[aribrown]

In response to MikeJ7's post, the registry key that was missing for me was the one that begins "dca740". I had to go in and manually add that registry key, and then add a new string and put in the FQDN to my domain controller (it is the same server as BESX for me). This allows the BESX server to resolve the MAPI settings.

[Mikej7]

Thanks. Are you running server 2008/Exch 2007?
I have the registry "dca740...", however; I do not have the "001e6602" strings, so I guess I will add them and see what happens.

[Mikej7]

OK - the above two items got my BESX on a Server 08/Exch 07 working:
1. Enabling the Advanced Features of AD, going to the BESAdmin AND each Device user of BES and granting Send As and Recieve As in the Security Tab.
2. Apply the Registry Settings in BB KB03304.

Both of these fixes are mentioned above and THANK YOU to those people who posted them!!!!!!!

[aribrown]

Good to hear! I found that for me it wasn't even really too much of a permissions issue. All the permissions were checking out at the mailbox and domain level just by making the initial changes for the BESAdmin account as outlined in the installation steps by Blackberry. All the permissions stuck for me, it just was a registry issue. I read in another post where someone just added their domain controller name to the hosts file. I am curious if this is just a similar resolution.... maybe it is possible that the registry change accomplishes the same thing as an entry in the hosts file? Just some food for thought. Although, after all of this I am pretty sure there is a software bug in BESX. Somehow under certain configs, multiple people seem to have the same issue.

[Triforce66]

I found following the steps in this guide to create and provision the user got me work..
http://www.blackberryforums.com/bes-...unctional.html

Not sure why but my IEMSTest still fails, but I was able to attach a BB to an account yesterday. Not going to complain, it finally works.

[dancadman]

Originally Posted by shorelinetrading

Ok - just applied the fix by creating a batch file on my Windows 2003 server:

dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "\SELF:CA;Send As" 
dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "\SELF:CA;Receive As" 
dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "\SELF:CA;Change Password" 
dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "\SELF:RPWP;Personal Information" 
dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "\SELF:RPWP;Phone and Mail Options" 
dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "\SELF:RPWP;Web Information" 
dsacls "cn=adminsdholder,cn=system,dc=YOURDOMAIN,dc=com" /G "YOURDOMAIN\BESAdminAccountNameHere:CA;Send As"

Replace YOURDOMAIN with your domain (and if you are .net or .local, don't forget to change the domain extension) and BESAdminAccountNamehere with your BES account name. Omit the domain for the service account if it's not a domain account (like mine is as my Exchange server is a DC).

Then re-add the permissions that I described previously to the BESAdmin account (Send As, Receive As in Security).

I'm waiting to see in a few hours if my permissions stick.

Just wanted to confirm that this has corrected my problem as well. Thank you very much for posting this! I had actually found a similar post somewhere else, but it wasn't as informative as this one was.

We only have about 15 BB's in our organization, we are currently using SBS 2003 with Exchange 2003 and now BESExpress. Me and another employee share the IT responsibilities. Naturally, we were the first 2 to try it, and because we have elevated permissions, this was tricky for us to get worked out. I implemented the above fix yesterday just after 5, and by 8 we were both able to send messages. I've been working on this for about 3 days now. We checked again this morning and it is still working so far. We are going to start migrating users in the coming weeks.

Thanks again. Got a good place to come to for help now!

[shorelinetrading]

Originally Posted by dancadman

Just wanted to confirm that this has corrected my problem as well. Thank you very much for posting this! I had actually found a similar post somewhere else, but it wasn't as informative as this one was.

We only have about 15 BB's in our organization, we are currently using SBS 2003 with Exchange 2003 and now BESExpress. Me and another employee share the IT responsibilities. Naturally, we were the first 2 to try it, and because we have elevated permissions, this was tricky for us to get worked out. I implemented the above fix yesterday just after 5, and by 8 we were both able to send messages. I've been working on this for about 3 days now. We checked again this morning and it is still working so far. We are going to start migrating users in the coming weeks.

Thanks again. Got a good place to come to for help now!

I wanted to let you guys know that I came into the office today and VOILA, my user added without a hitch via OTA activation after applying the MS Exchange fix and adding Send As/Receive As to the BESAdmin. Problem solved!

Here's a write up I did on my blog in case you need a quick link to the fix in the future...

www-dot-waldrondigital-dot-com/2010/03/04/cannot-activate-user-in-bes-express-iemstest-exe-fails-with-send-as-account-operator-error/

Title: Cannot activate user in Blackberry BES Express, IEMSTest.exe fails with Send As account operator error, Provision User Failed

Because I am a new user here they forbid me from posting links. Silly.

[Trkkr]

Hi everyone that is sure to visit this topic:

I would suggest trying aribrown's solution first as I tried the batch file solution and it didn't do the trick for me.

