BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 06-26-2006, 09:55 AM   #1 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default BES 4.1/Exchange 2003 cannot send email

Please Login to Remove!

Hello,

I just installed BES 4.1. It seems really cool. I am using several different blackberry devices (7280, 7290, 8700, etc).

All of my users can receive email from the Exchange 2003 server just fine. However, none of my users can send email.

I get (2) 20265 errors and a 20000 error in my Event Log everytime someone tries to send a message.

Any suggestions?

Jason
Offline  
Old 06-26-2006, 10:00 AM   #2 (permalink)
Grumpy Moderator
 
NJBlackBerry's Avatar
 
Join Date: Aug 2004
Location: Somewhere in the swamps of Jersey
Model: i5s
Carrier: AT&T
Posts: 27,796
Post Thanks: 33
Thanked 441 Times in 381 Posts
Default

Welcome to BB Forums!

Have you applied Microsoft patch MS06-029 to the Exchange server? It appears that MS06-029 causes a conflict with BES. If you have applied that patch, search the forum on 'MS06-029' and there are several threads on how to remedy this.

Good luck.
Offline  
Old 06-26-2006, 10:16 AM   #3 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I don't think that patch has been installed. Looking at my update history I don't see that it is installed. However, I don't see it as an option to install from the Microsoft Update site either.
Offline  
Old 06-26-2006, 11:40 AM   #4 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I have patch MS06-019 installed which is causing the problem.

Jason
Offline  
Old 06-26-2006, 11:59 AM   #5 (permalink)
Talking BlackBerry Encyclopedia
 
udontknowjack's Avatar
 
Join Date: Aug 2004
Location: State of Confusion
Model: 9000
Carrier: T-Mobile
Posts: 483
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

All future exchange patches will break it unless you fix it by giving your bsadmin ID explicit Send As permissions on the AD accounts.
Offline  
Old 06-26-2006, 02:08 PM   #6 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Yeah... thats what I was afraid of...

Ok... to test I added explicitly added my bsadmin account to one of my user objects in AD and gave it Send As privs.

That user still cannot send mail from their Blackberry. Any ideas?

Jason
Offline  
Old 06-26-2006, 04:29 PM   #7 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Ok... I am mostly working at this point.

Basically, I had to explicitly add "Send As" permissions for my BES Admin account to each AD object that it needed to send as. I then had to WAIT for all the information to propagate and then it all worked!

EXCEPT for my domain admins... My domain admins have the permissions removed because of the "AdminSDHolder" object.

I'm still working on resolving this for my domain admins. I know the recommended fix is to not mail enable my domain admin accounts but that is a fight for another day.

Jason
Offline  
Old 06-27-2006, 12:39 PM   #8 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7250
Posts: 2
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Hello Jason, I am having that same problem. Please post resolution if you come across. I can't send email from my BB b'c of that
Offline  
Old 06-27-2006, 12:57 PM   #9 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

For your regular users you should only have to add your "BES Admin" account to each AD user that is using a blackberry. Basically, you go to the Security tab of each user and add your "BES Admin" account and explicitly grant "Send As" permissions.

For your Administrators (basically and MS "protected" account) it's a little trickier...

You either follow the MS recommended practice of not allowing your admin accounts to not be mail enabled. (I know... I know... this wasn't a reasonable solution for me either at this point in time.)

So you go to AD Users and Computers -> View -> Advanced Features. Then from your AD tree you select System -> AdminSDHolder -> Properties. Then select Security -> Advanced -> Add -> Select your "BES Admin" account -> Click the Apply Onto Drop Down menu and select "User Objects" -> Grant "Send-As".

This should grant the BES Admin account "Send As" permissions to all of your protected accounts.

If you have any questions, please let me know... I VERY new to BES, but I'm having to learn fast!

Also, this link was an interesting read about this problem and decision for the security patch on the MS Exchange team's blog... Personally, I think it's ironic that MS releases a patch that breaks BES/Goodlink while they are trying to push their MS Mobile crap.

msexchangeteam.com/archive/2006/04/28/426707.aspx

Thanks,
Jason
Offline  
Old 06-27-2006, 02:46 PM   #10 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

UGH! I spoke to soon. My admins cannot send mail. I'm still working on it and will post my results when I find something.

Anyone else have any suggestions?

Jason
Offline  
Old 06-27-2006, 08:16 PM   #11 (permalink)
Thumbs Must Hurt
 
Join Date: Feb 2006
Location: NY
Model: 9630
Carrier: Verizon Wireless
Posts: 147
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

It's not a super solution in terms of convenience, but make the accounts that have to get BB email into regular (non-admin) accounts. Then create new admin accounts like admin-jsmith, etc. Remote desktop to one of your servers and login there as the admin account when you have to do admin tasks. It's not a bad idea from the perspective of making people very aware of what they're doing when it comes to admin tasks, since they have to actively go and become a privileged user to delete that file, modify group policy, etc.

If Windows had a real su command, like Unix (and not just Run As) this would be a lot quicker and people would generally be more careful when doing admin work.
Offline  
Old 06-28-2006, 09:48 AM   #12 (permalink)
New Member
 
Join Date: Jun 2006
Model: 7280
Posts: 10
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Ok I think I have it fixed now.

I removed the privs I had set (mentioned in the post above) on the AdminSDHolder object.

Then I ran the following command...

dsacls "cn=AdminSDHolder,cn=System,dc=domain,dc=com" /G "domain.com\BESAdmin:CA;Send As"

Waited for the permissions to propagate... and now all my domain admins and various other protected accounts can now send mail via their blackberry's.

I will post back if I run into further problems.

Jason
Offline  
Old 07-03-2006, 08:40 PM   #13 (permalink)
New Member
 
Join Date: Jun 2006
Model: 8700G
Posts: 1
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Any more ideas

I have tried everything on this site and still can't get it so the domain admins can send email from the Blackberry.
Does anyone have anything else to try? I called RIM and they referred me to Microsoft. I tried to take all admins out of the Domain admins group, but still red x. I have 1 user that is not in any protected groups and he can't send email either. I am on BES 4.0 and Exchange 2003 SP1.

Last edited by Jpezrox : 07-05-2006 at 06:05 AM.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On





Copyright 2004-2014 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.