That's the problem. Exchange uses a range of around 2000 ports - some of which get used for other things as well. Microsoft pretty much told me "Don't do it that way. Shut off the firewall when ...

1. Disable Firewall and Antivirus Windows Firewall or third-party antivirus software monitors traffic to prevent unauthorized ...

I upgraded my system manually while I was at home, disconnected from the domain, and the firewall remained off by policy.