You must use an account that's a member of the Organization Management role group to install the first Client Access server ...