question

MikayelMikayelyan-1400 avatar image
1 Vote"
MikayelMikayelyan-1400 asked sarfarazshaikh-7374 commented

CU update install failing with error 1603

Hello all, I am not sure if posting question in right place, but hope someone can help me with this as I didn't found any answer on web.
I am trying to update Exchange 2013 CU9 to CU 23. All prerequisites' are done and fine with that. But When I try to install I am getting this error in the step when coping files are started at 24% it gives this error:
Installing product E:\Exchange 2013-CU23\exchange server.msi failed. Fatal error during installation. Error code is 1603. Last error reported by the MSI package is 'The installer has insufficient privileges to access this directory: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.0.1497. The installation cannot continue. Log on as administrator or contact your system administrator.'

I am using Admin account with all the required access rights. Also I have checked that path shown above and find out there is no 15.0.1497 folder inside auth folder. There is folder 15.0.1104. Also after this all services are disabled and can't run even the CU9 that was working normal. So we are restoring vm from last backup.
Please if you can help me how to update 2013 CU9 to latest version we are planning to migrate to 2016 so need at least CU10.

Thanks in advance.

office-exchange-server-administration
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.0.1497

Rename the Frontend folder and run the setup file.

Tested its working as expected.

1 Vote 1 ·
ZhengqiLou-MSFT avatar image
1 Vote"
ZhengqiLou-MSFT answered ZhengqiLou-MSFT commented

Hi @MikayelMikayelyan-1400 ,

Good day.

Since you're going to upgrade from CU9 to CU23, there is a huge gap of them.
You should install the .Net FrameWork .4.8 to support the CU23.
Also if you want to use the PowerShell to upgrade, you'll have to make your Schema/AD/AD domain prepared, If you use the Setup Wizard, you don't have to do this.

For this issue, you can give a full control permission of the folder to your account or add Everyone to the list and give it Full Control.

A related case that could help: Exchange 2019 CU8 Upgrade failed - insufficient privileges to access \owa\auth\15.2.792

Regards,
Zhengqi Lou


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @MikayelMikayelyan-1400 ,

Do the suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.

Regards,
Lou


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 Votes 0 ·

Hi @MikayelMikayelyan-1400 ,

It has been a long time since last reply, did these suggestions help you? If the above suggestion helps, please click “Accept as answer” to mark helpful reply as an answer.Your action would be helpful to other users who encounter the same issue and read this thread.

Regards,
Lou


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 Votes 0 ·
BradDaleLevcoTech-9227 avatar image
0 Votes"
BradDaleLevcoTech-9227 answered ZhengqiLou-MSFT commented

I like this answer, but don't like this answer.

What should be the official Security permission on this directory?

I.E. what do I need to change it back to after the CU update, or will the CU update fix the permissions?

Thanks,
Brad Dale

· 8
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @BradDaleLevcoTech-9227 ,

By default it's full control for System and Local Admins:
76958-image.png
When you first trying to open this folder and press Continue, you will get the Full Control Permission for your account(The second user on the photo above).
76976-image.png


No, I think it'll not automatically roll back after CU update, so you may have to manually remove Everyone from the list.
Giving your own account a full control permission may also work.

Regards,
Lou

0 Votes 0 ·
image.png (25.9 KiB)
image.png (9.8 KiB)

So if I had permission set to SYSTEM readonly, only, before the patch.

Should I be worried that I have an incursion?

Thanks,
Brad Dale

0 Votes 0 ·

Hi,

I think you don't have to worry about that, as I have checked other version Exchange servers, this folder(and the folders in it) is Read-only by default.

Also you can only give the full permission for those two folders if you don't want to that.
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth

Regards,
Lou

0 Votes 0 ·
Show more comments
DocBrown-9801 avatar image
4 Votes"
DocBrown-9801 answered TStensitzki commented

CU23 is failing due to modified permissions on the Auth folder. I'm finding this on select 2013 Exchange Servers that have been compromised.

