The dedicated VMEP user must be a member of the local IIS_WPG group.