Consider the following scenario:

  • An organization admin uses setup.exe with the /NewProvisionedServer switch to let a delegated admin complete the installation of an additional Exchange Server in a Microsoft Exchange Server 2013 environment.

  • When a member of the Exchange Delegated Setup security group tries to run setup.exe to complete the installation of the pre-provisioned Exchange Server.

In this scenario, setup may fail.

Additionally, you receive the following error message:

[ERROR] Active Directory operation failed on This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-XXXXXXXX, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

[ERROR] The user has insufficient access rights.
Ending processing add-ManagedAvailabilityServerGroupMember


This issue occurs because the target server is not a member of the Managed Availability Server Group when the delegated admin runs setup.


To fix this issue, install Cumulative Update 17 or a later cumulative update for Exchange Server 2013 before you run setup.exe with the /NewProvisionedServer switch.


To work around this issue without using Cumulative Update 17 or a later cumulative update for Exchange Server 2013, add the target server to the Managed Availability Server Group.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.


Learn about the terminology that Microsoft uses to describe software updates.

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Thank you for your feedback!