Access Denied doesn’t always mean there is a permissions issue.


We were adding a new web front end to a SharePoint 2007 farm.  When running the Configuration Wizard, we got the following error message:


  • Server event error 104 – 
    Failed to connect to the configuration database.
    An exception of type System.Security.SecurityException was thrown.  Additional exception information: Access denied.
    System.Security.SecurityException: Access denied.
       at Microsoft.SharePoint.Administration.SPServer.Update()
       at Microsoft.SharePoint.Administration.SPFarm.Join()
       at Microsoft.SharePoint.PostSetupConfiguration.ConfigurationDatabaseTask.CreateOrConnectConfigDb()
       at Microsoft.SharePoint.PostSetupConfiguration.ConfigurationDatabaseTask.Run()
       at Microsoft.SharePoint.PostSetupConfiguration.TaskThread.ExecuteTask()
    The Zone of the assembly that failed was:


We thought the permissions were correct, but to be sure, we checked the Microsoft knowledge base.  Yes, we had them set correctly.  Here are those details in case you need them, though:


  • The setup user administrator account requires the following permissions:
    It must have domain user account permissions.
    It must be a member of the local administrators group on each server in the Office SharePoint Server 2007 farm, excluding SQL Server and the Simple Mail Transfer Protocol (SMTP) server.
    This account must be able to log in to the computer running SQL Server.
    This account must be assigned to the securityadmin and dbcreator SQL Server security roles.
    If you use any Stsadm operations that affect a database, the administrator account must be a member of the db_owner role.

  • After you run the config wizard, machine-level permissions for the administrator account include:
    Membership in the WSS_ADMIN_WPG Windows security group.
    Membership in the IIS_WPG role.

  • After you run the config wizard, database permissions include:
    db_owner on the Office SharePoint Server 2007 server farm configuration database.
    db_owner on the Office SharePoint Server 2007 server farm content database.


So “Access Denied” didn’t appear to indicate any issues with permissions. 

One of our team members suggested that the SharePoint version may not be at the same level as the other servers.  We then discovered that SharePoint had actually been installed many months before, but the application upgrades (cumulative updates and hot fixes) that had been applied to other servers in the farm had not also been applied to this one.


We compared the application upgrades/updates by going to Control Panel -> Add/Remove Programs and selecting the option to show updates.  We got a list of the cumulative updates and links to their download pages here:


After downloading the hotfixes and installing them, the Configuration Wizard ran successfully without any errors.


In this case, "Access Denied" meant "SharePoint versions aren’t at the same level".