Hi All,

When we try to update or Exchange 2013 CU3 environment to CU7 we get some errors when we try to prepare ad.

It fails at 98% with an error:

[2] [ERROR] Save() is not supported on a read-only object.
[2] [WARNING] An unexpected error has occurred and a Watson dump is being generated: Save() is not supported on a read-only object.

We have checked all the security settings with our test environment where it is working. Running command prompt as an admin and we have all necessary domain rights. Also checked alle the objects with Adsi edit, but no difference with our test environment.

Exchange error log:

[03/18/2015 20:17:47.0096] [2] Used domain controller <FQDN> to read object CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=prod,DC=local.
[03/18/2015 20:17:47.0096] [2] Used domain controller <FQDN> to read object CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=prod,DC=local.
[03/18/2015 20:17:47.0096] [2] [ERROR] Save() is not supported on a read-only object.
[03/18/2015 20:17:47.0096] [2] [WARNING] An unexpected error has occurred and a Watson dump is being generated: Save() is not supported on a read-only object.
[03/18/2015 20:17:47.0962] [1] The following 1 error(s) occurred during task execution:
[03/18/2015 20:17:47.0962] [1] 0.  ErrorRecord: Save() is not supported on a read-only object.
[03/18/2015 20:17:47.0962] [1] 0.  ErrorRecord: System.InvalidOperationException: Save() is not supported on a read-only object.
   at Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean bypassValidation)
   at Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__8()
   at Microsoft.Exchange.Configuration.Core.LatencyTrackerExtension.StartAndEndInternalTracking(LatencyTracker latencyTracker, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Core.CmdletLatencyTracker.StartAndEndInternalTracking(Guid cmdletUniqueId, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__7()
   at Microsoft.Exchange.Configuration.Core.LatencyTrackerExtension.StartAndEndInternalTracking(LatencyTracker latencyTracker, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Core.CmdletLatencyTracker.StartAndEndInternalTracking(Guid cmdletUniqueId, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
   at System.Management.Automation.CommandProcessor.ProcessRecord()

Thanks!

Regards, Raymond

Hi

Did you run the commands to prepareAD first before running the setup?

Hi Ed,

thanks for reply, but the problem is when we run preparead as i wrote in the question.?

Hello,

Please check the current schema version:

https://support.microsoft.com/en-us/kb/558112?wa=wsignin1.0

Try updating the schema by the following command:

Setup.exe /PrepareSchema

https://technet.microsoft.com/en-us/library/bb125224(v=exchg.150).aspx

Thanks,

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Hi Simon,

Thanks for Reply, prepare schema worked and is ready for a new CU.

When we try to run prepareAD after PrepareSchema we get the error as above.

Do you have any other suggestions? it looks like a security issue but the account is member of all the admin groups (domain, schema, enterprise etc.)

Hi,

I'm having exactly the same issue in our environment. We're trying to upgrade from CU3 to CU7. Schema update has run succesfully. Through ADSIEdit, it's confirmed that the rangeupper value is on the schema level of CU7 (15312)

We also checked all the security settings, groups, etc. No luck there

As Raymond mentioned: are there any other suggestions to check / fix this issue?

Thans you in advance for your reply

Regards, Laurence

Hello all,

today I've tried to upgrade to CU8. With CU8, the same error appears. Scehma update runs succesfully, but the AD prep fails at 98%, with the error:

[05/19/2015 05:39:13.0101] [2] Used domain controller HPAD01.hbs.corp to read object CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=hbs,DC=corp.
[05/19/2015 05:39:13.0148] [2] [ERROR] Save() is not supported on a read-only object.
[05/19/2015 05:39:13.0148] [2] [WARNING] An unexpected error has occurred and a Watson dump is being generated: Save() is not supported on a read-only object.
[05/19/2015 05:39:14.0354] [1] The following 1 error(s) occurred during task execution:
[05/19/2015 05:39:14.0354] [1] 0.  ErrorRecord: Save() is not supported on a read-only object.
[05/19/2015 05:39:14.0354] [1] 0.  ErrorRecord: System.InvalidOperationException: Save() is not supported on a read-only object.
   at Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean bypassValidation)
   at Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessTaskStage(TaskStage taskStage, Action initFunc, Action mainFunc, Action completeFunc)
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
   at System.Management.Automation.CommandProcessor.ProcessRecord()
[05/19/2015 05:39:14.0385] [1] [ERROR] The following error was generated when "$error.Clear();
          $createTenantRoot = ($RoleIsDatacenter -or $RoleIsPartnerHosted);
          $createMsoSyncRoot = $RoleIsDatacenter;

          #$RoleDatacenterIsManagementForest is set only in Datacenter deployment; interpret its absense as $false
          [bool]$isManagementForest = ($RoleDatacenterIsManagementForest -eq $true);

          if ($RolePrepareAllDomains)
          {
              initialize-DomainPermissions -AllDomains:$true -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -IsManagementForest:$isManagementForest;
          }
          elseif ($RoleDomain -ne $null)
          {
              initialize-DomainPermissions -Domain $RoleDomain -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -IsManagementForest:$isManagementForest;
          }
          else
          {
              initialize-DomainPermissions -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -IsManagementForest:$isManagementForest;
          }
        " was run: "System.InvalidOperationException: Save() is not supported on a read-only object.
   at Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean bypassValidation)
   at Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessTaskStage(TaskStage taskStage, Action initFunc, Action mainFunc, Action completeFunc)
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
   at System.Management.Automation.CommandProcessor.ProcessRecord()".
[05/19/2015 05:39:14.0385] [1] [ERROR] Save() is not supported on a read-only object.
[05/19/2015 05:39:14.0385] [1] [ERROR-REFERENCE] Id=DomainGlobalConfig___27a706ffe123425f9ee60cb02b930e81 Component=EXCHANGE14:\Current\Release\Shared\Datacenter\Setup
[05/19/2015 05:39:14.0385] [1] Setup is stopping now because of one or more critical errors.

Help to fix this issue would be very much appreciatie

Thanks in advance,

Laurence van Bilderbeek

Hello all,

I've been able to resolve this issue, simply by ignoring the message and continue installing CU8. After the installation of the CU on the first Exchange server, it seems it has performed the prepareAD itself, succesfully. I've checked the versions of the AD objects and containers as described in the Technet article Prepare Active Directory and domains. They are on the level of CU8.

with kind regards,

Laurence van Bilderbeek