When you updated the BES, did you perform the install while being logged in as BESAdmin, or were you logged in as a protected account?
1 way calendar sync seems the services are running as a protected account (if permissions are setup fine).
run services.msc, and check to see what the services are logged in as. If most of the services are running as something other than your BES service account, you will need to complete a switch service account procedure.
BES 4.1.4 - Exchange 2003
8800 and my trusty 8700r.
To change your PIN to FFFFFFFF, drop the BB in a lake.