Recently I was building a virtual SharePoint environment to do some testing.
It consisted of one WFE and an application server running search server express. The build went fine until trying to add the WFE to the farm.
The error returned was access denied. I checked everything that I could think of that was permissions related with no luck. Then I realised that SSE installs WSS SP1 automatically and the WFE that I was trying to add was just plain WSS. Silly mistake to make, but easy to make when your building a few machines in a rush.
Turns out permission denied can just mean that the server being added is not at the same patch level as the rest of the farm. Once it's at the right patch level it joined the farm fine.