Exchange 2013 CU9 Upgrade fails during PrepareAD

 am installing Exchange 2013 CU9 into a site with an existing Exchange 2013 Cu3 installation. During the ADPREP phase of installation I am getting the following error.

  PS C:\Users\chilco\Desktop\ex2013> .\Setup.exe /preparead /IAcceptExchangeServerLicenseTerms

Welcome to Microsoft Exchange Server 2013 Cumulative Update 9 Unattended Setup
Copying Files...
File copy complete. Setup will now collect additional information needed for installation.

Performing Microsoft Exchange Server Prerequisite Check

    Prerequisite Analysis                                                                             COMPLETED

Configuring Microsoft Exchange Server

    Organization Preparation                                                                          FAILED
     The following error was generated when "$error.Clear();
        install-CannedAddressLists -DomainController $RoleDomainController" was run: "Microsoft.Exchange.Data.Directory.ADOperationException: Active Directory operation failed on DC01.ad.company.com
. This error is not retriable. Additional information: A system flag has been set on the object and does not allow the o
bject to be moved or renamed.
Active directory response: 00002185: SvcErr: DSID-031B0E8F, problem 5003 (WILL_NOT_PERFORM), data 0
 ---> System.DirectoryServices.Protocols.DirectoryOperationException: The server cannot handle directory requests.
   at System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, Resu
ltAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut)
   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
   at Microsoft.Exchange.Data.Directory.PooledLdapConnection.SendRequest(DirectoryRequest request, LdapOperation ldapOpe
ration, Nullable`1 clientSideSearchTimeout, IActivityScope activityScope, String callerInfo)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest reques
t, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.Directory.ADDataSession.AnalyzeDirectoryError(PooledLdapConnection connection, DirectoryRe
quest request, DirectoryException de, Int32 totalRetries, Int32 retriesOnServer)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest reques
t, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest reques
t, ADObjectId originalId, Boolean emptyObjectSessionOnException)
   at Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest reques
t, ADObjectId originalId)
   at Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean by
passValidation)
   at Microsoft.Exchange.Management.Deployment.InstallCannedAddressLists.RenameAllGroupsAddressListToAllDistributionList
s()
   at Microsoft.Exchange.Management.Deployment.InstallCannedAddressLists.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePip
elineIfFailed)".


The Exchange Server setup operation didn't complete. More details can be found in ExchangeSetup.log located in the
<SystemDrive>:\ExchangeSetupLogs folder.

And from the Exchange Setup Logs I see this

# [ID = 525068733, Wt = 1, isFatal = True] "Creating Exchange configuration objects in Active Directory."
7/30/2015 4:01:30 PM:
          $policy = Get-RecipientEnforcementProvisioningPolicy -DomainController $RoleDomainController;
          if ($policy -ne $null -and (($policy.Name -ne "Recipient Quota Policy") -or (-not $policy.TargetObjects.Contains("SyncMailbox"))))
          {
            $dlQuota = $policy.DistributionListCountQuota;
            $mbQuota = $policy.MailboxCountQuota;
            $muQuota = $policy.MailUserCountQuota;
            $mcQuota = $policy.ContactCountQuota;
            $pfmbQuota = $policy.PublicFolderMailboxCountQuota;
            $tmbQuota = $policy.TeamMailboxCountQuota;
            $mpfQuota = $policy.MailPublicFolderCountQuota;

            Remove-RecipientEnforcementProvisioningPolicy -Identity $policy.Identity -Confirm:$false -DomainController $RoleDomainController;
            $newPolicy = New-RecipientEnforcementProvisioningPolicy -DomainController $RoleDomainController;
            Set-RecipientEnforcementProvisioningPolicy -Identity $newPolicy.Identity `
              -DistributionListCountQuota $dlQuota `
              -MailboxCountQuota $mbQuota `
              -MailUserCountQuota $muQuota `
              -ContactCountQuota $mcQuota `
              -PublicFolderMailboxCountQuota $pfmbQuota `
              -TeamMailboxCountQuota $tmbQuota `
              -MailPublicFolderCountQuota $mpfQuota `
              -DomainController $RoleDomainController;
            }

# [ID = CommonGlobalConfig___0bacae60e7a44f2790527a71c0f31a7d, Wt = 1, isFatal = True] "Creating Exchange configuration objects in Active Directory."
7/30/2015 4:01:30 PM:install-Container -Name:"Address Lists Container" -DomainController $RoleDomainController
# [ID = 1607811158, Wt = 1, isFatal = True] "Creating Exchange configuration objects in Active Directory."
7/30/2015 4:01:30 PM:install-Container -Name:"Address Lists Container","Offline Address Lists" -DomainController $RoleDomainController
# [ID = CommonGlobalConfig___662cf7f2fd9149118e6f9b763c24ffb6, Wt = 1, isFatal = True] "Creating Exchange configuration objects in Active Directory."
7/30/2015 4:01:30 PM:install-CannedAddressLists -DomainController $RoleDomainController