Error message when a user who has View Only Administrator permissions runs commands on an Exchange server that has the Client Access Server (CAS) role installed: "Access is denied"

Consider the following scenario. In an Exchange Server 2007 environment, you delegate a user. You give the user View Only Administrator permissions. The user then runs one of the following commands on an Exchange server that has the Client Access Server (CAS) role installed:

• Get-OwaVirtualDirectory
• get-ActiveSyncVirtualDirectory
• Get-OabVirtualDirectory

In this scenario, the command fails, and the user receives an "Access is denied" error message that resemble of the following error messages:Additionally, the user cannot view the CAS properties through the Exchange Management Console (EMC).

This problem occurs because access to the Metabase in Internet Information Server (IIS) is restricted to the user if the user has no local administrative rights. This restriction prevents the Exchange management functions from finishing and providing the details of the CAS configuration.

To administer CAS servers in Microsoft Exchange 2007, the administrator requires local administrator rights. The local rights provide access to the Metabase on the Exchange server that has the CAS role installed.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.