Hi there, I've just set up BES on our exchange 2003sp2 system and having of course some issues.

I'm fairly new to BES administration, so be gentle. I did search and review a few threads of similar nature, and ran through some solutions, to no avail.

So here's where I am at:

send mail from 8130, gets the red X.
Event viewer shows:

{csawatsky@mydomain.ca} Send() failed: ERR_SUBMIT_MAIL, Tag=266

{csawatsky@mydomain.ca} MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed

BES logs show:

[30000] (01/22 10:23:02.912):{0x12E8} EventLog::ThreadProc: Received notification, processing...
[30000] (01/22 10:23:02.912):{0x12E8} [Alarm::ActivateAlarm] Queuing alarm: <N/A> | BlackBerry Messaging Agent MERCURY Agent 1 (Application Event Log on MERCURY) | 01/22/2008 10:23:02 (AFFF4F29) -> {csawatsky@mydomain.ca} MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed
[30000] (01/22 10:23:02.912):{0x4F8} Alarm::ThreadProc: Received an alarm message
[30000] (01/22 10:23:10.303):{0x12E8} EventLog::ThreadProc: Received notification, processing...
[30000] (01/22 10:23:10.303):{0x12E8} [Alarm::ActivateAlarm] Queuing alarm: <N/A> | BlackBerry Messaging Agent MERCURY Agent 1 (Application Event Log on MERCURY) | 01/22/2008 10:23:03 (AFFF4FF8) -> {csawatsky@mydomain.ca} Send() failed: ERR_SUBMIT_MAIL, Tag=266
[30000] (01/22 10:23:10.303):{0x4F8} Alarm::ThreadProc: Received an alarm message



Now, I have gone through all the permissions and set them, using both the install guide, and the MSKB that everyone links to.
I have a newer (post hotfix) store.exe and have noticed that the "send as" permissions on my user account are being undone periodically. I did look up the fix for this, but it didn't seem very solid, just said something about restarting the service. Can anyone elaborate on that?

I did also change the reg settings to speed up the permissions cache refresh.

Any help would be much appreciated! I am hoping to move all of my treo users onto blackberrys soon

If the Send As permission keeps getting revoked then it is due to group membership. Domain Users will not lose, or shouldn't anyways, that permission but people who are part of the following groups will lose this permission:

Domain Admins
Schema Admins
Enterprise Admins
Administrators
Account Operators
Server Operators
Print Operators
Backup Operators
Cert Publishers

It's the behavour of AD to revoke that right. You can remove any users from these groups if it's not necessary, but they do need these rights then review the following from Microsoft:

Delegated permissions are not available and inheritance is automatically disabled

The "Send As" right is removed from a user object after you configure the "Send As" right in the Active Directory Users and Computers snap-in in Exchange Server

These should help resolve the issue.

ahhh great, for some reason I kept thinking that stuff meant if the BESAdmin user was in those groups, not MY user

so after I remove my user from the problem group, and reset the send as permission, do I need to restart any services? stop bes router?

thanks!

It does count for the BESAdmin as well as the users. Yup, after removing the membership and setting the permission stop the router for 20 minutes seeing as you have applied the Mailbox cache reg key. Good catch the by way, a lot of people don't bother doing that.

Again, you ccan also follow one of the work arounds in 817433 from Microsoft as well to keep group membership.

bingo, that fixed my wagon. Realistically, it's probably not the best idea for me to have my day to day user set up in any of those groups.

I came across this flow chart also that might help the next person trying to troubleshoot the problem, although it did not outline anything about the group membership that was causing my problems.

BlackBerry - Send As Issue

Good post, I have my personal account as a Domain Admin and I loose the BES sevice account from my security settings every few hours. I have been battling this for a few days now.

Now I have to decide whether to follow the work around or just remove myself from the domain admins group which is so handy to have.......

Matt

I'd recommend following the principle of least privilege.