This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 63%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM1%3C/text%3E%3C/svg%3E)
Have installed CU22 (from currently installed CU19) on two Exchange 2016 servers and getting this every time:
Error: The following error was generated when "$error.Clear(); set-InstallPathInAppConfig -ConfigFileRelativePath "FrontEnd\HttpProxy\oab" -ConfigFileName web.config" was run: "System.UnauthorizedAccessException: Access to the path 'D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.StreamWriter.CreateFile(String path, Boolean append, Boolean checkHost) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize, Boolean checkHost) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding) at Microsoft.Exchange.Management.SetInstallPathInAppConfig.InternalProcessRecord() at Microsoft.Exchange.Configuration.Tasks.Task.b__91_1() at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed) at Microsoft.Exchange.Configuration.Tasks.Task.ProcessTaskStage(TaskStage taskStage, Action initFunc, Action mainFunc, Action completeFunc) at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord() at System.Management.Automation.CommandProcessor.ProcessRecord()".
Have solved it each time by copying D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config.bak to D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config and then rerun the setup and it installs.
Can we do something before running CU22 so this does not happen?
Is there something that we should change on D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\oab\web.config before running the update?
Many thanks for your help!
mrtro
Tested, as a temporary measure to set Everyone as Full Control on this file and that worked. After installation of CU22 it has been updated and now have the correct permissions again.
In case anyone else has the same problem.
mrtro
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 69%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Thank you so much - we just use Ex2016 for internal hybrid support and I was frantic when we got to the end and that error came up - exactly same issue going from CU19 to 22. My guess is a different admin account had run the previous install so the file had explicit rights to them. Your solution worked perfectly.
Were these servers ever compromised by any of the previous Exchange vulnerabilities?
No, they do not even have internet connectivity.
For the next server I even set the account I am logged on with as as Full Control but that did not help either.
However it does seem to have something to do with access beeing denied to that perticular file for some reason.
Regards,
mrtro
Ok, are you running CU22 from an elevated prompt? I assume yes, but want to confirm :)
If so and you are still seeing this, then it could also be anti-malware installed on the server or something obviously corrupted those files in the past.
Sounds like your work-around is working however.
Indeed I am running cmd as Administrator. I will disable defender for the next server and see if that solves it. Otherwise I will just stick to my "solution" with copying files.
Thanks for your input in this matter @Andy David - MVP