If you installed CRM 4.0 on box where you also have SQL and used a domain account as service account you need manually to add your domain account to the PrivUserGroup else you will recive a "Caller does not have enough privilege to set CallerOriginToken to the specified value" when trying to access CRM after installation.

1. Open Active Directory and Computers (dsa.msc)
2. Find your PrivUserGroup
3. Open group and add your domain account running your CRM services
4. Reboot CRM server (just to be sure ;-)

I'm not sure why the installation doesnt fix this by default..