I saw several fixes, none look to appealing..workarounds, really. Anyone know if there is a way to fix this (other than breaking MS best practice)? I sincerely hope that there is not a stupid freeking Treo in my future....

what are you asking?

You could take yourself out of the Domain Admins group so you don't have the inherited restrictions and protections, and just use an "Admin" account to log in to servers.

I just removed myself from the domain admin group. I use a service account to preform all domain admin functions.

Running the one line DSACL command to give the besadmin send as doesn't look appealing to you? Could I ask why?

Run the following command from your PDCE as a Domain Admin. This is not a work around its a fix. Our system guys wasted an entire Sunday with Send As. I ran this cmd on Monday and had BB send for restricted groups working after a 2 hr wait. YMMV

@ the guy that removed himself from domain admins, run the cmd if you want the ability to be a DA with email.

%drive%:\>dsacls "cn=adminsdholder,cn=system,dc=mydomain,dc=com " /G Domain\BlackBerrySA:CA;Send As"

Replace mydomain with the name of your domain
Replace Domain\BlackBerrySA with your domain name and the name of your bb admin account (likely BESAdmin)
Include the entire cmd on one line

Note that you need the Win2k(3) res kit installed to access dsacls

dsacls seems to reveal permissions that can't be applied using the GUI Security tab.

HTH
-J