1. Exchange 2010 Access is denied error when you want to manage the CAS role
2. Exchange 2007 sp2 upgrade failure
3. Access Denied – When trying to Enable the Publishing Feature
Exchange 2010 Access is denied error when you want to manage the CAS role

Running Exchange 2007 has had its pros and cons. Now that Exchange 2010 is out we want to take advantage of the new features you need do the Exchange migrations. After installing Exchange 2010 server in an Exchange 2007 server environment can give some quirky results. After the installation Exchange 2010 and open the Exchange management console you go to Microsoft Exchange On-Premises -> ServerConfiguration -> Client Access and you will receive the following error message.

What the command does is reads the Active Directory objects to see all the registered OWA virtual directories. The virtual directories you retrieve are the virtual directories from Exchange 2010 but also from Exchange 2007. Next the command connects to these directories and needs admin rights. This is exactly where the problem is. Exchange 2010 creates a few new groups and one of them is Exchange Trusted Subsystem. Exchange Trusted Subsystem is automatically added to the local administrators group of the Exchange 2010 server but not on the Exchange 2007 servers. This is the problem! All you need to do is add the Exchange Trusted Subsystem to the local administrators group on the Exchange 2007 CAS servers and restart the server.
Now when we run the “Get-OwaVirtualDirectory” in powershell we see:
[PS] C:\Windows\system32>Get-OwaVirtualDirectory
Name Server OwaVersion
—- —— ———-
Exchange (Default Web Site) Exchange2003or2000
Public (Default Web Site) Exchange2003or2000
Exadmin (Default Web Site) Exchange2003or2000

owa (Default Web Site) Exchange2010
In the GUI you will only see the Exchange 2010 sever OWA configuration.