Exchange 2019 - CU12 requires a domain prep
When running Exchange updates, whether it is Exchange 2013, Exchange 2016 or Exchange 2019, I always prepare the Schema and AD before updating, however with some Cumulative Updates (CU) in the past have not required it, however the latest CU for Exchange 2019 does.
If you are running Exchange 2019 with AD Split permissions, you will need to run the PrepareAD or PrepareDomain or PrepareAllDomains command first, either from the domain controller directory or from the Exchange 2019 server if you have the AD tools installed.
In the example below, in my lab I did not run the command as I let the setup do this for me (Organization Preparation)
This takes about a min, depending on your server setup.
Once done, the unattended setup completed without error and after a reboot, I was able to apply the security update for Exchange 2019 CU12.