CU update install failing with error 1603

Mikayel Mikayelyan 56

Hello all, I am not sure if posting question in right place, but hope someone can help me with this as I didn't found any answer on web.
I am trying to update Exchange 2013 CU9 to CU 23. All prerequisites' are done and fine with that. But When I try to install I am getting this error in the step when coping files are started at 24% it gives this error:
Installing product E:\Exchange 2013-CU23\exchange server.msi failed. Fatal error during installation. Error code is 1603. Last error reported by the MSI package is 'The installer has insufficient privileges to access this directory: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.0.1497. The installation cannot continue. Log on as administrator or contact your system administrator.'

I am using Admin account with all the required access rights. Also I have checked that path shown above and find out there is no 15.0.1497 folder inside auth folder. There is folder 15.0.1104. Also after this all services are disabled and can't run even the CU9 that was working normal. So we are restoring vm from last backup.
Please if you can help me how to update 2013 CU9 to latest version we are planning to migrate to 2016 so need at least CU10.

Thanks in advance.

sarfaraz shaikh 6 Reputation points

2022-03-04T14:07:58.88+00:00

C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.0.1497

Rename the Frontend folder and run the setup file.

Tested its working as expected.
Penny Bristow 6 Reputation points

2023-03-24T03:25:38.2966667+00:00

Just a newbie question I assume you deleted the renamed folder after the successful update correct?
mahir movsumov 0 Reputation points

2023-08-08T13:18:26.9066667+00:00

i solve this problem find setup which exchange are installed mount it and when it ask exchangeserver.msi show that msi

9 answers

DocBrown 21 Reputation points

2021-03-13T15:15:36.5+00:00

CU23 is failing due to modified permissions on the Auth folder. I'm finding this on select 2013 Exchange Servers that have been compromised.

I was able to get the upgrade to run by changing the permissions on the Auth folder and it's contents. First I changed the owner from System to Domain Admin. Then I added permissions for the local and domain admin accounts. Once this was done I was able to successfully install CU23.
Please sign in to rate this answer.

4 people found this answer helpful.
r836 6 Reputation points

2021-03-14T02:26:22.417+00:00

So, permissions are set, but now I run the setup for CU 23 hit next on connect to the internet and check for updates and the wizard disappears like I dont have exchange installed. How were you able to successfully install the CU 23 after you changed the permissions?

Chris Calbreath 21 Reputation points

2021-03-14T02:29:11.78+00:00

Same thing happened to me in one server. Don’t check for updates and it will start. There weren’t any updates available on other servers I have updated anyway.

r836 6 Reputation points

2021-03-14T02:32:17.673+00:00

That is EXACTLY what I needed, you are a blessing!! Thank you I was digging out the image of the server thinking it was going to be a long night.

TStensitzki 11 Reputation points MVP

2021-03-15T13:22:28.773+00:00

Preferably you do not use the wizard, but the unattended install.

Mount the Exchange CU ISO

Open an administrative command prompt

Navigate to the mounted ISO volume and run setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

Ensure that you have updated the schema, AD, and domain(s) prior to installing a new CU.

When you upgrade the first Exchange Server to a new CU, and your admin account is a member of the Schema Admin and Enterprise Admin security groups, the CU might fail, because the FMSO roles are located in a different AD site.

Martinsnw 0 Reputation points

2024-02-23T19:15:04.8166667+00:00

Check your ISO file. You may be using a corrupted ISO file. Download a fresh copy if everything else fails.
Sign in to comment
Chris Calbreath 21 Reputation points

2021-03-13T15:42:07.397+00:00

I just encountered this as well on a compromised server. It looks like inheritance was disabled. I made myself the owner of the folder and then just re-enabled inheritance to allow CU23 install to complete.
Please sign in to rate this answer.

2 people found this answer helpful.
Brad Dale LevcoTech 1 Reputation point

2021-03-14T23:08:59.887+00:00

Just as a heads up,

This current security changes seem only to be affecting CAS Servers.

Our Mailbox Server didn't seem to have the same issues, however if it's a script instead of human that is doing this, our Exchange installation is on D: for the MBX server not C:

Just a thought on this whole mess.

Thanks,
Brad Dale
Sign in to comment
Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-11T03:02:44.487+00:00

Hi @Mikayel Mikayelyan ,

Good day.

