Exchange Server 2016 CU Setup Cannot Stop Service due to Access Denied

Problem

You have an Exchange Server 2016 organization and plan to upgrade to Cumulative Update 10. You log on to an  Exchange Server, activate DAG maintenance, and prepare the Server Component States for installing the new Cumulative Update. 

You open an elevated PowerShell Session and start the Setup using

./Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

Out of a sudden, the Exchange Server CU Setup fails while executing the setup step Stopping Services with an error:

Microsoft Exchange Server 2016 Cumulative Update 10 Unattended SetupCopying Files...File copy complete. Setup will now collect additional information needed for installation.LanguagesManagement toolsMailbox role: Transport serviceMailbox role: Client Access serviceMailbox role: Unified Messaging serviceMailbox role: Mailbox serviceMailbox role: Front End Transport serviceMailbox role: Client Access Front End servicePerforming Microsoft Exchange Server Prerequisite Check    Configuring Prerequisites                                                                         COMPLETED    Prerequisite Analysis                                                                             COMPLETEDConfiguring Microsoft Exchange Server    Preparing Setup                                                                                   COMPLETED    Stopping Services                                                                                 FAILED
The following error was generated when "$error.Clear(); & $RoleBinPathServiceControl.ps1 -Operation:DisableServices-Roles:($RoleRoles.Replace('Role','').Split(',')) -SetupScriptsDirectory:$RoleBinPath; &$RoleBinPathServiceControl.ps1 -Operation:Stop -Roles:($RoleRoles.Replace('Role','').Split(','))-IsDatacenter:([bool]$RoleIsDatacenter) " was run: "Microsoft.PowerShell.Commands.ProcessCommandException: Cannot stopprocess "fms (2496)" because of the following error: Access is denied ---> System.ComponentModel.Win32Exception: Access is denied at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited) at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited) at System.Diagnostics.Process.get_HasExited() at Microsoft.PowerShell.Commands.StopProcessCommand.ProcessRecord() ---End of inner exception stack trace ---".The Exchange Server setup operation didn't complete. More details can be found in ExchangeSetup.log located in the:ExchangeSetupLogs folder.

Why would an error like Access Denied happen while executing the Setup.exe as a member of the local Administrators’ security group from within an elevated PowerShell session?

Issue

The PowerShell code executed as part of the CU Setup sets the startup type of Exchange and some Windows services to Disabled. This ensures that in the case of a server reboot, an automatic service start will not interfere with a partially executed setup. After setting the startup type to Disabled, the services are stopped. 

The services are controlled by the ServiceControl.ps1 script is located on the Exchange Server installation media in SetupServerRolesCommon.

The function StopServices stops services using the Stop-Service cmdlet. Due to timing issues, some services are stopped by killing the running processes using Stop-Process -Force.

The services stopped by stopping the running process are:

• FMS
• MSExchangeServiceHost
• MSExchangeTransport
• MSExchangeInferenceService
• MSExchangeDagMgmt

When you execute the Stop-Process cmdlet results in the Access Denied error.

Solution

The issue is related to the fact that the user account logged on to the server and executing the Exchange Server Cumulatice Update does not have the local User Rights Assignment to Debug Programs.

By default, the right to debug programs is assigned to the local Administrators’ security group. In secured Active Directory infrastructures, the user rights assignments and local security groups are often managed using Group Policy Objects (GPO). The GPOs manage the names of local security groups, group memberships, and user rights assignments.

• To avoid the error described above, you must ensure that the group of Exchange Administrators that install Exchange Server Cumulative Updates has the user rights assignment to debug programs.

The client encountering the issue described above hasn’t had any problems installing Cumulative Updates for Exchange Server 2013 in the past. So this is solution is related to the setup of Exchange Server 2016 Cumulative Updates on Windows Server 2016 only. If you have any information regarding Exchange Server 2013, let me know using the comments below.

Enjoy Exchange Server!