We were getting the following error trying to deploy a new WCF service because the domain account which runs the service was not a local admin on the server on which it was installed:


Service cannot be started. System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL http://+:8000/ourservice/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details).


The easy fix would have been to add the user as a local admin, but that's not the most security way to resolve the issue.

WCF Web Services, IIS, Kerberos, and Delegation problems are maddening!

Sometimes you implement something exactly as you have in the past, but due to some unforeseen circumstance it doesn't work as you expect. We've seen issues like this when implementing WCF web services on IIS 6.

Some things you can check are:

- Have you setup the proper service principal names for the service account running the application pool?
- Is the service account setup to run the application pool that is running the web service trusted for delegation?