Today I tried to install and deploy my Blackberry Professional Server (4.1.4.17). I went to setup my account on the server, thought it was going to work, but failed.
I followed the instructions given on the Blackberry website and the tutorial. I am pretty sure I did not miss anything, but this is my first install so it is possible I missed something somewhere.
Any help that I can get would be really appreciated!

I am using Exchange 2007. I have a seperate Microsoft server 2003 for my BPS. I am testing with a T-mobile service Blackberry 8900.

After I create the account on the BPS, I recieve the password from the server in my email. I put in my email/password on the phone and try to activate. I will then get another email from the BPS that has the correct subject / attachment. (RIM_bca28a80-e9c0-11d1-87fe-00600811c6a2) + (ETP.DAT) After that the phone just sits on activating and will attempt later, and another email will end up in my account.

I looked at the log files (C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Logs) but I don't see anything that makes sense to me. Is there any log files I can post that can help diagnose the problem? Or is there a problem evident with my other statements?

Thank you

The message with ETP.DAT attachment reaches your inbox, but then just sits there?
It should be processed by BPS immediately and should disappear almost immediately after it arrives.
If it doesn't disappear, then you have a problem. Most likely a permissions issue.

Verify that your BPS service account has the proper permissions:
KB02276 - Assigning permissions for a BlackBerry Enterprise Server service account - Port3101.org : Your BES Connection

I am gathering screenshots so I can show my setup for your verification. Please check back later.

Thank you.

No, don't do that.
Go through the KB article I posted, and make sure your permissions are properly set.
I don't need to see any screenshots.

I did that earlier today, and just again. Everything looks set correctly to me.

So what's happening? Is the activation email with ETP.DAT attachment staying in your email inbox? You never really confirmed that.

Did you try running iemstest.exe against the user you're having trouble with?

Yes, the activation email with ETP.DAT attachment is staying in my email inbox.

Where do I run the iemstest.exe tool?

Run it from the command line on your BPS server.
I don't remember exactly which folder it's in on BPS. Just do a search for it on your file system.

Copy & Paste the results here.

C:\Program Files\Research In Motion\BlackBerry Enterprise Server\Utility>iemstes
t
BlackBerry Enterprise Server Utility - IEMSTest.exe (IExchangeManageStore), Vers
ion 1.0
Copyright (c) Research In Motion, Ltd. 1999. All rights reserved.
Opening Default Message Store Mailbox - Blackberry Server.
Opening message store for Matt XXXXX using /o=HSSH/ou=First Administrative Gro
up/cn=Recipients/cn=mXXXXXX /o=HSSH/ou=Exchange Administrative Group (FYDIBOHF2
3SPDLT)/cn=Configuration/cn=Servers/cn=XCHANGE01/cn=Microsoft Private MDB.
Matt XXXXXX's Mailbox opened successfully.
Root Folder opened successfully.
Folder created successfully.
Test folder deleted successfully.
Test completed successfully for Matt XXXXX.

Is user Matt XXXX a Domain Admin or in a protected AD group with elevated rights?

Yes, Matt XXXX is me. I am an Enterprise / Domain admin.

Aha!
That's likely one reason you're having trouble.
A BES user can't be a domain admin. You should remove yourself from the domain admins group and make sure you're a normal user, with normal rights.

I always recommend that admins follow The Principle of Least Privilege.

See here for more details:
AdminSDHolder - or where did my permissions go? - Port3101.org : Your BES Connection

That won't work for me as I am the IT manager and have to be a domain admin for many other applications.

Well, then you're not a very good IT Manager.
This is basic admin 101 stuff.

It's not safe to run as a domain admin full time. You should have a second account with domain admin privileges, and only log in as that user when you need to do admin tasks.
Your primary login should have normal user privileges.

If you refuse to follow The Principle of Least Privilege, then I'm afraid there's not much we can do to help you out here.
http://en.wikipedia.org/wiki/Least_privilege

Well I just created a new account...Blackberry Test as a domain user. No security beyond that. Phone still does not work, same problem as before. The RIM_bca28a80-e9c0-11d1-87fe-00600811c6a2 email sits in the inbox.

Do you have any anti-virus or anti-spam software in place that might be making any changes to the etp.dat attachment on its way into your mailbox?

If the message arrives malformed, then BES won't be able to process it.

If you have any type of message filtering in place, then try whitelisting blackberry.net so the message arrives unchanged.

I have a barracuda spam/virus firewall sitting in front of my exchange server. I have no 3rd party software on my exchange server. I do have ESET Nod 32 installed on workstations with email protection enabled.

However on the blackberry test I only accessed it via OWA, so it would not have been affected by ESET.

I checked my barracuda and all the emails were being deliverd correctly, but I whitelisted it anyway. Waiting for the current activation to fail to start a new one with it whitelisted.

Still no progress after I whitelisted blackberry.net.

Only asking because I'm running out of ideas...
Are you sure you have the ENTERPRISE BlackBerry Data Plan provisioned by T-Mobile, and not just the prosumer BlackBerry Data Plan?

If you're certain it's the Enterprise Plan, then I'm really stumped.
Most of the time that I encounter this problem, it's due to improperly set permissions for the BES service account, as I mentioned early on in the thread.
Maybe try running through them one more time for sh1ts & giggles?

I didn't have a "Enterprise Blackberry Data Plan" to choose, but I did get a:

Would you like to see my screenshots (I got them done before you told me not to do them) to verify it is set correctly?

That sounds like the wrong plan. I'm 99% sure that the $25 plan form T-mobile is NOT for BES/BPS.
The enterprise plan should be about $40.00 per month.
I think you need to call the carrier, because so far everything is set right on your server.

Well I found out what you were talking about.

I called the Tmobile yesterday and that's what they gave me. On t-mobile, you have to change your phone to a blackberry phone to see the blackberry plans listed. I deselected the unlimited plan, and chose the "BlackBerry Unlimited w/Enterprise E-mail Add-on" plan. I'm waiting for the service to update to try synching again.

Well it's been the 48 hours required to wait for BB service from T-mobile after you change services. I'm still unable to activate my phone. I'm still having the same problem where the email sits in the mailbox. I'm still testing under a basic domain user account.

Is there a log file that could tells us what's wrong by chance?

I still say it's a permissions issue.
Go through this KB article, again, carefully:
KB02276 - Assigning permissions for a BlackBerry Enterprise Server service account - Port3101.org : Your BES Connection

On the microsfot exchange permissions, Task 3 & 4 on that link you set me, where I enter the username (besadmin) do I need to include the domain prefix? domain\besadmin ?

IE:
get-mailboxdatabase xchange01\xchange01-sg01-b1 | add-adpermission -user besadmin -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

or

get-mailboxdatabase xchange01\xchange01-sg01-b1 | add-adpermission -user hssh\besadmin -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

Just got it working. I used my 1 freebie support from blackberry.

The problem was that my blackberry services on the server were running under Administrator instead of my besadmin account. After I exported a few reg keys, logged out, imported the keys, and changed the login for the services, stop/started them, it works.