To clarify the KB instructions:

blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB03 304]View Document

It says to go to

'HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\<BLACKBERRY_ENTERPRISE_SERVER_N AME>'

and

'" "\BlackBerry Server Management\'

---

With out setup the folders were

'" "\BlackberryServer ' -- which had the folder AND the key.

and

'" "\BlackBerryServer_MailStoreProfile' -- which had the folder but no key. We created the key, restarted the Router and Dispatcher services as aribrown suggested (may not be required) and it started working.

If that doesn't work for you, then maybe trying to batch file solution could be tried. The reg fix is simpler and faster so it's best to try that first.

Thanks aribrown!

[k.jacko]

This blows!
I already run BES4.1.6 (on one of our DC's) so my besadmin account has all permissions already present and correct for my existing users' devices to work fine on our server 2008/exchange 2007 box.
I installed BesExpres 5.01 on our server 2008/Exchange 2007 box
I've used the script above with the obvious alterations made to it.
When i run IEMSTest it fails on the last hurdle saying "No Send As Permission on besadmin account" (or somethin similar).
When i check the besadmin account in ADUC the correct 'Send As' and 'Receive As' permissions are applied to SELF and the besadmin account as well as the defaults.

Still won't work. Reading back, it looks like i need to give at least an hour for permissions to stick before trying the IEMSTest again?

Jesus, no wonder this product is free. They'll make a fortune out of support calls.

[knottyrope]

Originally Posted by k.jacko

Jesus, no wonder this product is free. They'll make a fortune out of support calls.

But admins come to the forums first.

[k.jacko]

Anyone got any more advice on this please?

My blackberry server config is all fine as i'm already running BES 4.1.6, but BESX still won't activate the attached device. The device does how the acitvation screen where you see 2 computers with a synching arrow between them. That screen flashes up twice in quick succession then goes off and nothing else happens.
I've checked the permissions on the Exchange powershell in Exchange 2007 and it confirms besadmin has 'Read As' and 'Receive As' permissions, yet IEMSTest still says it doesn't.

MY ISP says Blackbbery will only assist with a paid phone call, which is nuts tbh. Its obvious there are loads of people having issues with this, they need to fix it before thinking about charging anybody.

Thanks for any help offered.

[knottyrope]

Assign Send As permissions to all users via Active Directory

1. Open Active Directory.
2. Select the "View" menu and ensure "Advanced Features" is checked.
3. Right mouse click on your domain name and select Properties
4. Select the Security tab
5. Press the Advanced button at the bottom on the security tab
6. Select "Add" and enter your Blackberry Service Account name (e.g. BESadmin) and select OK
7. When the permissions screen appears change "Apply onto:" to "User Objects" (or xxx8220;Descendant User Objectsxxx8221; on Server 2008)
8. In the permissions box scroll down and check the Allow box beside "Send As" and press OK
9. Press Apply and OK to exit

[knottyrope]

Originally Posted by k.jacko

Jesus, no wonder this product is free. They'll make a fortune out of support calls.

Let us help you get started
BlackBerry Enterprise Server Express includes a complimentary support phone call to the BlackBerry experts valid for 60 days after receiving the software download¹. It’s designed to assist with the installation of the BlackBerry Enterprise Server Express or can be used towards resolving other BlackBerry Enterprise Server Express related technical issues.

[k.jacko]

Originally Posted by knottyrope

Assign Send As permissions to all users via Active Directory

1. Open Active Directory.
2. Select the "View" menu and ensure "Advanced Features" is checked.
3. Right mouse click on your domain name and select Properties
4. Select the Security tab
5. Press the Advanced button at the bottom on the security tab
6. Select "Add" and enter your Blackberry Service Account name (e.g. BESadmin) and select OK
7. When the permissions screen appears change "Apply onto:" to "User Objects" (or “Descendant User Objects” on Server 2008)
8. In the permissions box scroll down and check the Allow box beside "Send As" and press OK
9. Press Apply and OK to exit

Thanks for the reply, i've checked that and besadmin is already in that list with FULL permissions;. However there is no 'Read As' permission. There's loads of others that i've never seen, but no 'Read As'. And i've checked ADUC on both server 2003 and Server 2008.
Uber confusion is starting to set in now, lol.

[cosmismgr]

In my case, the Send-As permission for AD just simply wasn't being applied correctly using the AD snapin, although I had all of the proper permissions set. To have the IEMSTest complete successfully I had to use the following command from Microsoft Exchange Management Shell:


Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=Users,DC=<domain_1>,DC=<domain_2>,DC=<domain_3 >"

example: my.domain.com:
Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=Users,DC=my,DC=domain,DC=com"

Hope this helps others!

[vaneer]

I had the same issue and it took me about a week to realize the mistake I have made while installing BESX. SO I had to uninstall BESX and created a username in active directory (BESAdmin). and gave all appropriate permission mentioned in this forum. Now this is very important, Logout of administrator account and log in using BESadmin account and install BESX. Everything worked for me wireless activation done in about 15 sec.