XADM: You Must Have Exchange Full Administrator Rights to Install Exchange 2000 Server SP3 (323716)

SYMPTOMS

If you use a user account that does not have Exchange Full Administrator rights for the appropriate administrative group to upgrade a stand-alone Exchange 2000 server to Exchange 2000 Service Pack 3 (SP3), the upgrade may not be able to continue, and you may receive the following error message:

You must be at least an Exchange Full Administrator at the Administrative Group level to run update. You must use an account that has been granted the Exchange Full Administrator role on the current administrative group, or a higher-level role, using the Exchange Administrative Delegation Wizard.

MORE INFORMATION

The user account that you use to upgrade a stand-alone Exchange 2000 server to Exchange 2000 SP3 must have Exchange Full Administrator rights to either the organization or the administrative group that contains the server that you want to upgrade.

In versions of Exchange 2000 that are earlier than Exchange 2000 Server SP3, you must have only Exchange Administrator rights (not Exchange Full Administrator rights) on stand-alone (non-clustered) Exchange 2000 servers. This change occurred because of security enhancements that were first implemented in Exchange 2000 Server SP3.

For additional information about security enhancements that were first implemented in Exchange 2000 Server SP3, click the following article number to view the article in the Microsoft Knowledge Base:

816789 Read Access to the Everyone Group Is Removed After You Install Exchange 2000 S816789

IMPORTANT: The permissions that you must have to upgrade to Exchange 2000 Server SP3 may be different in the following scenarios:

If you upgrade to Exchange 2000 Server SP3 on clusters, you must have Exchange Full Administrator permissions at the organization level.
If you upgrade Exchange 2000 Key Management servers, you must have Enterprise Administrator and Exchange Full Administrator permissions at the organization level. This permission level is required to modify certificate templates in the configuration container during the service pack installation. The Windows Certificate Server, which is not a part of the Exchange organization, is contacted for this purpose, so Enterprise Administrator or Exchange Full Administrator permissions are required. The Windows Certificate Server is not part of the Exchange Server organization.
If you upgrade a computer that is a member server on which only Exchange System Manager is installed, you only have to have Local Administrator permissions on the local computer.