Exchange 2010 SP2: Different problems with E_ACCESSDENIED on exchange servers

Question

Hello All,
I'm observing a strange problem in an AD 2008 R2 / Exchange 2010 SP2 environment:
When creating a DAG and adding 1 or more servers to the DAG, the following error occurs:
Summary: 2 item(s). 0 succeeded, 2 failed.
Elapsed time: 00:00:05
<MAILBOX SERVER 1> Failed
Error:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Exchange Management Shell command attempted:
Add-DatabaseAvailabilityGroupServer -MailboxServer '<MAILBOX SERVER 1>' -Identity '<NAME DAG>'
Elapsed Time: 00:00:02
<MAILBOX SERVER 2> Failed
Error:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Exchange Management Shell command attempted:
Add-DatabaseAvailabilityGroupServer -MailboxServer '<MAILBOX SERVER 2>' -Identity '<NAME DAG>'
Elapsed Time: 00:00:02
There are no logs created on the Mailservers, so I have no more detailed information. Where to start with troubleshooting this issue?
Edit: BTW I already checked the local admin membership of the "Exchange Trusted Subsystem" domain group.
Also commands like get-owavirtualdirectory give the Access Denied error (except on the CAS servers themselves).
You know you're an engineer when you have no life and can prove it mathematically

Answer 1

Hi Frank,
The DAG is not yet populated. When inserting the first server(s) in the freshly created DAG, the error appeared.
[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>Get-DatabaseAvailabilityGroup
Name             Member Servers                                     
Operational Servers
IICT-DAG-002     {}
[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>Get-DatabaseAvailabilityGroup IICT-DAG-002 -Status | fl
RunspaceId                             : cc985264-fa89-48f8-8aba-c1b0c89eb097
Name                                   : IICT-DAG-002
Servers                                : {}
WitnessServer                          : iict-srvp00-011.insourceict.local
WitnessDirectory                       : C:\IICT-DAG-002
AlternateWitnessServer                 :
AlternateWitnessDirectory              :
NetworkCompression                     : InterSubnetOnly
NetworkEncryption                      : InterSubnetOnly
DatacenterActivationMode               : Off
StoppedMailboxServers                  : {}
StartedMailboxServers                  : {}
DatabaseAvailabilityGroupIpv4Addresses : {10.100.0.54}
DatabaseAvailabilityGroupIpAddresses   : {10.100.0.54}
AllowCrossSiteRpcClientAccess          : False
OperationalServers                     :
PrimaryActiveManager                   :
ServersInMaintenance                   :
ThirdPartyReplication                  : Disabled
ReplicationPort                        : 0
NetworkNames                           : {}
WitnessShareInUse                      :
AdminDisplayName                       :
ExchangeVersion                        : 0.10 (14.0.100.0)
DistinguishedName                      : CN=IICT-DAG-002,CN=Database Availability Groups,CN=Exchange Administrative Gro
                                         up (FYDIBOHF23SPDLT),CN=Administrative
Groups,CN=InsourceICT,CN=Microsoft Exch
                                         ange,CN=Services,CN=Configuration,DC=insourceict,DC=local
Identity                               : IICT-DAG-002
Guid                                   : 71d5d869-03ac-4f8a-8de7-fc15bc6a0ae1
ObjectCategory                         : insourceict.local/Configuration/Schema/ms-Exch-MDB-Availability-Group
ObjectClass                            : {top, msExchMDBAvailabilityGroup}
WhenChanged                            : 8-6-2012 14:35:59
WhenCreated                            : 8-6-2012 13:35:21
WhenChangedUTC                         : 8-6-2012 12:35:59
WhenCreatedUTC                         : 8-6-2012 11:35:21
OrganizationId                         :
OriginatingServer                      : IICT-SRV003.insourceict.local
IsValid                                : True
You know you're an engineer when you have no life and can prove it mathematically