Symptoms
Consider the following scenario:
-
An organization admin uses setup.exe with the /NewProvisionedServer switch to let a delegated admin complete the installation of an additional Exchange Server in a Microsoft Exchange Server 2013 environment.
-
When a member of the Exchange Delegated Setup security group tries to run setup.exe to complete the installation of the pre-provisioned Exchange Server.
In this scenario, setup may fail.
Additionally, you receive the following error message:
[ERROR] Active Directory operation failed on Exchange.contoso.com. This error is not retriable. Additional information: Insufficient access rights to perform the operation. Active directory response: 00002098: SecErr: DSID-XXXXXXXX, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 [ERROR] The user has insufficient access rights. Ending processing add-ManagedAvailabilityServerGroupMember
Cause
This issue occurs because the target server is not a member of the Managed Availability Server Group when the delegated admin runs setup.
Resolution
To fix this issue, install Cumulative Update 17 or a later cumulative update for Exchange Server 2013 before you run setup.exe with the /NewProvisionedServer switch.
Workaround
To work around this issue without using Cumulative Update 17 or a later cumulative update for Exchange Server 2013, add the target server to the Managed Availability Server Group.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
References
Learn about the terminology that Microsoft uses to describe software updates.