Since you're going to upgrade from CU9 to CU23, there is a huge gap of them.
You should install the .Net FrameWork .4.8 to support the CU23.
Also if you want to use the PowerShell to upgrade, you'll have to make your Schema/AD/AD domain prepared, If you use the Setup Wizard, you don't have to do this.

For this issue, you can give a full control permission of the folder to your account or add Everyone to the list and give it Full Control.

A related case that could help: Exchange 2019 CU8 Upgrade failed - insufficient privileges to access \owa\auth\15.2.792

Regards,
Zhengqi Lou

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-16T08:21:55.727+00:00

Hi @Mikayel Mikayelyan ,

Do the suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.

Regards,
Lou

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-24T02:26:55.603+00:00

Hi @Mikayel Mikayelyan ,

It has been a long time since last reply, did these suggestions help you? If the above suggestion helps, please click “Accept as answer” to mark helpful reply as an answer.Your action would be helpful to other users who encounter the same issue and read this thread.

Regards,
Lou

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Sign in to comment
Joshua 6 Reputation points

2021-03-22T16:25:57.48+00:00

I actually resolve the issue after correcting the permissions and mount the iso on the VM datastore NOT just mounting the iso from downloads.

Best,
Please sign in to rate this answer.

1 person found this answer helpful.
Tony Griffith 6 Reputation points

2021-03-24T02:21:05.653+00:00

Yes after changing owner to Domain Admin and enabling inheritance everything installed correctly
Sign in to comment
Brad Dale LevcoTech 1 Reputation point

2021-03-12T01:11:11.607+00:00

I like this answer, but don't like this answer.

What should be the official Security permission on this directory?

I.E. what do I need to change it back to after the CU update, or will the CU update fix the permissions?

Thanks,
Brad Dale
Please sign in to rate this answer.
Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-12T02:25:52.893+00:00

Hi @Brad Dale LevcoTech ,

By default it's full control for System and Local Admins:

When you first trying to open this folder and press Continue, you will get the Full Control Permission for your account(The second user on the photo above).

No, I think it'll not automatically roll back after CU update, so you may have to manually remove Everyone from the list.
Giving your own account a full control permission may also work.

Regards,
Lou

Brad Dale LevcoTech 1 Reputation point

2021-03-12T02:30:13.65+00:00

So if I had permission set to SYSTEM readonly, only, before the patch.

Should I be worried that I have an incursion?

Thanks,
Brad Dale

Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-12T02:41:04.533+00:00

Hi,

I think you don't have to worry about that, as I have checked other version Exchange servers, this folder(and the folders in it) is Read-only by default.

Also you can only give the full permission for those two folders if you don't want to that.
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth

Regards,
Lou

Brad Dale LevcoTech 1 Reputation point

2021-03-12T02:49:35.553+00:00

I am a bit concerned still.

As the Domain has receive multiple report of domains that we don't sent to.

Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-12T02:59:18.457+00:00

Sorry I don't know these reports, do they have error messages or some information?
And please cover your personal information for a security consideration.

Regards,
Lou

Brad Dale LevcoTech 1 Reputation point

2021-03-12T03:02:49.827+00:00

They are Gmail DMARC reports.

From my point of view, they are emails w/o authentication.

Just saying that you might want to look @ mrshmc.com as a possible relay point for Exchange exploitations.

Thanks,

Brad Dale LevcoTech

Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-12T05:16:37.707+00:00

Hi @Brad Dale LevcoTech ,

Are these reports came after you assigned the permission?
I think they are irrelevant with the Folder Permission...

And we grant the full control permission is to solve the update problem, because the Setup program couldn't access the folder.

If you want to ask another question, kindly suggest that if you don't mind, you could post a new thread and our engineers will help you there.
Thanks for your understanding.

Best regards,
Lou

Xzsssss 8,861 Reputation points Microsoft Vendor

2021-03-12T05:18:45.24+00:00

I helped you removed the photos, because it contains your personal website/domain or other information.

Please remember to cover these important things when you're going to post them :)

김광은 1 Reputation point

2022-12-08T15:29:10.8+00:00

authenticated Users - Read & Ex
System - Full
Administrator(or Administrators) - Full

success!!
Sign in to comment