When you run Setup, it verifies permissions on the existing administrative groups. Setup expects the permissions to occur in the following ascending order:
- Read
- Read and Write
- Read, Write, and SetPerms
If the security permissions have not replicated throughout the whole domain, the permissions may not be present in the ascending order that Setup expects. For example, if you view the Exchange Server Setup Progress.log file, the following information may be logged:
[10:50:43] Checking permissions on the admin group: /dc=com/dc=example/cn=Configuration/cn=Services/cn=Microsoft Exchange/cn=OrganizationName/cn=Administrative Groups/cn=Group-1
[10:50:43] We have permission ExchAG_Read
[10:50:43] We have permission ExchAG_Write
[10:50:43] Checking permissions on the admin group: /dc=com/dc=example/cn=Configuration/cn=Services/cn=Microsoft Exchange/cn=OrganizationName/cn=Administrative Groups/cn=Group-2
[10:50:43] We have permission ExchAG_Read
[10:50:43] We have permission ExchAG_Write
[10:50:43] Checking permissions on the admin group: /dc=com/dc=example/cn=Configuration/cn=Services/cn=Microsoft Exchange/cn=OrganizationName/cn=Administrative Groups/cn=Group-3
[10:50:43] We have permission ExchAG_Read
[10:50:43] We have permission ExchAG_SetPerms
[10:50:43] Final set of permissions: 0X40C040E0
In this example, Setup locates three administrative groups and determines that sufficient permissions are present to start the Exchange Server 2003 installation. However, the permissions are not present in the ascending order that Setup expects (the third administrative group has Read and SetPerms permissions, but not Write permission). When Setup examines the list of administrative groups to determine the groups that you can install Exchange Server 2003 in, it determines that none of the groups qualify.
When no group qualifies, Setup tries to create an administrative group named First Administrative Group and tries to install Exchange Server 2003 in it. If you are not logged on as an organization-level administrator, Setup is unsuccessful when it tries to create the administrative group and "Access denied" errors are logged.