none
Exchange 2007 - SP2 Update - Access is denied during setup.com /upgradecms - CCR Cluster

    Question

  • I continually get access denied messages when trying to /upgradecms.    The setup.com /m:upgrade went ok - but failed in the last step - stating "Service 'MSExchangeMailSubmission' failed to reach status 'Running' on this server.   I went to services.msc and started up the services manually and all worked well. Rebooted etc as documented and went to do setup.com /upgradecms (after stopping the CCR CMS, and moving it to the passive node.)   During this phase I get to about 11% and get 'Access is Denied'.

    The Last part of ExchangeSetup logs are as follows: (let me know if you need full message):
    [1/3/2010 12:33:11 AM] [2] Entering ScSetVersionPropertiesOnResource
    [1/3/2010 12:33:11 AM] [2]   Setting  property 'ResourceVersion'='524290'
    [1/3/2010 12:33:11 AM] [2]   Setting  property 'ResourceBuild'='666894338'
    [1/3/2010 12:33:11 AM] [2] Leaving ScSetVersionPropertiesOnResource
    [1/3/2010 12:33:11 AM] [2] Leaving ScUpdateExchangeClusterResources
    [1/3/2010 12:33:11 AM] [2] Leaving ScSetupExchangeVirtualServer
    [1/3/2010 12:33:12 AM] [2] [ERROR] Access is denied.

    [1/3/2010 12:33:12 AM] [2] Ending processing.
    [1/3/2010 12:33:12 AM] [1] The following 1 error(s) occurred during task execution:
    [1/3/2010 12:33:12 AM] [1] 0.  ErrorRecord: Access is denied.

    [1/3/2010 12:33:12 AM] [1] 0.  ErrorRecord: System.Runtime.InteropServices.COMException (0x80070005): Access is denied.

       at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
       at System.DirectoryServices.DirectoryEntry.Exists(String path)
       at Microsoft.Exchange.Management.SystemConfigurationTasks.DavHelper.CopyDavVdirsToMetabase(String domainController, String exchangeServerName, String metabaseServerName)
       at Microsoft.Exchange.Management.SystemConfigurationTasks.DavHelper.CopyDavVdirsToMetabase(String domainController, String exchangeServerName, Node[] nodes)
       at Microsoft.Exchange.Management.SystemConfigurationTasks.UpgradeClusteredMailboxServerObjects.InternalProcessRecord()
       at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
    [1/3/2010 12:33:12 AM] [1] [ERROR] Access is denied.

    [1/3/2010 12:33:12 AM] [1] Setup is halting task execution because of one or more errors in a critical task.
    [1/3/2010 12:33:12 AM] [1] Finished executing component tasks.
    [1/3/2010 12:33:12 AM] [1] Ending processing.
    [1/3/2010 12:33:12 AM] [0] The Exchange Server Setup operation did not complete. For more information, visit http://support.microsoft.com and enter the Error ID.
    [1/3/2010 12:33:12 AM] [0] End of Setup
    [1/3/2010 12:33:12 AM] [0] **********************************************


    Any help would be appreciated.  I moved the cluster back to the original active node (still sp1) and it started up fine and is running.  




    - added as more data -

    I've tried with a few different admin accounts.

    I have 2 HUB/CAS servers which upgraded fine.  I have a cas/mailbox (public folder / OAB distribution point ) server which upgraded just fine.


    • Edited by Sam Bentrup Sunday, January 03, 2010 1:07 PM More Data
    Sunday, January 03, 2010 6:56 AM

Answers

  • Ended up being IIS was stopped. After starting IIS, the setup.com /updatecms worked fine.  Should probably be listed as a pre-req.
    • Marked as answer by Alan.Gim Tuesday, January 12, 2010 2:54 AM
    Tuesday, January 12, 2010 2:33 AM

All replies

  • So, you have tried to upgrade the passive node two times, both failed. The first time is service stop error, and the second time is access denied error, right?

    Is there any error event in the application log on the passive node?

    Please run ExBPA against the nodes for health check

    Resources:

    Upgrading Clustered Mailbox Servers to Exchange 2007 SP1 or SP2


    James Luo
    TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
    If you have any feedback on our support, please contact tngfb@microsoft.com
    Tuesday, January 05, 2010 3:15 AM
  • An update to this:

    On Friday night it failed as explained.  I reran setup /m:upgrade and it went through successful; however setup /upgradecms still fails with an "Access is Denied".   Saturday night I tried a few other things (mainly rolling the entire cluster vs just the CMS) to the second location.. still failed /upgradecms.
     Both instances I rolled back to primary node and started up just fine on SP1.

