[VinceButler]

I'm losing my freaking mind

I have been trying to get a new BES 5 server running for HOURS against our Exchange 2010 system. Yes, I'm running the correct version - 5.0.1 MR1 with the right CDO etc. It was working briefly earlier today, and then it stopped and I can't figure out why. I have even gone so far as to wipe the server and reload from scratch and I am still having trouble. I'm fairly certain my problem is that I can't get the AD permissions for the BESAdmin account to apply correctly. I am following the directions in the BES 5.0.1 Install Guide on page 20-21. I have completed steps 1-3 successfully, but whenever I try #4 I get the following:

[PS] C:\Windows\system32>Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As
-User "BESAdmin" -Identity "CN=Users,DC=PUHSD,DC=ORG"
Active Directory operation failed on dc-dhcp.PUHSD.ORG. This error is not retriable. Additional information: Access is
denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
+ CategoryInfo : WriteError: (0:Int32) [Add-ADPermission], ADOperationException
+ FullyQualifiedErrorId : DA172DD1,Microsoft.Exchange.Management.RecipientTa sks.AddADPermission

I can't figure out why I am getting denied. I am a member of both Domain Admins and Enterprise Admins, as well as Organization Management. Based on everything I can find I should be able to apply these rights but it just isn;t happening. Does anyone have any ideas about what could be causing this, or have an alternate method for getting these rights applied without using Powershell? I'm desperate, I don't want to spend my Christmas here...

[VinceButler]

More details...

I still can't figure out why I am unable to run the AD-AddPermission command. I even tried assigning Exchange rights to my domain's Administrator account (which we don't use for anything so it's rights assignments are pretty vanilla). Same problem. All I can figure is there is an inheritance issue with the Domain Admins or Enterprise Admins group(s) that is gumming it up.

As a workaround I tried manually assigning Send As to the BESAdmin account at the root of the domain, and applying it to "Descendant User Objects." When I check any mail account in the EMC BESAdmin is listed with both Send As and Full Mailbox. However, when I run IEMSTest.exe on the BES server I get the following:

BlackBerry Enterprise Server Utility - IEMSTest.exe (IExchangeManageStore), Vers
ion 1.0
Copyright (c) Research In Motion, Ltd. 1999. All rights reserved.
Opening Default Message Store Mailbox - BESAdmin

Vince Butler: Opening message store using
/O=PUHSD/OU=District Office/cn=Recipients/cn=vincent.butler
/o=PUHSD/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configura
tion/cn=Servers/cn=CAS01/cn=Microsoft Private MDB
Vince Butler: OpenMsgStore failed (8004011d)
Vince Butler: CDO Server Name: CAS01
Vince Butler: CDO Mailbox DN: /O=PUHSD/OU=District Office/cn=Recipients/cn=vince
nt.butler
Vince Butler: CDO logon successful
Vince Butler: CDO COM exception: Code = 80040705, WCode = 0505, Code meaning = I
Dispatch error #1285
Description = You do not have permission to log on. [Microsoft Exchange Serv
er Information Store - [MAPI_E_FAILONEPROVIDER(8004011D)]].
Vince Butler: CDO test failed
Vince Butler: No Send As permission for the {PUHSD\BESAdmin} account operator.

[fieldgeek]

With the account you are trying to assign the permissions with, is it's role in Exchange assigned correctly?

With specifically adding the permissions in AD, is Vince Butler a member of any protected groups in AD (like domain admins)?

Sorry if these are just basics for you but I always need to start there.

[VinceButler]

The account I am trying to assign permissions with is in the Organization Management role. It is also a Domain Admin. I was not aware it was a protected group (not even sure what that means). Can I just use an account that is assigned full permissions to the root of the domain instead?

[fieldgeek]

The problem is not with the permissions your account has then when assigning permissions, it is that your account cannot properly recieve those permissions applied to it. If you check on the security of the account you will see only default Microsoft permissions and nothing you might have created or assigned. The adminsdholder protects admin accounts from getting unwanted things (and many times wanted things) which is why it is best to keep administrative accounts seperate from non-administrative accounts, really, for you to have two accounts. I am not sure if this is related to restrictions for assigning the send-as rights thought, it might be. Hmm... I'll have to look.

