Check to make sure that the activation message sent from the BES to the users mailbox isn't getting flagged up as SPAM or malicious. The email will come from an address along the lines of "network@etp......." and then varies, and the file sent with the email has the extention .DAT

Also make sure the BESAdmin permissions are being inherited by the users.