“Insufficient permissions” error when adding servers to a DAG

I’ve been busily building out a shiny new Exchange 2010 setup at work, with Windows Server 2008 R2 as the base OS. I spent some time this morning puzzling over why I couldn’t add a second server to a DAG. It turns out that the Exchange Trusted Subsystem group doesn’t have the needed permissions under R2; to fix it, you have to add that group to the Administrators group. I found this out by poring over many a dreary Google search result, but if I had looked here first I would have found the solution faster.