You receive an "Access is denied" error message when you try to create the System Attendant resource on an Exchange Server 2003 cluster

When you try to create the System Attendant resource on a Microsoft Exchange Server 2003 cluster, you receive the following error message: Additionally, the following information is logged in the Exchange Server Setup Progress.log file:

This issue may occur if either of the following conditions is true:

• The Remote Registry Service is not running.
• Remote access to the registry is restricted.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this issue, make sure that Remote Registry Service is running. Then, determine whether the issue is resolved. If the issue is resolved, do not perform the following procedure.

If the issue is not resolved, restore the default permissions to the registry subkey to allow Exchange Server 2003 to access the registry. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
3. Right-click the winreg subkey, and then click Permissions.
4. Click Advanced. Then, add the following accounts and the corresponding permissions to the Permission entries list.

   Type	Name	Permission	Apply to
   Allow	Administrator	Full Control	This key only
   Allow	Administrators	Full Control	This key only
   Allow	Backup Operators	Read	This key only
   Allow	Domain Admins	Full Control	This key only
   Allow	Enterprise Admins	Full Control	This key only
   Allow	EXCHANGE$	Full Control	This key only
   Allow	Exchange Domain Servers	Read	This key only
   Allow	LOCAL SERVICE	Read	This key and subkeys

   Note EXCHANGE$ is the name of the cluster node whose registry is being modified.
5. Click Apply, and then click OK two times.
6. Quit Registry Editor.

To allow the Full Control permission, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
3. Right-click the winreg subkey, and then click Permissions.
4. Click the user, click Advanced, click Edit, and then click to select the following check boxes in the Allow column under Permissions:
   • Query Value
   • Set Value
   • Create Subkey
   • Enumerate Subkeys
   • Notify
   • Create Link
   • Delete
   • Write DAC
   • Write Owner
   • Read Control

To allow the Read permission, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
3. Right-click the winreg subkey, and then click Permissions.
4. Click the user, click Advanced, click Edit, and then click to select the following check boxes in the Allow column under Permissions:
   • Query Value
   • Enumerate Subkeys
   • Notify
   • Read Control