Installation of Client Access role fails on Windows Server 2008 R2 (Execution of: "$error.Clear(); I

Not open for further replies.



I am trying to install Exchange Server 2010 beta 1 onto a Windows Server 2008 R2 (build 7000) machine which has also been set up as a domain controller.

However when attempting to install the Client Access role, setup fails with the error below.

Does anyone know of a way to get around this please?

I have already searched for this error and not found any similar threads.

Also every time I press the code button on this forum it crashes the browser and I keep losing the message! (IE8 from within Server R2). Also the message box is very small, will not expand and keeps jumping to the top.



Summary: 4 item(s). 1 succeeded, 1 failed. 
Elapsed time: 00:00:01 
Preparing Setup 
Elapsed Time: 00:00:00 
Client Access Role 
The execution of: " $error.Clear(); Install-ExchangeCertificate -services " IIS, POP, IMAP"  -DomainController $RoleDomainController" , generated the following error: " Could not grant Network Service access to the certificate with thumbprint 2F320F5D5B5C6873E54C8AB57F604D8AFA31D18C because a cryptographic exception was thrown." . 
Could not grant Network Service access to the certificate with thumbprint 2F320F5D5B5C6873E54C8AB57F604D8AFA31D18C because a cryptographic exception was thrown. 
Access is denied. 
Elapsed Time: 00:00:01 
Mailbox Role 
Finalizing Setup 
Robin Wilson

Andreas Helland

It's not exactly recommended installing Exchange on a Domain Controller, but apart from that there is a requirement for the Exchange 2010 Beta to be installed in a Windows 2003 domain functional level. I haven't checked installing AD DS on 2008 R2 Beta but doesn't that default to the Windows 2008 domain functional level?

Brian Day MCITP [MVP]

If you can, don't install Exchange on a DC. You may have to make " Exchange Trusted Subsystem" a member of the Domain Admins groups since there really isn't a local admins group on a DC.Brian Day / MCSA / CCNA, Exchange/AD geek.

Chinthaka Shameera

Exchange 2010 on DC scenario is not recommend by Microsoft.if you can try after reinstall IIS components and .Net framework.

Walter Steinsdorfer [MVP]


the network service has no access to the client certificate store in wich the certificate was importet. Did you do this manually or do you use the self-signed cert coming with the installation?Viele Grüße Walter Steinsdorfer MVP Exchange Server



Thanks for all the replies.

I have since wiped the system and installed everything again and it all worked this time so not sure what was wrong last time. I did try to uninstall all Exchange components and then uninstall IIS and Application server, reboot and re-install but I received the same error still when it came to installing the client access role.

Walter: I just attempted the standard installation which should have used the default self-signed certificate. Everything was a fresh install done at the same time on a freshly formatted PC.

For info last time when it failed to work:

- Installed Windows Server 2008 R2

- Installed Domain Controller role using dcpromo. I set the forest and domain as Windows Server 2008 R2

- Added a forest trust between main domain and test Exchange domain (set up as ex2010.local)

- Installed IIS and Application Server role

- Installed Hyper-v role

- Installed Desktop Experience feature

- Installed Exchange and recieved the error

When it worked I set up the forest and domain in Windows Server 2008 mode (i.e. not R2), installed Exchange first and then set up the forest trust and then Hyper-v. It did say it failed to configure dns which was probably because it started trying to do automatic updates half way through the dcpromo! DNS seems to work ok though.

I did notice this time that Hyper-v gave a warning about the virtual network adapter not being set up correctly and the local network did not work correctly although I could access the internet. Not sure if this could have been related to the cause of the problem previously. For now I have disabled the virtual network until I get time to try and get it working and so the mail will work in the meantime.

I also noticed that Hyper-v added an extra 443 ssl binding to the default website so as it had 2 bindings on port 443 it refused to start. After deleting one it worked.

I decided to install Exchange onto a domain controller as it is only a test and I wouldn't do it in a live environment. I am also short of test machines! It didn't give me any warnings about this actually, I think previous versions warn you that it is not recommended.

Andreas and Chinthaka: I did not know about the requirement to run the domain at 2003 mode. The main domain is running in 2008 mode with Exchange 2007 so I assume this is just a temporary beta related requirement. It does seem to be working (second attempt) so far in a 2008 mode domain although I haven't had a chance to fully test it yet.



P.S. Sorry it's taken me a while to reply!

Robin Wilson


I think there might be a misunderstanding on the domain functional mode of W2K3. That is the minimum value, but can also be W2K8. Gary A. Cooper | Senior Systems Architect | MCA:Exchange2003 | MCM:Exchange2003/2007 | Horizons Consulting, Inc. If you have found my answer helpful, please vote as such.


Thanks for the reply.

It seems to be working well now in a forest trust with all users being automatically logged on from Outlook.Robin Wilson

Dustin J

Fire up MMC, add the Local Computer Certificate store into the console, located the certificate for the computers DNS name when you first went to install Exchange 2010 Beta/RC, (It will be in the personal store if you are getting this error), move it into the Trusted Root Certification Authorities. Now you can install, enjoy :).


Hello Dustin

Thanks for the reply but I can't really confirm if would fix it or not now but it sounds like a valid solution as the issue was related to certificates so I will mark it as the answer. I had used the totally confused, wipe the system, cross fingers and try again approach which worked in this instance.Robin Wilson

Christopher L. Morris

Thank you for this post! I can confirm as well that this indeed works! I have a new 2008 R2 server (DC) running Exchange 2010, and this is what helped me get past that horrid error. For me, the key was to look through my certificates until I found the one that had the thumbprint code that matched what was in the error message, and then move that certificate to the Trusted Root Certification Authorities folder.MCSE, MCSA, CCNA, A+


I had a similar problem, but I was not installing on a DC.

