"Insufficient access rights" error when you run setup.exe as member of "Delegated Setup" group in Exchange Server 2013

Consider the following scenario:

• An organization admin uses setup.exe with the /NewProvisionedServer switch to let a delegated admin complete the installation of an additional Exchange Server in a Microsoft Exchange Server 2013 environment.
• When a member of the Exchange Delegated Setup security group tries to run setup.exe to complete the installation of the pre-provisioned Exchange Server.

In this scenario, setup may fail.

Additionally, you receive the following error message:

[ERROR] Active Directory operation failed on Exchange.contoso.com. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-XXXXXXXX, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

[ERROR] The user has insufficient access rights.
Ending processing add-ManagedAvailabilityServerGroupMember

This issue occurs because the target server is not a member of the Managed Availability Server Group when the delegated admin runs setup.

To fix this issue, install Cumulative Update 17 or a later cumulative update for Exchange Server 2013 before you run setup.exe with the /NewProvisionedServer switch.

To work around this issue without using Cumulative Update 17 or a later cumulative update for Exchange Server 2013, add the target server to the Managed Availability Server Group.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Learn about the terminology that Microsoft uses to describe software updates.