I was able to get the upgrade to run by changing the permissions on the Auth folder and it's contents. First I changed the owner from System to Domain Admin. Then I added permissions for the local and domain admin accounts. Once this was done I was able to successfully install CU23.

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

So, permissions are set, but now I run the setup for CU 23 hit next on connect to the internet and check for updates and the wizard disappears like I dont have exchange installed. How were you able to successfully install the CU 23 after you changed the permissions?

0 Votes 0 ·

Same thing happened to me in one server. Don’t check for updates and it will start. There weren’t any updates available on other servers I have updated anyway.

2 Votes 2 ·
r836-3072 avatar image r836-3072 ChrisCalbreath-0769 ·

That is EXACTLY what I needed, you are a blessing!! Thank you I was digging out the image of the server thinking it was going to be a long night.

1 Vote 1 ·

Preferably you do not use the wizard, but the unattended install.

  • Mount the Exchange CU ISO

  • Open an administrative command prompt

  • Navigate to the mounted ISO volume and run setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

Ensure that you have updated the schema, AD, and domain(s) prior to installing a new CU.

When you upgrade the first Exchange Server to a new CU, and your admin account is a member of the Schema Admin and Enterprise Admin security groups, the CU might fail, because the FMSO roles are located in a different AD site.


1 Vote 1 ·
ChrisCalbreath-0769 avatar image
2 Votes"
ChrisCalbreath-0769 answered BradDaleLevcoTech-9227 edited

I just encountered this as well on a compromised server. It looks like inheritance was disabled. I made myself the owner of the folder and then just re-enabled inheritance to allow CU23 install to complete.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Just as a heads up,

This current security changes seem only to be affecting CAS Servers.

Our Mailbox Server didn't seem to have the same issues, however if it's a script instead of human that is doing this, our Exchange installation is on D: for the MBX server not C:

Just a thought on this whole mess.

Thanks,
Brad Dale

0 Votes 0 ·
AlexanderS-7287 avatar image
0 Votes"
AlexanderS-7287 answered

I had the same issue on a compromised Exchange server 2016. The update to CU20 gave error message:

'The Installer has insufficient privileges to modify this file: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\scripts\premium\aria-web-telemetry.js.'.


After changing the permissions on these folders the update ran fine.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DocBrown-9801 avatar image
0 Votes"
DocBrown-9801 answered DocBrown-9801 edited

Well the compromise has gone further. Both Exchange 2013's are down as of about 3AM EDT on 3/19/2021, even after the patches have been applied and one even went through an upgrade from CU22 to Cu23. Still evaluating what has been done, but it's not pretty.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DocBrown-9801 avatar image
0 Votes"
DocBrown-9801 answered scl8767 commented

Looks like the lastest fun was to install scripts to automatically reset the DNS server to a public server, breaking exchange.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Joshua-4330 avatar image
0 Votes"
Joshua-4330 answered ZhengqiLou-MSFT commented

I have the same issue

Installing product I:\exchangeserver.msi failed. Fatal error during installation. Error code is 1603. Last error reported by the MSI package is 'The installer has insufficient privileges to access this directory: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.1.2242. The installation cannot continue. Log on as administrator or contact your system administrator.'.



Installing product I:\exchangeserver.msi failed. Fatal error during installation. Error code is 1603. Last error reported by the MSI package is 'The Installer has insufficient privileges to modify this file: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\TimeoutLogout.aspx.'.

I tried to modify the permission and added the right permission but still issue persist.

Error:
Installing product ExchangeServer2016-x64-CU20\exchangeserver.msi failed. Fatal error during installation. Error code is 1603.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi Joshua,

Have you added the permission for both ECP & OWA folder?
And what about using the unattendent mode with Admin mode PowerShell?

Regards,
Lou

0 Votes 0 ·
Joshua-4330 avatar image
1 Vote"
Joshua-4330 answered TonyGriffith-4173 commented

I actually resolve the issue after correcting the permissions and mount the iso on the VM datastore NOT just mounting the iso from downloads.

Best,

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Yes after changing owner to Domain Admin and enabling inheritance everything installed correctly

1 Vote 1 ·