Exchange Geek's Weblog

I'm a Geek!

Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error message is Access is denied.”

Posted by Milind Naphade on 18/09/2009

Today, I had a problem with my lab installation of Exchange 2010. The setup is pretty simple of a mixed mode organization having an Exchange 2003 SP2, Exchange Server 2007 SP2 32Bit, and an Exchange 2007 RC1 setup in it.

After installation I noticed that, when I open EMC on Exchange 2010 server and click on Client Access server role under server management node I get a weird error as below:


The EMS on Exchange 2010 server showed up the red lines of death too.

PS] C:\>Get-OwaVirtualDirectory |FL
An IIS directory entry couldn’t be created. The error message is Access is deni
. HResult = -2147024891
+ CategoryInfo          : NotInstalled: (GLEX2007\owa (Default Web Site):A
DObjectId) [Get-OwaVirtualDirectory], IISGeneralCOMException
+ FullyQualifiedErrorId : 46C81F27,Microsoft.Exchange.Management.SystemCon


Turns out, if I have Exchange 2007 server in co-existence with Exchange 2010 the security group “Exchange Trusted Subsystem” needs to be a member of Local Administrators group on an Exchange Server 2007 box.


And, that should be it. The error went away as soon as the security group Exchange Trusted Subsystem was added to local admins group on Exchange server 2007.

Thanks to Henrik for helping me out on this. 🙂


18 Responses to “Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error message is Access is denied.””

  1. Jan said

    it helped. 😀

    cool workaround… 😀

  2. Sean Williams said

    I am having the same issue however Exchange 2007 is installed on a Domain Controller (Yes, I know it should not have been. It was done by the previous engineer here). Any ideas? I have added “Exchange Trusted Subsystem ” to the Domain Admins group withno success.

  3. Sean Williams said

    Was able to solve this on a 2003 DC running Exchange 2007 by:

    Opening Internet Information Service (IIS) Manager
    Expanding to SERVER (local Computer) -> Web Sites -> Default Web Site
    Right Click on Default Web Site and choose Permissions
    Add Exchang Trusted Subsystem and grant Full Control
    Restart IIS
    Reboot your 2010 Exchange Server

  4. Great. Thanks for posting, Sean.

  5. kurt said

    installed a exch 2010 with coex 2007 today…
    this error was something!!!
    just what i needed!!
    it works now!!

  6. NZRegs said

    Perfect solution! Thanks!!

  7. Robert said

    Thanks – what a lifesaver. Exchange 2010 Prerequisite check gets a C- in my book.

  8. Chris said

    Excellent! Thank you!

  9. MiKeDaDoC said

    Exactly what I was looking for 🙂


  10. CharlesM said

    Thanks a bunch! Required on ALL 2007 servers in Organization, but solved problem immediately!

  11. John Thorpe said

    Thank God for Google :)…..

    …. and thank you for this fix as I can now configure OWA on 2010!!

  12. […] Get-OWAVirtualDirectory returns “An IIS directory entry couldn't be created. The error message…[…]

  13. ColtonCat said

    Interesting, I just ran into this self same problem with 2k7 sp3, and stumbled on this workaround – which still works, so wondering if the issue has been unfixed in sp3?

  14. […] “Get-OWAVirtualDirectory returns “An IIS directory entry couldn’t be created. The error me… […]

  15. Kuldeep said

    but i still hav the issue. My exchange 2010 is running on domain controller so i add exchange trusted system to administrator group under bultin. Also rebooted ex2007 server and ex2010 server. No sucess
    Then i given full permission to Exchange trusted system on default website at ex2007 server and rebooted IIS and 2010 server. but no success.

  16. ColtonCat said

    @Kuldeep: “Exchange Trusted System” should be in the Local Administrator group on the Exchange 2007 server. Seems you put it in there on the 2010 server. You don’t need to do anything to IIS’ default website – so your last step was unnecessary.

  17. @ Kuldeep. Sorry for the delayed response. CaltonCat is correct. You must add the Exchange Trusted SubSystem Group in group membership of local administrators on Exchange 2007 Server NOT Exchange 2010. Exchange 2010 servers get this group added automatically.

  18. […] בבלוג של ה Exchange Geek פורסם מאמר שהציע לכאורה פיתרון מעניין בסוגיה. בבדיקה הסתבר כי שרת ה Exchange 2007 שודרג כבר לגרסת העדכון […]

Sorry, the comment form is closed at this time.

%d bloggers like this: