Calendar Authentication Error

[brucealeg]

I have searched the forums and been given a lot of great advice from the members here, but I am still having a calendar authentication error and want to give troubleshooting another shot.

I have a BES 4.0.7.11 server running against a Exchange 2000 (latest patches and SP) with zero issues. I recently added a 2nd Exchange 2000 (with the exact same patches) to the domain and migrated users to it.

Mail from this new server to the BB works without issues and calendar entries created in Outlook make it to the BB with no issue.

If create a calendar or meeting request on the BB it never makes it to the mail server. The logs show this:

[30002] (04/28 10:58:10):{0xE3C} Server = messaging-1c, Mailbox = /o=Company/ou=First Administrative Group/cn=Recipients/cn=bleggett Description = You do not have permission to log on. [Microsoft Exchange Server Information Store - [MAPI_E_FAILONEPROVIDER(8004011D)]].

[30180] (04/28 10:58:10):{0xE3C} {bleggett} CDOCalendar::Initialize - Error in call m_spCalendarFolder = m_spCDOSession->GetDefaultFolder.

[40000] (04/28 10:58:10):{0xE3C} CDO initializing failure in CDO helper 0463e598 (5)

[40580] (04/28 10:58:11):{0xE3C} CDO helper 0463e598 closing after CDO initialize failure

[40577] (04/28 10:58:12):{0xE3C} CDO helper 0463e598 stopped

Someone here said it had to be permissions - since I verified that the cdo.dll is the same on all servers in the equation. He provided me with a RIM created checklist of what to check and even a guide to making a new BES service account. None of that has fixed this issue.

Does anyone else have any ideas?

Bruce

[gibson_hg]

Permissions are incorrect on one Exchange Server if the other is working.

[30002] (04/28 10:58:10):{0xE3C} Server = messaging-1c, Mailbox = /o=Company/ou=First Administrative Group/cn=Recipients/cn=bleggett Description = You do not have permission to log on. [Microsoft Exchange Server Information Store - [MAPI_E_FAILONEPROVIDER(8004011D)]].

Double check permissions, they must inherit from the Server level down to the mailbox store and public folder store levels.

Compare the permissions for BESAdmin between both Exchange servers.

[brucealeg]

I have done it 10 times and used several guides and I can not find a difference. Is there a permission/object to check for calendering only? Mail flows both ways - it's only calendering that does not. I can not find a permission that does not match.

[gibson_hg]

So, to get things straight, this is only an issue on one mail server. Have you confirmed CDO.dll versions between all servers? BES included? Send in screenshots if possible of the permissions in ESM from both Exchange Servers for BESAdmin.

It's either that or the account itself is the issue, in that case you need to create another BESAdmin and switch the BES to use that account instead.

[cikez]

What version of BES are you running?

[brucealeg]

Bes 4.0.7.11

[ikazi]

Still looks like a permission issue but here are some other things you can try.
- Make sure CDO.DLL size and date is same (not corrupt or zero bytes)
- Check if any other MAPI based application is using it.
- unregister and reregister.
- upgrade BES version.

Hope this helps
Ikazi

[brucealeg]

Ok - mined all the data I have been asked for.

The BES and Mail Server B have the exact same info for the cdo.dll.

Version 6.0.6619.9
12/4/2006
704KB

I unreg and reg.

The BES was upgrade to this SP and patch based on this issue starting a few months ago.

Compared rights between Mail Server A and B.

Besadmin on Server A has - Read, Exec, Read Permission, List Contents, Read Properties, List Object, Administer Data store, View info store status, receive as, send as.

Besadmin on Server B has - Read, Exec, Read permission, List Contents, Read properties, List Object, Administer info store, view info store status, receive as, send as

I took someone here's advice and created a new besadmin caleld BesAdminNew and setup the permission based on the RIM document he supplied and when I do that the BES services wont start after I reboot.

When I created the account I simply went into Bes Server Props > MAPI > changed user account. I rebooted to speed up the process and no mail flows - pop open the Manager and it says the DB is not up. If I change back to BesAdmin it works.

Hope there is some clue in this.

Bruce

[gibson_hg]

You've almost got the BES switched over. You need to backup a reg key and restore it and you need to change the services as well.

Read this KB from RIM for more detailed steps:

BlackBerry Search Results (http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB04293&sliceId=SAL_Public&dialogID=128352470&stateId=0%200%2057489533)

Let us know how it goes.

[brucealeg]

Interesting - I see what you're saying. I'll try it tonight and report back, thanks for the heads up.

Bruce

[brucealeg]

Ok - last night a got the chance to switch all the service, but the few that should run as system, set to the new service account.

BAM - I can once again sync my calendar with Exchange in both direction. Yippie!!

However, e-mail has become one directional. I can receive mail, but any mail from the BB heading to the Exchange server fails with a red X. I glanced the logs and nothing jumped out at me.

I had to switch the service account back for now, because e-mail is obviously more important here.

Any clues?

Bruce

[gibson_hg]

Hi bruce,

Sounds like the Send As error. You might not have set that one in AD when creating the new BESAdmin account.

You would see this in the MAGT logs as well as the Application Log:

[20265] (12/13 15:38:10):{0xFF0} {<user_name>@<hidden><domain>} MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed

If it's that exact error then Send As was not set or did not inherit down to the users.

Review the RIM KB on it, there's even a flash video on setting the permission:

BlackBerry Search Results (http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB04707&sliceId=SAL_Public&dialogID=129548178&stateId=0%200%2058367416)

Hope it works out for ya!

[brucealeg]

That's it to the T. I read the RIM and then MS KB and per that I've added the permissions mentioned to the domain and will see what happens later when I can change the BES service accounts around again.

Thank you so much for the help,
Bruce

[brucealeg]

Gibson,
Thanks for all off your help. I was actually able to get the original BesAdmin account working using all the links you sent me. It's unfortunate, but a couple of the permission MS recommends did not work and I had to hand out a little more then needed. However, it works and that's a big plus.

Thanks again,

Bruce

[gibson_hg]

That's awesome news, thanks for the update!