I found this link helpful for that same scenario, the permission changes you need are defined in the section Eliminating the "Access is Denied" Error:

http://technet.microsoft.com/en-us/library/aa337083.aspx