You receive an "Access is denied" error message when you try to create the System Attendant resource on an Exchange Server 2003 cluster (906906)


The information in this article applies to:

  • Microsoft Exchange Server 2003 Standard Edition
  • Microsoft Exchange Server 2003 Enterprise Edition

Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

When you try to create the System Attendant resource on a Microsoft Exchange Server 2003 cluster, you receive the following error message:
Access is denied.
Facility: Win32
ID no: c0070005
Microsoft Exchange Cluster Administrator Extension
Additionally, the following information is logged in the Exchange Server Setup Progress.log file:

[09:06:06] Entering ScGetExchangeServicesInstallPathFromRegistry
[09:06:06] ScGetExchangeServicesInstallPathFromRegistry
(f:\titanium\admin\src\libs\exsetup\exmisc.cxx:4353)
Error code 0XC0070005 (5): Access is denied.
[09:06:06] Leaving ScGetExchangeServicesInstallPathFromRegistry
[09:06:06] ScSetupExchangeVirtualServer
(f:\titanium\admin\src\udog\exsetdata\exsetds.cxx:1422)
Error code 0XC0070005 (5): Access is denied.
[09:06:06] Leaving ScSetupExchangeVirtualServer

CAUSE

This issue may occur if either of the following conditions is true:
  • The Remote Registry Service is not running.
  • Remote access to the registry is restricted.

RESOLUTION

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this issue, make sure that Remote Registry Service is running. Then, determine whether the issue is resolved. If the issue is resolved, do not perform the following procedure.

If the issue is not resolved, restore the default permissions to the winreg registry subkey to allow Exchange Server 2003 to access the registry. To do this, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

  3. Right-click the winreg subkey, and then click Permissions.
  4. Click Advanced. Then, add the following accounts and the corresponding permissions to the Permission entries list.
    TypeName Permission Apply to
    Allow AdministratorFull ControlThis key only
    AllowAdministratorsFull ControlThis key only
    AllowBackup OperatorsReadThis key only
    AllowDomain AdminsFull ControlThis key only
    AllowEnterprise AdminsFull ControlThis key only
    AllowEXCHANGE$Full ControlThis key only
    AllowExchange Domain ServersReadThis key only
    AllowLOCAL SERVICEReadThis key and subkeys
    Note EXCHANGE$ is the name of the cluster node whose registry is being modified.
  5. Click Apply, and then click OK two times.
  6. Quit Registry Editor.

MORE INFORMATION

To allow the Full Control permission, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

  3. Right-click the winreg subkey, and then click Permissions.
  4. Click the user, click Advanced, click Edit, and then click to select the following check boxes in the Allow column under Permissions:
    • Query Value
    • Set Value
    • Create Subkey
    • Enumerate Subkeys
    • Notify
    • Create Link
    • Delete
    • Write DAC
    • Write Owner
    • Read Control
To allow the Read permission, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

  3. Right-click the winreg subkey, and then click Permissions.
  4. Click the user, click Advanced, click Edit, and then click to select the following check boxes in the Allow column under Permissions:
    • Query Value
    • Enumerate Subkeys
    • Notify
    • Read Control
Modification Type:MajorLast Reviewed:9/13/2005
Keywords:kbprb kbexchESM KB906906 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.