Exchange 2013 Update from SP1 to CU5 failed

Question

Hello, guys!
I need your help. I've just tried to make an update my Exchange Server with CU5 and get an error:
"$error.Clear(); 
          Uninstall-CrimsonManifest -DefinitionXml "bin\ActiveMonitoringEvents.man";
          Install-CrimsonManifest `
            -DefinitionXml "bin\ActiveMonitoringEvents.man" `
            -MessageDll "bin\ActiveMonitoringEventMsg.dll" `
            -ProviderName "Microsoft-Exchange-ActiveMonitoring"
The following error occurred: "System.InvalidOperationException:
Failed to perform event manifest action (manifest =
C:\Program Files\Microsoft\Exchange Server\V15\bin\ActiveMonitoringEvents.man, event = install-manifest,
exitcode  
= 5, errors = The publishers and channels are installed successfully. However, we can't enable one or more publishers and channels. Access is denied.
   in Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory
category, Object target, Boolean reThrow, String helpUrl)
   in Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory
category, Object target)
   in Microsoft.Exchange.Management.SystemConfigurationTasks.InstallCrimsonManifest.InternalProcessRecord()
   in Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   in Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func,
Boolean terminatePipelineIfFailed)".
Help me, please!!!
What should i do to resolve this problem???

Answer 1

Hi,
This issue occurs if any of the following conditions are true:
The built-in security group “NT Service\Eventlog”  does not have permissions on the folder %SystemRoot%\System32\winevt\Logs.
The built-in security group “NT Service\Eventlog”  does not have permissions on the registries and its sub keys,  
                         HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability Analysis
                         HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\
To solve this issue, please take the following steps to give requires permissions on the log folders and registry
Step 1:
Restore the default permissions on %SystemRoot%\System32\winevt\logs.
Authenticated user - List folder/read data, Read attributes, Read Extended attributes, Read permissions
Administrators - Full control
SYSTEM - Full control
EventLog - Full control
To restore the default permissions on folder %SystemRoot%\System32\winevt\logs, follow these steps.
Right-click on %SystemRoot%\System32\winevt\logs and select Properties.
Select the Security tab.
Click Edit button and click the Add button in the permissions dialog box.
In Select users, computers, or Groups dialog box ensure that under object types Built in Security Principals and the location as local computer name is selected.
Enter the object name as "NT SERVICE\EventLog" without quotes. And click
OK. This group should have full control on the folder.
Once EventLog group is added add the rest of the groups with above mentioned permissions.
Step 2:
Provide the permission to registry,
Open Registry Editor
Locate
HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability Analysis, Right-click it and Select
Permissions...
Checked whether you have Eventlog group. If not, add “NT Service\Eventlog”, then give Full Control, then click OK.
Locate HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\, right-click and Select
Permissions...
Repeat same in the No.3 step.
Note: Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number
to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
Best Regards.