[Speeding Texan]

I have a BES (latest version) running on Exchange Server 2003. I have completed the workaround for the Send As permissions as my account is a domain administrator. The permissions are staying intact. I can receive and sync with the server no problem, but I cannot send a message. I get the following message whenever I try to send from my blackberry:

[40000] (10/04 10:34:55.222):{0x26B8} [BIPP] Received datagram, Tag=389
[40700] (10/04 10:34:55.222):{0x26BC} {sthomas@i2E.org} Receiving packet from device, size=329, TransactionId=579479456, Tag=389, content type=CMIME, cmd=0x3
[30112] (10/04 10:34:55.222):{0x26BC} {sthomas@i2E.org} Receiving message from device, RefId=312472547, Tag=389, TransactionId=579479456
[20265] (10/04 10:34:55.316):{0x26BC} {sthomas@i2E.org} MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed
[20000] (10/04 10:34:55.410):{0x26BC} {sthomas@i2E.org} Send() failed: ERR_SUBMIT_MAIL, Tag=389
[40277] (10/04 10:34:55.410):{0x26BC} {sthomas@i2E.org} Sending message error to device for message 312472547
[40583] (10/04 10:34:55.410):{0x26BC} {sthomas@i2E.org} Sending packet to device, Size=43, Tag=676, TransactionId=-987508993
[40279] (10/04 10:34:55.410):{0x26BC} {sthomas@i2E.org} SubmitToRelaySendQ, Tag=676
[40000] (10/04 10:34:55.410):{0x1668} [BIPP] Send data, Tag=676
[40279] (10/04 10:34:55.410):{0x26BC} {sthomas@i2E.org} SubmitToRelaySendQ, Tag=389
[40000] (10/04 10:34:55.410):{0x1668} [BIPP] Send status DATA_ACCEPTED, Tag=389
[40000] (10/04 10:34:56.253):{0x26B8} [BIPP] Received status DELIVERED, Tag=676

The BES Service account has send as, administer information store, and all other required permissions according to the install guide. I have wiped my device, deleted and recreated my account, all with no success. I cannot think of anything else to try because it does not seem to be the Send As issue caued by the hotfix, the permissions are not being deleted from the service account.

Help!

[Speeding Texan]

An update- I found out that I can accept calendar invitations and they work properly, including sending the confirmation. Still cannot send any email, either to other mailboxes on the Exchange server, or external emails.

Anyone have any ideas?

[BBAdmin]

A couple of quick questions back on this one:

1. Is your Exchange server a DC?
2. Although you have set and checked the BESAdmin permissions, have they propogated down to the users mailboxes?
3. When sending an email from the BlackBerry (which as you say fails), open up the failed message and in the subject line there will be an error message, what error do you get?

[Speeding Texan]

DC is a different server. The user permissions are going down to the users with no problem, and even stay after a few days and a few restarts.

Message on the blackberry: Desktop program unable to submit message

[BBAdmin]

OK, check out these two articles, the first is a RIM KB, the second is a Microsoft KB:

Livelink - Redirection

Users cannot send e-mail messages from a mobile device or from a shared mailbox in Exchange 2000 Server and in Exchange Server 2003

[Speeding Texan]

Regenerated encryption key, deleted service book and resent from BES. I have uninstalled/reinstalled (including deleting the database) the BES software, added and removed myself as a user many times, and have security wiped the blackberry device every time.

Still getting the same error message. Permissions still appear to be intact, nothing else in the event log or BES logs about any errors other than this.

[sferical]

Does the listed user by any chance have domain/exchange/enterprise permissions?

I have seen this before with domain administrators as, due to the way that MS uses and propogates permissions, you actually get mailbox denies for these kind of users.

If you do discover that this is the issue and makes changes make sure that you switch off the BB router or restart the BES as permisions are cached on the router for some reason. Restarting the BES deoesn't always work BTW and you have to bite the bullet and stop the router for 20.

[NOVA]

I am having the same problem here. Most likely your user account is a member of the domain admin group. In this case you are screwed. Microsoft says you need to create a new user account that is not part of the domain admin group. even though it appears that your permissions have worked down through you different OUs you will find that you still have issues beacuse microsoft in all of their wisdom have decided to not let domain admins send emails unless the service account sending the email is their own. I have been struggling with this for 4 days now, even since I applied an exchange update to my server. Now what I'm wondering is....is there a work around. I do not want to re-create user accounts, and I do not want to remove them from the domain admin group. HELP!

[J.W.]

I had the same problem. I decided it was better to give up domain admin rights than to fight this issue. :::sigh::: I was the domain admin and had done all the work assigning the service account to all the mailboxes to get around the send as problem. At least I thought I had.

The changes did not propogate down through AD to my account since I *was* the domain admin. Even though I removed myself from the group, I was not inheriting the new permissions by default.

Go into to your account and make sure your account is inheriting and that the service account has send as allowed for your account. Turn off the BB router for 20 minutes and give AD time to propogate the new permissions to Exchange. Be patient, it can take an hour or so.

Once you do that, you are good as gold.

[sferical]

Giving up domain rights can be a real pain when you are used to doing everything you need logged in as the same user but a good AD administrator should really have seperate accounts for their normal day to day stuff than the one they use for admin tasks.

[BBAdmin]

Giving up domain rights can be a real pain when you are used to doing everything you need logged in as the same user but a good AD administrator should really have seperate accounts for their normal day to day stuff than the one they use for admin tasks.

My opinion exactly. Why would you ever have a 'one does all' administrator....I don't want to belittle anyone, but it's nothing short of rookie and lazy administration.

[NOVA]

So what groups do I need to remover network administrators from for this to work?

[J.W.]

Originally Posted by BBAdmin

My opinion exactly. Why would you ever have a 'one does all' administrator....I don't want to belittle anyone, but it's nothing short of rookie and lazy administration.

Maybe because there is only *one* administrator? Nah....

The good news is that I don't have to give myself 16 character passwords any longer. Bad news: some of the applications I depend on won't run under my account any longer and need to be on different machines now.

Lazy? No, efficient. Now I have to either terminal in or go to the server in question (on a different floor) to do that part of my job. Compared to before, that's a waste of my limited time.

So what groups do I need to remover network administrators from for this to work?

Any domain account with the word "administrator" in it.