Users cannot access Outlook Web Access after you apply security templates from the Security Operations Guide for Windows 2000

After you apply the Group Policy templates that are described in the Security Operations Guide for Windows 2000, when a Microsoft Outlook Web Access (OWA) user tries to log on to Microsoft Exchange Server 2003, that user receives the following error message: Additionally, the following event appears in the security log in Event Viewer on the active cluster node:

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: date
Time: time
User: S-1-5-21-1292428093-2111687655-839522115-21305
Computer: clusternodeA
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: ClusSvc
Handle ID: -
Operation ID: {0,19279754}
Process ID: 320 [this is services.exe]
Primary User Name: clusternodeA$
Primary Domain: contoso.com
Primary Logon ID: (0x0,0x3E7)
Client User Name: owa-username
Client Domain: contoso.com
Client Logon ID: (0x0,0x1260FEE)
Accesses: READ_CONTROL Query service configuration information Query status of service Enumerate dependencies of service Query information from service
Access

This behavior occurs because the OWA user does not have Read access permissions to the Cluster service (Clussvc.exe) on the cluster node. When you start Exchange Server on a cluster node, the first user to access OWA requires Read permissions to the Cluster service on that node. When you apply the Group Policy templates that are provided in the Security Operations Guide for Windows 2000 to the cluster nodes, this access permission may be removed. Therefore, the OWA user does not have sufficient permissions to sign in to OWA.

This issue may occur when you import and configure the Baseline.inf and the Exchange Backend Incremental.inf security templates in the policy settings that you apply to the server cluster.

To resolve this issue, modify the Group Policy object that you used to apply the Group Policy templates from the Security Operations Guide for Windows 2000 to give the OWA users Read access to the Cluster Service. To do this, follow these steps:

1. Log on to a domain controller, and then start the Active Directory Users and Computers snap-in.
2. Right-click the domain or the organizational unit where your server cluster is located, and then click Properties.
3. Click the Group Policy object that you used to apply the security settings from the Security Operations Guide for Windows 2000, and then click Edit.
4. Expand Computer Configuration, expand Windows Settings, expand Security Settings, and then click System Services.
5. In the right pane, double-click ClusSvc.
6. Click Edit Security, and then click Add.
7. Depending on your environment and depending on your security considerations, add the OWA users, and then click OK.
   
   For example, you may want to add one of the following security groups:
   • Authenticated Users
   • Domain Users
   • Everyone
8. In the Name list, click the security group that you added, click to clear all the check boxes in the Allow column of the Permissions box, and then click to select the Read check box in the Allow column.
9. Click OK, and then click OK.
10. Exit the Group Policy tool, click Apply, and then click OK.
11. Restart the cluster node computers, or manually update Group Policy on each cluster node.
    
    To manually update Group Policy, run the following command on each cluster node:
    secedit /refreshpolicy machine_policy

To obtain the Security Operations Guide for Windows 2000, visit the following Microsoft Web site: To obtain the templates that are described in the Security Operations Guide for Windows 2000, visit the following Microsoft Web site: