Exchange 2016 CU22 installation error on \FrontEnd\HttpProxy\oab\web.config

asked 2021-11-25T08:19:08.93+00:00
mrtro 236 Reputation points

Have installed CU22 (from currently installed CU19) on two Exchange 2016 servers and getting this every time:

Error: The following error was generated when "$error.Clear(); set-InstallPathInAppConfig -ConfigFileRelativePath "FrontEnd\HttpProxy\oab" -ConfigFileName web.config" was run: "System.UnauthorizedAccessException: Access to the path 'D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.StreamWriter.CreateFile(String path, Boolean append, Boolean checkHost) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize, Boolean checkHost) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding) at Microsoft.Exchange.Management.SetInstallPathInAppConfig.InternalProcessRecord() at Microsoft.Exchange.Configuration.Tasks.Task.b__91_1() at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed) at Microsoft.Exchange.Configuration.Tasks.Task.ProcessTaskStage(TaskStage taskStage, Action initFunc, Action mainFunc, Action completeFunc) at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord() at System.Management.Automation.CommandProcessor.ProcessRecord()".

Have solved it each time by copying D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config.bak to D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config and then rerun the setup and it installs.

Can we do something before running CU22 so this does not happen?
Is there something that we should change on D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config before running the update?

Many thanks for your help!
mrtro

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
6,074 questions
No comments
{count} votes

Accepted answer
  1. answered 2021-11-26T07:43:36.14+00:00
    mrtro 236 Reputation points

    Tested, as a temporary measure to set Everyone as Full Control on this file and that worked. After installation of CU22 it has been updated and now have the correct permissions again.
    In case anyone else has the same problem.
    mrtro


2 additional answers

Sort by: Most helpful
  1. answered 2021-11-25T13:13:35.837+00:00
    Andy David - MVP 109K Reputation points Microsoft MVP

    Were these servers ever compromised by any of the previous Exchange vulnerabilities?


  2. answered 2021-11-25T14:03:48.507+00:00
    Andy David - MVP 109K Reputation points Microsoft MVP

    Ok, are you running CU22 from an elevated prompt? I assume yes, but want to confirm :)

    If so and you are still seeing this, then it could also be anti-malware installed on the server or something obviously corrupted those files in the past.
    Sounds like your work-around is working however.