"Cannot run process. Results: return value: '3'; processID: 0" Error when installing QMM Agents (4246452)

When trying to install QMM Agents or Shared Components using QMM Project Manager, the following error is shown in the EMWMigration.log file

9/2/2011 10:20:55 AM aeEMWGUIShared::WMICmdRunner::RunCommandLine2 Connect using WMI. Server: ISCEDFW01SQMM02. Username: isc\isce-sa-qmm
9/2/2011 10:20:55 AM aeEMWGUIShared::WMICmdRunner::RunCommandLine2 Start execution command line on 'ISCEDFW01SQMM02': C:\WINDOWS\system32\Aelita Exchange Migration Wizard\Setup\EMWShared.exe /s /a /s /f1"C:\WINDOWS\system32\Aelita Exchange Migration Wizard\Setup\setup.iss"
9/2/2011 10:20:55 AM aeEMWGUIShared::WMICmdRunner::RunCommandLine2 Error: (Cannot run process. Results: return value: '3'; processID: 0)
9/2/2011 10:20:55 AM MMExCore|Quest.MigrationManager.Exchange.Informer.informer_WriteLogInfo Message: Process completed. Exit status: 3 |External source: aeEMWGUIShared.WMICmdRunner.RaiseOnComplete
9/2/2011 10:20:55 AM MMExCore|Quest.MigrationManager.Exchange.Informer.informer_WriteLogError Error: 0 - (Unsuccess process exit code: 3 | Source: aeEMWGUIWizards.CInstaller.m_runner_OnComplete)
9/2/2011 10:20:55 AM MMExCore|Quest.MigrationManager.Exchange.Informer.informer_WriteLogError Error: 0 - (Install completed unsuccessfully. Agent: Shared Components Server: ISCEDFW01SQMM02 | Source: aeEMWGUIWizards.CAgentInstaller.m_internalInstaller_OnComplete)
 

The service account used as an Exchange account on the Exchange server is missing some directory permissions or local server permissions. Therefore, when QMM Project manager uses WMI to connect to the server and run the process, it gets insufficient permissions response.

Return code Description
0 Successful Completion
2 Access Denied
3 Insufficient Privilege
8 Unknown failure
9 Path Not Found
21 Invalid Parameter

To resolve the issue, check the local security policy applied to the server and make sure the service account can successfully log on to the server, start processes, install and start applications on the server, etc.

If the service account is able to login to the server, and local installations are successful using the service account, but agent installation is still failing, check the security setting for "Replace a process level token" in the User Rights Assignment in the Local Security Policy. If Local Service and Network Service are not listed in the local security setting the installation will fail. Adding the Local Service and Network Service accounts to the Local Security Settings should allow the agents to be successfully installed.

The Local Service and Network Service accounts are the default Local Security Settings for the "Replace a process level token". Its possible a default domain policy or another explicity policy has been defined in AD which will override the local settings. If the option to add a user/group to the Local Security Setting is greyed out, the policy is being enforced at a Site, Domain or OU level and steps will need to be taken to override the policy to add Local Service and Network Service to the security settings for "Replace a process level token"