Update to Exchange 2016 CU1 fails with WMSVC error

23. June 2016

During the last days I had to update a few Exchange 2016 servers to CU1. Unfortunately the update failed with the following error:

Error:
The following error was generated when "$error.Clear();
          $keyPath = "HKLM:\Software\Microsoft\WebManagement\Server";
          if (!(Get-Item $keyPath -ErrorAction SilentlyContinue))
          {
            New-Item $keyPath -Force
          }
          Set-ItemProperty -path $keyPath -name "EnableRemoteManagement" -value 0x1 -Type DWORD -Force;

          if (Get-Service WMSVC* | ?{$_.Name -eq ‘WMSVC’})
          {
            Set-Service WMSVC -StartupType Automatic
            Stop-SetupService -ServiceName WMSVC;
            Start-SetupService -ServiceName WMSVC
          }
        " was run: "Microsoft.Exchange.Configuration.Tasks.ServiceDidNotReachStatusException: Service ‘WMSVC’ failed to reach status ‘Running’ on this server.
   at Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception exception, ErrorCategory errorCategory, Object target, String helpUrl)
   at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target)
   at Microsoft.Exchange.Management.Tasks.ManageSetupService.WaitForServiceStatus(ServiceController serviceController, ServiceControllerStatus status, Unlimited`1 maximumWaitTime, Boolean ignoreFailures, Boolean sendWatsonReportForHungService)
   at Microsoft.Exchange.Management.Tasks.ManageSetupService.StartService(ServiceController serviceController, Boolean ignoreServiceStartTimeout, Boolean failIfServiceNotInstalled, Unlimited`1 maximumWaitTime, String[] serviceParameters)
   at Microsoft.Exchange.Management.Tasks.ManageSetupService.StartService(String serviceName, Boolean ignoreServiceStartTimeout, Boolean failIfServiceNotInstalled, Unlimited`1 maximumWaitTime, String[] serviceParameters)
   at Microsoft.Exchange.Management.Tasks.StartSetupService.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)".

One part of the error message was really important:
Service ‘WMSVC’ failed to reach status ‘Running’

So i opened the services console and tried to start the service Web Management Service (WMSVC) manual – which also failed. In the event log the following two errors were logged when I tried to start the service:

Log Name:      Application
Source:        Microsoft-Windows-IIS-IISManager
Date:          23.06.2016 10:17:52
Event ID:      1007
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERVER-FQDN
Description:
IISWMSVC_STARTUP_UNABLE_TO_READ_CERTIFICATE

Unable to read the certificate with thumbprint ‘29827623d1eec8d17743d4bca2beb9cbcb2027d8’. Please make sure the SSL certificate exists and that is correctly configured in the Management Service page.

Log Name:      System
Source:        Service Control Manager
Date:          23.06.2016 10:17:52
Event ID:      7024
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERVER-FQDN
Description:
The Web Management Service service terminated with the following service-specific error:
Unspecified error

The first error shows quite clear what the problem is:
Unable to read the certificate

To check the certificate for the Web Management Service you have to open the IIS Manager, select the current server and switch to the Features View. Now open Management Service.

As you can see here there is no SSL certificate selected.

Select a (valid) certificate and apply the settings.

After that you should be able to start the WMSVC service again and the Exchange setup should continue. The reason that the problem happened is that the local certificate was renewed a few days before. In the default IIS configuration renewed certificates are not automatically rebound. To fix this open: IIS Manager => Server => Feature View => Server Certificates
Now switch the setting on the right side and enable Automatic Rebind of Renewed Certificate.