Select the product you need help with

FIX: "Access is denied" status error when you use a delegated user account to try to monitor services in Forefront Threat Management Gateway 2010

Article ID: 2701952 - View products that this article applies to.

SYMPTOMS

Consider the following scenario:

You use a Microsoft Forefront Threat Management Gateway 2010 array that contains several users in a workgroup.
You delegate the administration of the array to a user account that is not part of the built-in administrator account.
The user account is mirrored on each member server of the array and is part of the local Administrators group of each member server.
You use the user account to open Microsoft Management Console (MMC) in Forefront Threat Management Gateway from one of the following:
- A member server that is not the "Report Server"
- A Forefront Threat Management Gateway remote management computer.
You try to monitor the Forefront Threat Management Gateway services on the Services tab.

In this scenario, you notice that the SQL Server (ISARS) and SQL Server Reporting Services (ISARS) services are running on the Report Server and that these services report the following status error:

Service status cannot be determined: Access is denied.

Note This same status error can be seen for the Email protection service if the service is being used on the array. Additionally, the following services display the same status error:

Exchange Edge Transport Server role
Microsoft Protection for Exchange Server 2010

Back to the top | Give Feedback

CAUSE

This problem occurs because Forefront Threat Management Gateway does not set the service permissions in such a way that the user account can query the status of the services.

Back to the top | Give Feedback