Setting Permissions on the Subenrollment Service File

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

The subenrollment service runs in the root cluster and enrolls a licensing-only cluster during provisioning. By default, the discretionary access control list (DACL) subenrollment service allows access only to the local system account on the each server in the root cluster. To provision a licensing-only cluster, you must log on to a server in the licensing-only cluster with such an account. Alternatively, a local administrator on the root cluster must change the DACL for SubEnrollService.asmx on every RMS server in the root cluster to grant access to the user account that will perform provisioning on the licensing-only cluster. SubEnrollService.asmx is located in the Certification virtual directory on the servers in the root cluster.