Posted by (JavaScript must be enabled to view this email address) on Tue 31 Mar 2009

Today I had an issue with workflows on our CRM server, specifically that none of them would run, so in order to resolve the issue I looked at the trace log and found that we were receiving the following error…

 
"Caller does not have enough privilege to set CallerOriginToken to the specified value" 
 

Looking at the CRM Asynchronous Service, I could see that it was running under the correct domain account (CRM Admin), however I discovered that this account needs to belong to a specific group in AD also (PrivUserGroup), so I then performed the following steps…

1. Open Active Directory and Computers (dsa.msc)
2. Find your PrivUserGroup
3. Open group and add your domain account running your CRM services
4. Run iisreset on CRM server.
5. Restart CRM Asynchronous Service.

And hey presto, workflows can then be ran on the server.