question

StephenChallen-5754 avatar image
0 Votes"
StephenChallen-5754 asked ·

Exchange 2019 CU8 Upgrade failed - insufficient privileges to access \owa\auth\15.2.792

We have had an unsual error when upgrading which has stalled after uninstalling and not allowing us to continue.

Error Message
Installing product E:\exchangeserver.msi failed. Fatal error during installation. Error code is 1603. Last error reported by
the MSI package is 'The installer has insufficient privileges to access this directory: C:\Program Files\Microsoft\Exchange
Server\V15\FrontEnd\HttpProxy\owa\auth\15.2.792. The installation cannot continue.


Any ideas to resolve the issue would be much appreciated.

office-exchange-server-deployment
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RobertSalasidis-2467 avatar image
2 Votes"
RobertSalasidis-2467 answered ·

I refined the process on the last DAG member (running with Administrator privilege makes no difference)

I changed ownership of owa and ecp above to administrator

I added added Full Control to the administrator in owa and ecp.

'Everyone' does not exist when doing this before running the CU8

Worked perfectly, exchange comes up live after running the unattended setup above (approximately 20+ minutes runtime)

· 1 ·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

For perfections, can you just confirm that CU8 corrects folder permissions during the upgrade and therefore not need a manual return to the prior state?

0 Votes 0 ·
ZhengqiLou-MSFT avatar image
0 Votes"
ZhengqiLou-MSFT answered ·

Hi @StephenChallen-5754 ,

Good day!

This error is likely because of the Setup wizard can't access this folder.
If you manually open this path, you may receive the warning like this:
75655-image.png
Then you should click Continue to open it.
So the point is to give your account a full permission or install the update in admin mode.

Also you can use the Windows Update to do that:
Check Advanced options and enable to receive Microsoft products updates.
75519-image.png
Then Check for updates, you will see it.

Regards,
Lou


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


image.png (9.8 KiB)
image.png (5.4 KiB)
·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StephenChallen-5754 avatar image
0 Votes"
StephenChallen-5754 answered ·

ZhengqiLou-MSFT, thanks for the reply. Unfortunately due to the nature of Exchange the folder in question can only be accessed via the install utility through IIS and is not accessible by the user and only the system for security reasons. Of course, that said I did try a variety of "administrator" permissions methods but to no avail.

It is not listed as a known issue with the CU8 upgrade and is one of those problems that theoretically doesn't happen, but it did.

·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StephenChallen-5754 avatar image
0 Votes"
StephenChallen-5754 answered ·

For anyone else hitting problems with upgrading to latest CU and having to rebuild/recover exchange, just go ahead and pull off all key data such as Certificates, Exchange Database, etc and follow "recover" procedure:

https://docs.microsoft.com/en-us/exchange/high-availability/disaster-recovery/recover-exchange-servers

· 1 ·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi Stephen,

Very happy to know your issue has been resolved, and really thanks for sharing the steps you have done. This could help others as well.

Have a nice day!

Best regards,
Zhengqi Lou

0 Votes 0 ·
RobertSalasidis-2467 avatar image
3 Votes"
RobertSalasidis-2467 answered ·

I had the same error today - trying to upgrade a DAG (2019x3)

Maybe the error started because I did not perform the initial update attempt by executing the CU8 install file from an elevated administrator shell (even though I am logged in as the administrator)

What worked was, changing the ownership of the auth directories

C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth

to the administrator account, and then setting permissions on that account to full control. I also gave temporary full control to the Everyone account, and verified the SYSTEM account had full control as well.

I executed .\setup.exe /m:upgrade /IAcceptExchangeServerLicenseTerms from a mounted copy of the CU8 ISO file

With the above the Copying files went through OK, and then the rest of the installation proceeded without a hitch

· 7 ·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks Robert. This helped us figure this out tonight for a client.

1 Vote 1 ·

I am usually a consumer of info here, glad I could help for a change.

1 Vote 1 ·

Hi Robert,

This issue usually happens when you don't have the permission of these folders and that's why we suggest users go with Admin mode.

Great thanks for sharing such useful information! Have a nice day XD

Best regards,
Zhengqi Lou

0 Votes 0 ·

RobertSalasidis

That is a really great workaround. I had tried changing folder/file permissions on my system; I avoided changing "ownership" from SYSTEM due to concerns over compromised systems. Can you confirm that the install that worked has returned permissions back to what they should be? Would be great to have confidence that the CU does a thorough job.

Steve

0 Votes 0 ·

The server I did with the second technique above (pre set the permissions before the first install) seems to have restored the permissions to the original SYSTEM on the auth directories. The servers that were reqpaired after the install failed, still have the permissions set to the administrator account.

I will try later tomorrow to set them back to SYSTEM, since the files are read only for the most part, it should not cause any issues I would think.

1 Vote 1 ·

Thanks for checking. I am paranoid with Exchange and security issues and functionality issues of OWA/ECP when the smallest setting is wrong and so just useful for the future record for us to gather as much info on it as possible.

0 Votes 0 ·

How did you change the Access?

If I run "icacls "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth" administrator:F /t"

I get an access denied on that folder (elevated admin CMD)

0 Votes 0 ·
RobertSalasidis-2467 avatar image
0 Votes"
RobertSalasidis-2467 answered ·

You have to Change ownership of the folder via the properties-security tab in file Explorer.

Then add the administrator account to the permissions via the file explorer as well

·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.