[JD_AJNS]

So I setup a new BES and everything is working but I find there are two users that cannot send emails from their device. I check the users out and at some point they were added to the administrators group.

So I shut the router off, removed them from the admin group and added the besadmin account with send as, waited 20 minutes and turned the router on but they still can't send.

When I check the security tab for the users the inherited permissions is off and they have different groups with different permissions then everybody else so clearly I need to clean that up.

Is there an easy way to do this without messing up the user account? Can I remove the administrators group from the security tab and then just turn the inherited permissons back on?

[troykent]

if a user is apart of a group such as domain admin, account operators, etc. AD will continually remove Besadmin account from the security permissions. They can't be apart of these built in groups and use a blackberry. there could be another work around but i'm not aware of it.

[KOR]

Originally Posted by JD_AJNS

So I setup a new BES and everything is working but I find there are two users that cannot send emails from their device. I check the users out and at some point they were added to the administrators group.

So I shut the router off, removed them from the admin group and added the besadmin account with send as, waited 20 minutes and turned the router on but they still can't send.

When I check the security tab for the users the inherited permissions is off and they have different groups with different permissions then everybody else so clearly I need to clean that up.

Is there an easy way to do this without messing up the user account? Can I remove the administrators group from the security tab and then just turn the inherited permissons back on?

You have to apply the permissions in the correct places. I'm a domain admin and had the problem for a while before I decided to fix it. There are several threads here that may help you out, and plenty of articles on RIM's web site that you may find helpful, as well. I reviewed quite a few and finally decided to call RIM's T-Support. The tech had me change permissions in two places and have had no problems since, and I've applied the changes to other domain user accounts and everyone's happy now.

Using Exchange 2K3 and BES 4.1.6.9

[SoUnCool]

This was what I did

open AD snap-in for users and computers
change view to advanced features
your will see System container in your AD tree
expand it, you will see AdminSDHolder container
right click , > Properties > security and add your BESADMIN account there, Apply ok, and close AD snap-in, wait for replication to all DC's, stop BES router for 20 minutes, and then bingo it works, all members of protected groups can send/receive using BB

This article explains send as issue The xxx34;Send Asxxx34; right is removed from a user object after you configure the xxx34;Send Asxxx34; right in the Active Directory Users and Computers snap-in in Exchange Server