In my test environment, I installed a 2003 DC, and a 2008 R2 server. I attempted to install Exchange 2010 on the 2008 server, but the install failed during the Client Access Role portion. Same error as Robin's.

This was about the only thread I could find about this error. None of the suggestions worked for me.

Here is what I did to resolve the problem and successfully install Exchange 2010:

Since Exchange did install the Hub Transport role and Management Tools before failing, I was able to open the Exchange Management Console.

1. Open Exchange Management Console

2. Click Server Config in the left pane

3. In the center pane, under the Exchange Certificates tab, click on Microsoft Exchange

4. Click Assign Services to Certificate in the Right pane

5. Select each required service (I selected all except Unified Messaging)

6. Click Assign

You should now be able to install the remaining roles.


brettu's solution worked perfectly for me. Solved same error installing Exchange 2010 on Server 2008 R2.


brettu's solution worked perfectly for me too.

Exchange 2010 on Server 2008 R2 which is DC.

Pablo Di Maria

I had the same problem described by robinwilson16.

But i fixed it, was moving a Certificate from Personal to Root Certificate that Dustin J recommended .

Now it all OK.


Pablo Di Maria Optima Ingeniería S.A
Not open for further replies.
Thread starter Similar threads Forum Replies Date
G Exchange 2010 Installation Question Regarding the Client Access Server External Domain Exchange Server Administration 3
C Exchange installation issue Client Access Service Exchange Server Administration 2
DoctorJellybean Preserve OST file location in new installation? Using Outlook 4
Diane Poremsky How to Uninstall Outlook from an Office Installation New Articles 0
N Outlook 2013 installation error Using Outlook 1
icacream outlook 2007 installation file.... Using Outlook 2
P Installation BCM impossible due to untraceable old SQL-server remains BCM (Business Contact Manager) 6
J Need help with installation of BCM in Outlook2013 BCM (Business Contact Manager) 5
V need installation file Using Outlook 5
T I've broken my installation (OL 2013) Using Outlook 0
crazyboy BCM Installation Best Practices? BCM (Business Contact Manager) 5
N Citrix installation possible? BCM (Business Contact Manager) 1
P exchange server 2010 installation Exchange Server Administration 2
T installation of ms exchange is currently suspended. you must undo changes to continue. Exchange Server Administration 2
J Question of Exchange 2010 Installation - Organization Name Exchange Server Administration 6
B Installation of Exchange 2010 on a SBS2008SP1 Server. Exchange Server Administration 2
M Exchange Server 2010 Installation error ""The domain is invalid. Property Name: Domain" Exchange Server Administration 4
S Exchange server 2010 installation error Exchange Server Administration 3
H Attempting to Move PST Files to New Installation of Outlook 2010 Using Outlook 4
T Operation failed due to rgistry or installation problem. Using Outlook 1
P Exchange 2010 Installation Problem Exchange Server Administration 9
S Exchange Server 2010 installation help Exchange Server Administration 2
L exchange 2010sp1 installation error (done via dvd with included sp1) Exchange Server Administration 1
N Failed Exchange 2010 SP1 Installation PowerShell "unauthorized operation" Exchange Server Administration 2
L Re: How do you debug the installation of the Outlook Hotmail Connector Using Outlook 3
C Get "The installation of this package failed" errmsg when Installing Facebook Connector. Using Outlook 2
R Does installation of Windows 7 over Windows XP require setting up email accounts in Outlook from scratch Using Outlook 8
E Exchange 2010 Installation Exchange Server Administration 4
T Exchange 2010 Mailbox Role Installation Failure Exchange Server Administration 4
B AD Exchange Features Missing After 2010 Server Installation Exchange Server Administration 2
M Exchange 2010 SP1 installation error Exchange Server Administration 5
N Outlook 2003 installation without CD? Using Outlook 2
T Installation help for Outlook 2007 with Business Contact Manager Using Outlook 2
M New Exchange 2010 Installation Exchange Server Administration 3
F Outlook Installation Error Message Using Outlook 2
N Exchange 2010 Update rollup Installation Order Exchange Server Administration 11
A Order of exchange 2010 roles installation Exchange Server Administration 2
P Microsoft Exchange 2010 installation problems into an Exchange 2007 environment transport service wi Exchange Server Administration 4
B New Installation of Outlook 2010 will not start Using Outlook 2
H Microsoft Office Professional Plus 2010 Installation Problems Using Outlook 1
M Exchange 2010 and OCS 2007 R2 Installation on the same server? Exchange Server Administration 3
M Outlook 2010 installation issue Using Outlook 1
M Outlook 2010 deletes pst files on installation Using Outlook 2
C Certificate installation error. Exchange Server Administration 3
A ACCOUNT FOR EXCHANGE 2010 INSTALLATION Exchange Server Administration 4
S OWA2010 Problem after installation of Exchange 2010 SP1 Rollup1 Using Outlook 4
M Exchange server 2010 installation failed with hub transport server role error Exchange Server Administration 5
J Exchange 2010 installation - A configuration started by another administrator is currently in progress Exchange Server Administration 1
R Exchange 2010 SP1 Mailbox role installation Failed Exchange Server Administration 6
N My copy of office professional academic will not allow installation of outlook 2010 Using Outlook 2
Similar threads