    Sunday night - the primary node failed (other reasons) which caused it to now start on the secondary node; - it starts and runs what seems to be perfectly (no issue).    I'm now quite concerned  as I have an SP2 node (that we're running on well right now) and an SP1 node (the now passive side).   Do I upgrade the primary node to SP2 now that the secondary node is running SP2 just fine?

    As per your request - here is ExBPA health check:

    The only 'Critical Issue' is   'ClusteredMailboxServer' is partially configured on server xxxxxxxxx. Either setup is configuring it right now or setup failed while configuring it.


    -Sam
    Tuesday, January 05, 2010 8:47 PM
  • When setup operations on the CMS failed on one node of a cluster, the error info will show in the ExBPA. The error usually solved by re-run the installation

    The main problem is “Access is denied”

    Please check the resources on the active node, do all resources online?

    Please go to ADSI editor, and check the permissions of each node and the account that performed the update action on the CMS object


    James Luo
    TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
    If you have any feedback on our support, please contact tngfb@microsoft.com
    Wednesday, January 06, 2010 8:48 AM
  • Yes - all of the resources are online.

    The account  I tried originally is the same as what I used to install (my personal account), I've also tried the "administrator" account.  As well as another administrator equivalent account.   They all fail with Access is Denied.

    I'll also note - my account was able to successfully upgrade another cluster (an SCC cluster), both front-end hub/cas roles, and a public folder/oab distribution server. I'm quite confident my account has privileges to do the necessary tasks - unless there's an odd issue where inheritance is blocked on this specific object.

    In EXBPA I specifically get this only:
    'ClusteredMailboxServer' is partially configured on server hbgxxxx.xxxxxxx.xxx. Either setup is configuring it right now or setup failed while configuring it. Please rerun setup if it isn't currently running.

    I've rerun setup /m:upgrade as well as setup /upgradecms  - again setup /m:upgrade is successful,  /upgradecms is "Access is Denied".

    As I mentioned it failed over to that node on Sunday - and has been running there (without issue) ever since.  I'm moderately scared to take it offline and/or move it back to original node without more data - or potentially upgrading the now passive node to sp2 as well to at least match.  

    L:ast note: CCR health is still Healthy - and logs do seem to be shipping correctly.



    Wednesday, January 06, 2010 12:33 PM
  • One last addition - I did not think this was valid addition until speaking with other peers.   When the cluster failed on Sunday morning (around 2am) and failed to second node - everything was working for all of our users except Entourage users.  After troubleshooting - noted that IIS - World Wide Web Service(and thus the /Exchange legacy Virtual Directories) was stopped.   I started the service and Entourage users were able to function well again.   Would IIS be the culprit here?  especially considering the errors within the Microsoft.Exchange.Management.SystemConfigurationTasks.DavHelper.CopyDavVdirsToMetabase namespace.

    Our attack plan  is as follows:   Note - both of the 2 nodes in CMS are in a VMware Virtual Environment in two separate sites.

    1) Verify Backups
    2) Stop Exchange through stop-clusteredmailboxserver cmdlet.
    3) Snapshot both VMs.  Since Exchange is stopped, this should be a quiesced snapshot on both sites.
    4) Since IIS was stopped - but now started.  The first attempt will be to rerun setup.com /upgradecms  - this will be done on Site2 where the CMS currently lives which is currently SP2.    If this succeeds - we will note down that IIS needed to be running for a successful upgrade, call it a bug for not checking, and be happy - then run the setup.com /m:upgrade on Site1 which is still SP1 and be on our merry way as per documented.
    5) If #4 fails as has shown in the past, and had no ties to IIS - We are then going to setup.com /m:upgrade Site1 (currently sp1 going to sp2), roll the off-line CMS to Site1, and run setup.com /upgradecms  to see if there is just an error on Site 2's exchange server.  If this is successful - we'll either note the failure for next time and probably plan to rebuild Site2 and reseed databases as something is corrupt on this server.  
    6) If site 1 fails the upgrade process for any reason - we will power off both VMs, revert snapshot on both VMs.  Power on Site 2 - let the Cluster and CMS come back online and fully functional - then bring Site 1 back online and reassess and back to drawing board.

    - If successful throughout any of the processes - merge the snapshots to not leave those hanging around.


    Wednesday, January 06, 2010 2:18 PM
  • Ended up being IIS was stopped. After starting IIS, the setup.com /updatecms worked fine.  Should probably be listed as a pre-req.
    • Marked as answer by Alan.Gim Tuesday, January 12, 2010 2:54 AM
    Tuesday, January 12, 2010 2:33 AM
  • I'm having the same issue on the upgrade process of my CMS. I have the same setup and keep getting the access denied error during the cms upgrade. Although IIS is running fine on all nodes. I have tried restarting IIS but to no avail. I am worried now since one of the nodes is on SP3 and the primary node is on SP1. Has anyone resolved this issue?
    Wednesday, March 07, 2012 3:36 AM