[VinceButler]

I tried creating an new AD account which is in the Domain Users group only. I assigned it full access to the root of the domain (so in effect it has the same permissions as the Enterprise Admins group, but is not a member of that group or any other admin groups). I also created a mailbox for the account and assigned it to the Organization Management role. I waited about 10 mins for replication, logged in on the server and tried running the command from the shell but received the same Insufficient Permissions error.

[knottyrope]

Look at page 19
View Document 0 256342616

you are giving too many permissions.

[VinceButler]

That is the document I was referring to in my original post. As I explained in that post, I was following those directions and the first three steps worked perfectly. The fourth step - applying the Send-As permissions - will not apply because the shell claims I have insufficient permissions. My struggle has been in getting my account (or another account) configured with the appropriate permissions to apply step 4 successfully.

If you can provide any information on what rights I need to successfully pass that step, or what exactly that step does so I can replicate the permissions assignments outside of the Exchange Shell it would be most helpful.

[knottyrope]

make a new domain user and do knot add anything else to it in AD except for a mail box.

then add the send as permissions.

[VinceButler]

Fixed. At least for right now

I just manually assigned permissions at the root of the domain (the same thing I explained in my second post). I still had 32 users who were not starting and were getting the following error:

Event Type: Warning
Event Source: BlackBerry Messaging Agent PUHSD BES Agent 1
Event Category: None
Event ID: 20400
Date: 12/29/2009
Time: 9:24:52 AM
User: N/A
Computer: BES
Description:
{username@puhsd.org} MAPIMailbox::MAPIMailbox - OpenMsgStore (0x8004011d) failed, MailboxDN=/O=PUHSD/OU=District Office/cn=Recipients/cn=username, ServerDN=/o=PUHSD/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=CAS01/cn=Microsoft Private MDB

Turns out I never turned off client throttling on Exchange and that was causing the problem. I applied the following command:

Get-ThrottlingPolicy | where {_.IsDefault -eq $true} | Set-ThrottlingPolicy -RCAMaxConcurrency $null

then restarted Exchange, then the BES, and now it looks like things are working normally. I still see some errors in the event log but I think those are related to the user migration from our old BES using the Transporter tool.

[easy-v]

Originally Posted by VinceButler

I'm losing my freaking mind

I have been trying to get a new BES 5 server running for HOURS against our Exchange 2010 system. Yes, I'm running the correct version - 5.0.1 MR1 with the right CDO etc. It was working briefly earlier today, and then it stopped and I can't figure out why. I have even gone so far as to wipe the server and reload from scratch and I am still having trouble. I'm fairly certain my problem is that I can't get the AD permissions for the BESAdmin account to apply correctly. I am following the directions in the BES 5.0.1 Install Guide on page 20-21. I have completed steps 1-3 successfully, but whenever I try #4 I get the following:

[PS] C:\Windows\system32>Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As
-User "BESAdmin" -Identity "CN=Users,DC=PUHSD,DC=ORG"
Active Directory operation failed on dc-dhcp.PUHSD.ORG. This error is not retriable. Additional information: Access is
denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
+ CategoryInfo : WriteError: (0:Int32) [Add-ADPermission], ADOperationException
+ FullyQualifiedErrorId : DA172DD1,Microsoft.Exchange.Management.RecipientTa sks.AddADPermission

I can't figure out why I am getting denied. I am a member of both Domain Admins and Enterprise Admins, as well as Organization Management. Based on everything I can find I should be able to apply these rights but it just isn;t happening. Does anyone have any ideas about what could be causing this, or have an alternate method for getting these rights applied without using Powershell? I'm desperate, I don't want to spend my Christmas here...

Try running EMS with elevated priveliges (Right click, runas administrator)

[VinceButler]

I tried running EMS both ways when I was originally having the problem and I got the same error.

[Karl123]

I have the same error and i do not know what i should do more. Anything written in this Thread does not help to get rid of this error.

If anyone has an solution for this problem please let me know.

Karl

[FinsToTheLeft]

I was experiencing the exact same problem. Just for kicks I ran the same command under the Exchange 2007 Management Shell and it worked. I then tried to run it again under the Exchange 2010 Management Shell and it returned an error saying that the account already had the permission assigned, allowing me to continue with the install.

