New Exchange Policy Requires More Frequent Patching

The update release policy for Exchange Server is changing from a rollup update (RU) model to a Cumulative Update (CU) model with Exchange 2013. CUs will be delivered quarterly, and the first CU is expected to arrive in the first quarter of 2013. Security updates will be delivered separately from CUs. The new update model may deliver more predictable updates and keep the on-premises Exchange product in better synchronization with the Microsoft-hosted Exchange Online service, but organizations will have a smaller time window to apply the latest update in order to receive product support from Microsoft.

Rollup Update Model Discontinued with Exchange 2013

The RU model began with Exchange 2007 when Microsoft announced it would bundle all customer-driven hotfixes into RUs rather than require customers to locate, research, and apply each hotfix separately between service packs (SPs). The delivery goal for RUs was originally every six to eight weeks, but RUs for Exchange 2010 have arrived about every 10 weeks on average with some taking up to 16 weeks to arrive after the previous RU. Problems with Exchange 2010 SP1 RU7 required two additional releases of that RU. RUs are cumulative, and they must be applied to an existing Exchange installation since they do not contain the full product image. RUs contain mostly product fixes, but they can also contain feature enhancements (for example, Exchange 2007 SP3 RU10 brings the capability of coexistence with Exchange 2013). RUs will continue for Exchange 2007 and 2010, but Exchange will transition to the CU model with Exchange 2013.