CU upgrade error; [ERROR] Save() is not supported on a read-only object.

Hi All,

When we try to update or Exchange 2013 CU3 environment to CU7 we get some errors when we try to prepare ad.

It fails at 98% with an error:

[2] [ERROR] Save() is not supported on a read-only object.
[2] [WARNING] An unexpected error has occurred and a Watson dump is being generated: Save() is not supported on a read-only object.

We have checked all the security settings with our test environment where it is working. Running command prompt as an admin and we have all necessary domain rights. Also checked alle the objects with Adsi edit, but no difference with our test environment.

Exchange error log:

[03/18/2015 20:17:47.0096] [2] Used domain controller <FQDN> to read object CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=prod,DC=local.
[03/18/2015 20:17:47.0096] [2] Used domain controller <FQDN> to read object CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=prod,DC=local.
[03/18/2015 20:17:47.0096] [2] [ERROR] Save() is not supported on a read-only object.
[03/18/2015 20:17:47.0096] [2] [WARNING] An unexpected error has occurred and a Watson dump is being generated: Save() is not supported on a read-only object.
[03/18/2015 20:17:47.0962] [1] The following 1 error(s) occurred during task execution:
[03/18/2015 20:17:47.0962] [1] 0.  ErrorRecord: Save() is not supported on a read-only object.
[03/18/2015 20:17:47.0962] [1] 0.  ErrorRecord: System.InvalidOperationException: Save() is not supported on a read-only object.
   at Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean bypassValidation)
   at Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__8()
   at Microsoft.Exchange.Configuration.Core.LatencyTrackerExtension.StartAndEndInternalTracking(LatencyTracker latencyTracker, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Core.CmdletLatencyTracker.StartAndEndInternalTracking(Guid cmdletUniqueId, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__7()
   at Microsoft.Exchange.Configuration.Core.LatencyTrackerExtension.StartAndEndInternalTracking(LatencyTracker latencyTracker, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Core.CmdletLatencyTracker.StartAndEndInternalTracking(Guid cmdletUniqueId, String groupName, String funcName, Boolean logDetailsAlways, Action action)
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
   at System.Management.Automation.CommandProcessor.ProcessRecord()

Thanks!

Regards, Raymond