0x80070643 during an Exchange CU: setup fails and rolls the server back

Fix it now

0x80070643 is the HRESULT form of Windows Installer return code 1603, which Microsoft publishes as a fatal error during installation. It is generic by design and names nothing. The setup log names the task that failed, and reading it is the entire job.

Get-Command ExSetup.exe | ForEach-Object {$_.FileVersionInfo}
Test-ServiceHealth

1. Open C:\ExchangeSetupLogs\ExchangeSetup.log and search backwards from the end for the first error. The task named immediately before it is what failed.
2. Note which layer it came from. A code in the 0x8013 range belongs to the .NET runtime’s HRESULT constants, which means an Exchange setup task threw rather than the installer failing to copy a file.
3. Check the ordinary blockers before rerunning: a pending reboot, free disk space, third-party transport agents still installed, and prerequisites below the level this build needs.
4. Reboot the server, then rerun from an elevated Command Prompt: Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Mode:Upgrade
5. Let it finish, then reboot again. Microsoft requires a restart after an update so registry and operating system changes can be made.

The older /IAcceptExchangeServerLicenseTerms switch stopped working with the September 2021 cumulative updates. Unattended and scripted installs must use the _DiagnosticDataON or _DiagnosticDataOFF form.

If the log records completion and Test-ServiceHealth is clean, you are done. If setup will not start at all rather than failing partway, that is a different problem with its own fix.

Why it happens

An Exchange update is not one operation. Setup unpacks files, applies installer actions, then runs a long list of configuration tasks that touch Active Directory, the file system, IIS and the services. A failure anywhere in that sequence aborts the run and rolls back what it can. Microsoft publishes 1603 as ERROR_INSTALL_FAILURE, a fatal error occurred during installation, and 0x80070643 is the same number expressed as an HRESULT: 0x8007 is the HRESULT form of a Win32 error and 0x643 is 1603. Neither identifies the task.

A code in the 0x8013 range is more informative. Microsoft documents the .NET runtime’s HRESULT constants as using that prefix, so a value in that range means the failure was raised by managed code – in this context, one of Exchange’s own setup tasks rather than the installer. The setup log records the task name and the exception together, and the exception is usually specific enough to act on.

Two product facts shape what you should do next. Exchange Server 2016 and 2019 went out of support on 14 October 2025, with Extended Security Update enrolment as the only route to further security updates for them. Exchange Server Subscription Edition, released on 1 July 2025, is serviced with Security Updates and Hotfix Updates rather than cumulative updates. So ‘rerun the CU’ applies to a 2016 or 2019 server; on Subscription Edition the package you are retrying is an SU or an HU, launched the same way and just as elevated.

Full reference

The command line, exactly

<drive>:\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Mode:Upgrade [/DomainController:<ServerFQDN>] [/EnableErrorReporting]

Microsoft’s example is E:\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Mode:Upgrade /DomainController:dc01.contoso.com. Use _DiagnosticDataOFF instead if you do not want diagnostic data sent. The switch matters: Microsoft states that the previous /IAcceptExchangeServerLicenseTerms switch does not work from the September 2021 cumulative updates onwards, and unattended or scripted installs must use one of the two newer forms.

Do not roll back a virtual machine snapshot to undo a failed update on a domain-joined Exchange server. Reverting the machine does not revert the Active Directory changes setup already made. Microsoft’s own position on going backwards is blunt: after you upgrade to a newer build you cannot uninstall it to revert, because uninstalling removes Exchange from the server completely.

What each code contributes

Reading the setup log properly

1. Open C:\ExchangeSetupLogs\ExchangeSetup.log and go to the end.
2. Search backwards for the first error entry rather than the first mention of a failure; the rollback that follows generates a lot of noise.
3. Read the task name immediately above it. That is the operation that failed.
4. Read the exception text with it. That is what you search on, and what a support engineer needs.
5. Note the timestamp and compare it with the Application and System logs for the same second, which often names the underlying access denial or service timeout.

Supportability before you spend a night on it

Establish which product you are patching. Exchange Server 2016 and 2019 are out of support; customers enrolled in the Extended Security Update programme continue to receive security updates for them, and everyone else is expected to move to Exchange Server Subscription Edition. Subscription Edition released on 1 July 2025 and is serviced by Security Updates and Hotfix Updates rather than cumulative updates, which changes what ‘the current update’ means and what a rerun will do.

Before the next attempt

• Reboot first and reboot after. Microsoft asks for both, and half the failures in this family are pending-reboot state.
• Run from the console with an elevated Command Prompt, not a remote session that can drop.
• Take the server out of service properly if it is a DAG member, so a failover during setup does not add a second incident.
• Keep the media that matches the build you are resuming. Changing build partway through is the fastest way to make this considerably worse.

Every code this article covers

Confirm the fix worked

1. The end of C:\ExchangeSetupLogs\ExchangeSetup.log records a successful completion rather than a rollback.
2. Get-Command ExSetup.exe | ForEach-Object {$_.FileVersionInfo} reports the build you intended, checked against Microsoft’s build number reference.
3. Test-ServiceHealth reports every required service running after the post-update reboot.
4. Mail flows in and out, and both the management shell and the admin centre open.

Questions people ask about this