Solved

Exchange 2013 CU5 installer fail

Posted on 2014-07-22
3
1,032 Views
Last Modified: 2014-07-22
My environment is on 2013 CU4 (SP1) and I'm installing a new mailbox server with the CU5 installer.

I tried installing with a "Exchange Admin" account who has the following group memberships:
local admin
Enterprise Admins
Schema Admins
...and a bunch of other Exchange groups.

I get the following error when trying to run setup.exe /PrepareAD:

[07/22/2014 22:00:25.0208] [2] Adding access control entries to the security descriptor for the object CN=Configuration,DC=monmouth,DC=edu.
[07/22/2014 22:00:25.0208] [2] The appropriate access control entry is already present on the object "CN=Configuration,DC=monmouth,DC=edu" for account "MONMOUTH0\Exchange Servers".
[07/22/2014 22:00:25.0224] [2] Taking ownership of CN=Deleted Objects,CN=Configuration,DC=monmouth,DC=edu.
[07/22/2014 22:00:25.0286] [2] Active Directory operation failed on WLB-DCM0-01.monmouth.edu. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

[07/22/2014 22:00:25.0286] [2] The user has insufficient access rights.
[07/22/2014 22:00:25.0318] [2] Ending processing initialize-ExchangeConfigurationPermissions
[07/22/2014 22:00:25.0318] [1] The following 1 error(s) occurred during task execution:
[07/22/2014 22:00:25.0318] [1] 0.  ErrorRecord: Active Directory operation failed on WLB-DCM0-01.monmouth.edu. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

[07/22/2014 22:00:25.0318] [1] 0.  ErrorRecord: Microsoft.Exchange.Data.Directory.ADOperationException: Active Directory operation failed on WLB-DCM0-01.monmouth.edu. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
 ---> System.DirectoryServices.Protocols.DirectoryOperationException: The user has insufficient access rights.
   at System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
   at Microsoft.Exchange.Data.Directory.PooledLdapConnection.SendRequest(DirectoryRequest request, LdapOperation ldapOperation, Nullable`1 clientSideSearchTimeout, IActivityScope activityScope, String callerInfo)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.Directory.ADDataSession.AnalyzeDirectoryError(PooledLdapConnection connection, DirectoryRequest request, DirectoryException de, Int32 totalRetries, Int32 retriesOnServer)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId)
   at Microsoft.Exchange.Management.Tasks.InitializeConfigPermissions.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)

Obviously its a permissions problem.  But what permission am I missing here??
0
Comment
Question by:rcarsey
  • 2
3 Comments
 
LVL 19

Accepted Solution

by:
Adam Farage earned 500 total points
ID: 40212989
Are you sure the permissions fully replicated through? That is the only thing I can immediately think of that is not correct here. Also, you want to make sure you are part of the domain admins group also, which could very well be the issue.

Try that, and also look at DCDIAG /TESTALL and REPADMIN /SHOWREPL. No errors, then I think you just need to wait.
0
 

Author Comment

by:rcarsey
ID: 40213010
Of course.. that was it.  He wasn't a Domain Admin.  

When I tried to use the domain\administrator account -- he lacked Schema Admin.. so he didn't work either.

Thanks Adam.
0
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40213303
No problem :) just here to help when and where I can.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Exchange Powershell help 6 32
Problem with autodiscover SBS 2011 4 41
Hide External contact 13 26
Exchange 2013 Errors 2 7
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now