchange 2007 SP1, we recommend that you obtain the latest update rollup package for Exchange 2007 SP1.
   
   

   Note:
   Although you could install the same update rollup package level as was installed on the earlier Exchange build, we strongly recommend that you install the latest update rollup package that is available for the service pack level of Exchange. This step makes sure that you benefit from the latest fixes for Exchange 2007.

6. Verify that the common language runtime (CLR) supports the generatePublisherEvidence setting.
   
   When you install an update rollup package on a computer that is running a Microsoft .NET Framework build that does not support the generatePublisherEvidence setting, certain Exchange services may not start. If you are running the .NET Framework 2.0, install one of the following software updates:
   
   
   • .NET Framework 2.0 Service Pack 1
     
     For more information, see Microsoft Knowledge Base article 945757, Problems that are fixed in the .NET Framework 2.0 Service Pack 1.
     
     
   • Software update 936707 with CRL build 2.0.50727.876
     
     For more information, see Microsoft Knowledge Base article 936707, FIX: A .NET Framework 2.0 managed application that has an Authenticode signature takes longer than usual to start.
     
     
   • Software update 942027 with CRL build 2.0.50727.926
     
     For more information, see Microsoft Knowledge Base article 942027, FIX: You may notice that the memory load is very high when you run an application that is built on the .NET Framework 2.0.
     
     

The following sections contain important items to consider before you deploy an update rollup package or service pack in an organization.

When Exchange cannot connect to the Internet

When you install an update rollup package or a service pack, Exchange tries to connect to the certificate revocation list (CRL) Web site.

If Exchange cannot connect to the CRL Web site, you may experience the following symptoms:

• The installation takes a long time to complete.
  
  
• You receive the following message during the installation:
  
  

  Creating native images for .Net assemblies.

This issue occurs because Exchange tries to examine the CRL to verify the code signing certificate each time that Exchange compiles an assembly into managed code. When Exchange is not connected to the Internet, each CRL request must time out before the installation can continue.

To work around this issue and to reduce installation times, turn off the Check for publisher’s certificate revocation option on the server that is being upgraded. To do this, follow these steps.

Note:
The Check for publisher's certificate revocation option is set on a per-account basis.

1. Start Internet Explorer.
   
   
2. On the Tools menu, click Internet Options.
   
   
3. Click the Advanced tab, and then locate the Security section.
   
   
4. Click to clear the Check for publisher’s certificate revocation check box, and then click OK.
   
   
5. After the update rollup installation is complete, turn on the Check for publisher’s certificate revocation option.
   
   

For more information, see Microsoft Knowledge Base article 971445, Generating NGEN images takes longer than expected.

Outlook Web Access Customizations

CAS-CAS Proxying

Slipstream Update Rollup Installations

Using RPC Proxy Settings Other Than the Default Settings

General Backup Recommendations

Service Outage Considerations

The following sections contain information about how to deploy an Exchange 2007 service pack or an update rollup.

Where to Apply

Order in Which to Apply to Servers

How to Apply

To remove an Exchange 2007 update rollup package that is installed on Windows Server 2003, open Add or Remove Programs in Control Panel, and then select the appropriate Knowledge Base number for removal.

To remove an Exchange 2007 update rollup package that is installed on Windows Server 2008, open Installed Updates in Control Panel, and then select the appropriate Knowledge Base article for removal.

To support coexistence with Microsoft Exchange 2010, Exchange 2007 SP2 creates the Exchange Trusted Subsystem (ETS) security group in the Microsoft Exchange Security Groups organization unit during Active Directory preparation setup. This group is then added to the Exchange 2007 server’s local administrators group during the installation of the SP2 binaries.

The ETS is a highly-privileged universal security group (USG) that has read and write access to every Exchange-related object in the Exchange organization. In Exchange 2010, all Remote PowerShell actions are run under the context of a Client Access server, which is a member of the ETS group. This means that for any action that acts against a local server resource, such as enumerating the IIS virtual directories, the ETS group needs sufficient rights to view or manipulate those local resources, depending on the action.