Exchange Service Pack or Rollup or Cumulative Update fails with error code '3221684229' and message 'Access is denied.'

  • 项目

Two week ends ago I was on call and I was paged about the issue in subject.

One customer from Switzerland was trying to install Exchange 2013 CU8. Everytime when he was arriving at the "Mailbox Role" step at 49% setup portion percentage he received this error:

Error:
The following error was generated when "$error.Clear();
 buildToBuildUpgrade-ExsetdataAtom -AtomName SystemAttendant -DomainController $RoleDomainController

" was run: "Microsoft.Exchange.Management.Deployment.ExsetdataException: An error occurred with error code '3221684229' and message 'Access is denied.'.
   at Microsoft.Exchange.Configuration.Tasks.Task.ThrowTerminatingError(Exception exception, ErrorCategory category, Object target)
   at Microsoft.Exchange.Management.Deployment.ManageExsetdataAtom.HandleExsetdataReturnCode(UInt32 scErr)
   at Microsoft.Exchange.Management.Deployment.ManageExsetdataAtom.BuildToBuildUpgradeAtom(AtomID atomID)
   at Microsoft.Exchange.Management.Deployment.BuildToBuildUpgradeExsetdataAtom.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)".

The Exchange Server setup operation didn't complete. More details can be found
in ExchangeSetup.log located in the <SystemDrive>:\ExchangeSetupLogs folder.

After investigations we found out the setup was failing with the following error:

196562 [05.09.2015 17:22:31.0115] [2] ScFindFileInDirTree (f:\15.00.1076\sources\dev\admin\src\libs\base\basemisc.cxx:1347)
196563 Error code 0XC0070005 (5): Access is denied.
196564 [05.09.2015 17:22:31.0115] [2] ScFindFileInDirTree (f:\15.00.1076\sources\dev\admin\src\libs\base\basemisc.cxx:1347)
196565 Error code 0XC0070005 (5): Access is denied.

The issue was caused by setup program trying to access (using the with the function called ScFindFileInDirTree) to all the folders under the …\Exchange Server\V15\Mailbox directory. The account used for running Exchange setup did not have Full Control permission on the "System Volume Information" folder of the mount points.

To solve it simply:

We started Windows Explorer, folder options, view tab.
Unselected "Hide protected operating system files (Recommended).
Then the "System Volume Information" folder was be visible in Windows Explorer.
We selected the "System Volume Information" folder, properties, security tab.
System Account was visible with Full Control permissions.
At this point we added the domain account used for running Exchange CU8 setup giving it the "Full Control" permissions.
We restarted the Exchange 2013 CU8 setup and it completed successfully.

Hope this help you if you have mount points on your MBX servers and you face the same issue.

Cheers,

Cri