Unable to update Exchange 2013 CU9 to CU23

Hi to all and sorry for my English,

actually we run Exchange 2013 CU9 on Windows 2008 R2.

We beginned the migration to Exchange 2016, its installation fail because the existing Exchange 2013 must run at least CU 10.

Trying to upgrade Exchange 2013 CU9 to CU23 (the only one available) i receive this error on step one:

*****************************************************************

$createTenantRoot = ($RoleIsDatacenter -or $RoleIsPartnerHosted);
          $createMsoSyncRoot = $RoleIsDatacenter;

          #$RoleDatacenterIsManagementForest is set only in Datacenter deployment; interpret its absense as $false
          [bool]$isManagementForest = ($RoleDatacenterIsManagementForest -eq $true);

          if ($RolePrepareAllDomains)
          {
              initialize-DomainPermissions -AllDomains:$true -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$cre
ateMsoSyncRoot -IsManagementForest:$isManagementForest;
          }
          elseif ($RoleDomain -ne $null)
          {
              initialize-DomainPermissions -Domain $RoleDomain -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$c
reateMsoSyncRoot -IsManagementForest:$isManagementForest;
          }
          else
          {
              initialize-DomainPermissions -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -Is
ManagementForest:$isManagementForest;
          }
        ": "Microsoft.Exchange.Management.Tasks.EnumerateRightsFailedException: Rilevato l'errore 0x6BE durante l'enumer
azione dei criteri di gruppo per l'account S-1-5-21-3562906010-3634392973-2603855403-2111.
   in Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception exception, ErrorCategory errorCategory, Object ta
rget, String helpUrl)
   in Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.AddSaclRight(ADDomain dom, SecurityIdentifier exsS
id)
   in Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
   in Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   in Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePip
elineIfFailed)".

*****************************************************************

where S-1-5-21-3562906010-3634392973-2603855403-2111correspond to "<domain>\Exchange Servers".

Error can be reproduced running 

setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms

then "Preparing Organization" fail.

Using domain administrator account and everything work fine even the installation fail.

Where is my mistake?

Thanks in advance for any help

Best regards.

Massimo