requested registry access is not allowed 1

[ronin2307]

I get this error a lot. It even shows up when I try to enter the license key.
I have installed ex2007 on a brand new and fresh 03 64 bit R2 server and the installation on the client access and mailbox roles fail as well with this error.
I have run all the prep steps already.
Any ideas? I am so frustrated with this...

The install was done under the ENTERPRISE admin account

 

[Zelandakh]

Enterprise Admin needs to be local admin, domain admin (I think) and schema admin.

 

[ronin2307]

it is :-(

 

[Zelandakh]

ooh. Interesting. Not seen that one. Remote registry service running?

 

[ronin2307]

yes that too :-(

 

[Zelandakh]

Try running the prep steps again. Almost feels like an adprep problem. Haven't got a fresh R2 server to test it on though :-(

 

[ronin2307]

i can try that but they all finished without issues

 

[Zelandakh]

Is the proposed Ex2007 server a DC?

 

[ronin2307]

negative. just a member server

 

[Zelandakh]

Is the DC accessible on the LAN directly with nothing in between? Nothing untoward in the event log?

 

[ronin2307]

ok with help from ms I have found the problem and it has been fixed.
my default domain policy was setting certain permissions on a key that was needed for installation and they were not correct. what bugs me is that this was DEFAULT 2003 policy yet it was incompatible with the 2007 exchange. anyway...
the issue has been resolved after 2 days on the phone with those guys.
thanx for all of your ideas as well

 

[Zelandakh]

If that is the default domain policy in AD, then nothing is applied by default out of the box AFAIK so it has been modified unless you know otherwise.

Can you post in this thread which settings were incorrect and what was done to fix this - if it is a standard setting and I'm incorrect in my assumption above, others will want to know.

 

[ronin2307]

i am almost positive that it is default setting. I am the only one here in the IT dept. and the only one who knows what group policies are. so there is no chance anybody else did it.
and I have never messed with registry setting through the GP either.

this was the key in question


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg]

and it needed full permission for LOCAL SERVICE and SYSTEM and read permission for everybody