Setup Error during pre-reqs for CU8 to Exchange 2016

Due to an unknown error when accessing Outlook Web Access (did not affect ECP) in CU4, we decided to upgrade to CU8. Also note that Microsoft will only support you on the two latest CU for Exchange, so they don’t care that much what isn’t working if you haven’t followed the updates.

During the pre-reqs check for installing CU8, it failed due to missing Schema or Enterprise Admin rights on the account I was installing CU8 with.

At first try, this was correct, because I didn’t think the upgrade to CU8 would require additional configuration of AD Schema. But okey, so I went over to AD and got myself additional temporary membership in the Enterprise Admin group.

Signed off the server, and started the Setup again, but I kept getting the same error. I also tried using PowerShell to Prepare Schema, but got the same error.

Scratching my head abit, then went on with forcing AD Replication and using gpresult, to see that I did indeed have membership in Enterprise Admin.

As the statement says Schema Admin and/or Enterprise Admin, I went back to AD and got Schema Admin group memebership, but still the same error.

Then I read alot of guides on installing CUs, and somewhere that it said remove membership in Domain Users as a pre-req, but couldn’t really understand why, until I stumbled upon a technet article stating:

Exchange Setup will check all your group memberships, and if it finds you are member of Domain Users, best practice says you should not be Enterprise Admin or Schema Admin together with Domain User. So it failed with the same error, not because I wasn’t member of Schema Admin or Enterprise Admin, but because I was also member of Domain Users.