Running Dynamics CRM 4.0 with a Service Account

When I install CRM 4.0, I got the warning message "Verify Domain User account SPN for the Microsoft Dynamics CRM ASP.NET Application Pool account" in system requirements window. But it did not prevent me from installing CRM, so I proceeded.



After successfully completing other steps I couldn't browse CRM page. I was getting an error message saying "Caller does not have enough privilege to set the CallerOriginToken to the specified value.” To resolve this problem I had to follow following steps.

1. Using Setspn command line tool, setup the SPNs for the machine and service account as follows.
setspn –a HOST/servername.domainabc:5555 domainabc\serviceusername

The Setspn command line tool is included in Windows Server 2003 Support Tools and you can download it from the Microsoft Download Center in this location.
You can find "Setspn Overview" from Microsoft TechNet in this location.

2. Verify/ Add the Microsoft Dynamics CRM server to the CRM installation’s Active Directory PrivUserGroup group by following these steps.

2.1 Locate the correct security group if you have more than one deployment of Microsoft Dynamics CRM 4.0 in the domain. Run the following SELECT statement on MSCRM_Config database using SQL Server Management Studio.
SELECT ID, DatabaseName, FriendlyName FROM Organization

2.2 Add the Microsoft Dynamics CRM server to the Active Directory PrivUserGroup group.
...1. Start -> Run -> dsa.msc, then click OK.
...2. Locate the organizational unit in which the Microsoft Dynamics CRM installed.
...3. Double click PrivUserGroup, click Members, and then click Add.
...4. Click Object Types, click Computers, and then click OK.
...5. Use Check Names option to find out Microsoft Dynamics CRM server, and then click OK.

3. Add the service account to the local machines IIS_WPG group.
4. Restart Microsoft Dynamics CRM server.
5. Restart Microsoft Dynamics CRM client for Outlook.