Unable to install mail, calendar or PF synchronization agents on Exchange server running on DC (D (4209246)

Agent Installation  progress bar  is reaching 5 % and quickly ends. Wizard reports that no agents were installed. This very often happens after an upgrade to QMM 8.3 The following errors can be traced in EMWMigration.log file on the console:

"11/12/2008 12:07:32 PM aeEMWGUIShared::WMICmdRunner::RunCommandLine2  Connect using WMI. Server: EXCHANGE1. Username: DMN\exchange.migration-a
11/12/2008 12:07:32 PM aeEMWGUIShared::WMICmdRunner::RunCommandLine2  Start execution command line on 'EXCHANGE1': C:\WINNT\system32\Aelita Exchange Migration Wizard\Setup\EMWShared.exe /s /a /s /f1"C:\WINNT\system32\Aelita Exchange Migration Wizard\Setup\setup.iss"
11/12/2008 12:07:32 PM aeEMWGUIShared::WMICmdRunner::RunCommandLine2  Error: (Cannot run process. Results: return value: '3'; processID: 0)
11/12/2008 12:07:32 PM aeEMWGUIShared::WMICmdRunner::RaiseOnComplete  Process completed. Exit status: 3
11/12/2008 12:07:32 PM aeEMWGUIWizards::CInstaller::m_runner_OnComplete  Error: (Unsuccess process exit code: 3)
11/12/2008 12:07:32 PM aeEMWGUIWizards::CAgentInstaller::m_internalInstaller_OnComplete  Error: (Install completed unsuccessfully. Agent: Shared Components Server: EXCHANGE1)"

Domain Controllers are generally subject to more tight security policies than any other member server in the domain. As of QMM 8.3 agent installation logic was redesigned to suite new Windows    Server 2008 architecture and Exchange 2007 clustering technologies. As a result some restrictive GPOs (Group Policies Objects) on the Domain Controller can cause this process to fail.

 As per the following Microsoft Tech Net article:

http://technet.microsoft.com/en-us/library/cc784623.aspx  
"Replace a process level token
Description
This security setting determines which user accounts can call the CreateProcessAsUser()application programming interface (API) so that one service can start another. An example of a process that uses this user right is Task Scheduler.
Default: Network Service, Local System.
Configuring this security setting
You can configure this security setting by opening the appropriate policy and expanding the console tree as such: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\"

The default setting for such policy is modified on Domain Controllers  and Network Service and  Local System accounts are removed. Please navigate to  "Replace a process level token" policy within "Default Domain Controllers Policy"  and add LOCAL SERVICE  and NETWORK SERVICE accounts. Then execute the following at the command prompt on the Domain Controller where Exchange server is installed and agents are failing to be deployed:
Gpupdate /target:computer /force