Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error message is Access is denied.”

Today, I had a problem with my lab installation of Exchange 2010. The setup is pretty simple of a mixed mode organization having an Exchange 2003 SP2, Exchange Server 2007 SP2 32Bit, and an Exchange 2007 RC1 setup in it.

After installation I noticed that, when I open EMC on Exchange 2010 server and click on Client Access server role under server management node I get a weird error as below:


The EMS on Exchange 2010 server showed up the red lines of death too.

PS] C:>Get-OwaVirtualDirectory |FL
An IIS directory entry couldn’t be created. The error message is Access is deni
. HResult = -2147024891
+ CategoryInfo          : NotInstalled: (GLEX2007owa (Default Web Site):A
DObjectId) [Get-OwaVirtualDirectory], IISGeneralCOMException
+ FullyQualifiedErrorId : 46C81F27,Microsoft.Exchange.Management.SystemCon


Turns out, if I have Exchange 2007 server in co-existence with Exchange 2010 the security group “Exchange Trusted Subsystem” needs to be a member of Local Administrators group on an Exchange Server 2007 box.


And, that should be it. The error went away as soon as the security group Exchange Trusted Subsystem was added to local admins group on Exchange server 2007.

Thanks to Henrik for helping me out on this. 🙂

18 thoughts on “Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error message is Access is denied.””

  1. I am having the same issue however Exchange 2007 is installed on a Domain Controller (Yes, I know it should not have been. It was done by the previous engineer here). Any ideas? I have added “Exchange Trusted Subsystem ” to the Domain Admins group withno success.

  2. Was able to solve this on a 2003 DC running Exchange 2007 by:

    Opening Internet Information Service (IIS) Manager
    Expanding to SERVER (local Computer) -> Web Sites -> Default Web Site
    Right Click on Default Web Site and choose Permissions
    Add Exchang Trusted Subsystem and grant Full Control
    Restart IIS
    Reboot your 2010 Exchange Server

  3. installed a exch 2010 with coex 2007 today…
    this error was something!!!
    just what i needed!!
    it works now!!

  4. Thank God for Google :)…..

    …. and thank you for this fix as I can now configure OWA on 2010!!

  5. Interesting, I just ran into this self same problem with 2k7 sp3, and stumbled on this workaround – which still works, so wondering if the issue has been unfixed in sp3?

  6. but i still hav the issue. My exchange 2010 is running on domain controller so i add exchange trusted system to administrator group under bultin. Also rebooted ex2007 server and ex2010 server. No sucess
    Then i given full permission to Exchange trusted system on default website at ex2007 server and rebooted IIS and 2010 server. but no success.

  7. @Kuldeep: “Exchange Trusted System” should be in the Local Administrator group on the Exchange 2007 server. Seems you put it in there on the 2010 server. You don’t need to do anything to IIS’ default website – so your last step was unnecessary.

  8. @ Kuldeep. Sorry for the delayed response. CaltonCat is correct. You must add the Exchange Trusted SubSystem Group in group membership of local administrators on Exchange 2007 Server NOT Exchange 2010. Exchange 2010 servers get this group added automatically.

Comments are closed.