Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error message is Access is denied.”


Today, I had a problem with my lab installation of Exchange 2010. The setup is pretty simple of a mixed mode organization having an Exchange 2003 SP2, Exchange Server 2007 SP2 32Bit, and an Exchange 2007 RC1 setup in it.

After installation I noticed that, when I open EMC on Exchange 2010 server and click on Client Access server role under server management node I get a weird error as below:

image

The EMS on Exchange 2010 server showed up the red lines of death too.

PS] C:>Get-OwaVirtualDirectory |FL
An IIS directory entry couldn’t be created. The error message is Access is deni
ed.
. HResult = -2147024891
+ CategoryInfo          : NotInstalled: (GLEX2007owa (Default Web Site):A
DObjectId) [Get-OwaVirtualDirectory], IISGeneralCOMException
+ FullyQualifiedErrorId : 46C81F27,Microsoft.Exchange.Management.SystemCon
figurationTasks.GetOwaVirtualDirectory

image

Turns out, if I have Exchange 2007 server in co-existence with Exchange 2010 the security group “Exchange Trusted Subsystem” needs to be a member of Local Administrators group on an Exchange Server 2007 box.

image

And, that should be it. The error went away as soon as the security group Exchange Trusted Subsystem was added to local admins group on Exchange server 2007.

Thanks to Henrik for helping me out on this. :-)

September 18, 2009   Posted in: Exchange 2010

18 Responses

  1. Jan - November 11, 2009

    it helped. :D

    cool workaround… :D

  2. Sean Williams - November 11, 2009

    I am having the same issue however Exchange 2007 is installed on a Domain Controller (Yes, I know it should not have been. It was done by the previous engineer here). Any ideas? I have added “Exchange Trusted Subsystem ” to the Domain Admins group withno success.

  3. Sean Williams - November 11, 2009

    Was able to solve this on a 2003 DC running Exchange 2007 by:

    Opening Internet Information Service (IIS) Manager
    Expanding to SERVER (local Computer) -> Web Sites -> Default Web Site
    Right Click on Default Web Site and choose Permissions
    Add Exchang Trusted Subsystem and grant Full Control
    Restart IIS
    Reboot your 2010 Exchange Server

  4. Exchange Geek - November 12, 2009

    Great. Thanks for posting, Sean.

  5. kurt - November 20, 2009

    installed a exch 2010 with coex 2007 today…
    this error was something!!!
    just what i needed!!
    it works now!!
    thanks

  6. NZRegs - November 20, 2009

    Perfect solution! Thanks!!

  7. Robert - November 21, 2009

    Thanks – what a lifesaver. Exchange 2010 Prerequisite check gets a C- in my book.

  8. Chris - December 21, 2009

    Excellent! Thank you!

  9. MiKeDaDoC - December 24, 2009

    Exactly what I was looking for :-)

    Thanks!!

  10. CharlesM - December 31, 2009

    Thanks a bunch! Required on ALL 2007 servers in Organization, but solved problem immediately!

  11. John Thorpe - January 27, 2010

    Thank God for Google :) …..

    …. and thank you for this fix as I can now configure OWA on 2010!!

  12. Exchange Server 2007 SP2 RU2 available for download « Exchange Geek's Weblog - January 30, 2010

    [...] Get-OWAVirtualDirectory returns “An IIS directory entry couldn't be created. The error message…[...]

  13. ColtonCat - July 16, 2010

    Interesting, I just ran into this self same problem with 2k7 sp3, and stumbled on this workaround – which still works, so wondering if the issue has been unfixed in sp3?

  14. Juergen Hasslauer » Blog Archive » Exchange Trusted Subsystem - August 2, 2010

    [...] “Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error me… [...]

  15. Kuldeep - September 21, 2010

    but i still hav the issue. My exchange 2010 is running on domain controller so i add exchange trusted system to administrator group under bultin. Also rebooted ex2007 server and ex2010 server. No sucess
    Then i given full permission to Exchange trusted system on default website at ex2007 server and rebooted IIS and 2010 server. but no success.

  16. ColtonCat - September 21, 2010

    @Kuldeep: “Exchange Trusted System” should be in the Local Administrator group on the Exchange 2007 server. Seems you put it in there on the 2010 server. You don’t need to do anything to IIS’ default website – so your last step was unnecessary.

  17. Exchange Geek - September 21, 2010

    @ Kuldeep. Sorry for the delayed response. CaltonCat is correct. You must add the Exchange Trusted SubSystem Group in group membership of local administrators on Exchange 2007 Server NOT Exchange 2010. Exchange 2010 servers get this group added automatically.

  18. בעיות נפוצות בעת הטמעת Exchange 2010 | האתר של נתנאל בן-שושן - October 2, 2010

    [...] בבלוג של ה Exchange Geek פורסם מאמר שהציע לכאורה פיתרון מעניין בסוגיה. בבדיקה הסתבר כי שרת ה Exchange 2007 שודרג כבר לגרסת העדכון [...]