[garycutri]

RESOLVED: OpenMsgStore failed (8004011d) error in Exchange 2010

If you followed the official BES 5.0.1 install guide you would have issued the following two commands:

New-ThrottlingPolicy BESPolicy

Set-Mailbox "BESAdmin" -ThrottlingPolicy BESPolicy

These two commands would have created a new policy and added BESadmin with all the default settings (RCAMaxConcurrency = 20) which doesn't prevent the "OpenMsgStore failed (8004011d)" error from occurring once multiple users are added.

To correct this error please enter the commands below into the Exchange Management Shell:

1. Change the RCAMaxConcurrency to unlimited (default is 20) using the following command:

Get-ThrottlingPolicy | where {$_.IsDefault -eq $true} | Set-ThrottlingPolicy -RCAMaxConcurrency $null

2. Display a list of your Throttling Policies using the following command:

Get-ThrottlingPolicy

3. From the "Get-ThrottlingPolicy" output locate and copy the "DefaultThrottlingPolicy" name.

Example: "DefaultThrottlingPolicy_a1f84187-7a42-4ece-9276-06c704be21e7"

4. Now enter the command below but paste in your DefaultThrottlingPolicy name.

Set-Mailbox "BESAdmin" -ThrottlingPolicy <Default Policy Name>

Example: Set-Mailbox "BESAdmin" DefaultThrottlingPolicy_a1f84187-7a42-4ece-9276-06c704

5. Now remove the "BESPolicy" that isn't required by issuing the command below:

Remove-ThrottlingPolicy BESPolicy

From: http://www.blackberryforums.com.au/f...ge-2010-a.html

Full Exchange 2010 Install Guide: http://www.blackberryforums.com.au/f...all-guide.html

[ec1060]

Originally Posted by Karl123

I have the same error and i do not know what i should do more. Anything written in this Thread does not help to get rid of this error.

If anyone has an solution for this problem please let me know.

Karl

*** SOLVED! ***

I was getting the same error as you, and I figured it out ... turns out it had nothing to do with permissions. The error is because you are not specifying the EXACT Distinguished Name for your BESAdmin account.

Here's how to determine the exact Distinguished Name...

1. On your Exchange Server (mine is Exch 2010), launch Active Directory Users & Computers

2. Right-click on the very top node (it says "Active Directory Users and Computers") and select View | Advanced Features

3. Next, drill down in the tree, until you locate your user (BESAdmin)

4. Right-Click on your BESAdmin user and select "Properties"

5. Click on the "Attribute Editor" (You won't be editing anything in this tab ... you're just looking)

6. Scroll down in this list of attributes, until you find "distinguishedName"

7. Copy the entire Value.

In my case, it is:
"CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

8. Now go back to the Exchange Management Shell (aka the "Tool That Intimidates the Hell out of my Boss and Therefore Gives me Job Security") and re-enter the entire "Add-ADPermission" command, this time using the Distinguished Name you found in ADUC.

Worked for me ... I think it should work for you too!

To clarify ... the ENTIRE command I ran in Exch Management Shell was:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

[knottyrope]

Originally Posted by ec1060

*** SOLVED! ***

I was getting the same error as you, and I figured it out ... turns out it had nothing to do with permissions. The error is because you are not specifying the EXACT Distinguished Name for your BESAdmin account.

Here's how to determine the exact Distinguished Name...

1. On your Exchange Server (mine is Exch 2010), launch Active Directory Users & Computers

2. Right-click on the very top node (it says "Active Directory Users and Computers") and select View | Advanced Features

3. Next, drill down in the tree, until you locate your user (BESAdmin)

4. Right-Click on your BESAdmin user and select "Properties"

5. Click on the "Attribute Editor" (You won't be editing anything in this tab ... you're just looking)

6. Scroll down in this list of attributes, until you find "distinguishedName"

7. Copy the entire Value.

In my case, it is:
"CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

8. Now go back to the Exchange Management Shell (aka the "Tool That Intimidates the Hell out of my Boss and Therefore Gives me Job Security") and re-enter the entire "Add-ADPermission" command, this time using the Distinguished Name you found in ADUC.

Worked for me ... I think it should work for you too!

To clarify ... the ENTIRE command I ran in Exch Management Shell was:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

Nice! Thanks for sharing.

[tranquilnet]

Originally Posted by ec1060

*** SOLVED! ***

I was getting the same error as you, and I figured it out ... turns out it had nothing to do with permissions. The error is because you are not specifying the EXACT Distinguished Name for your BESAdmin account.

Here's how to determine the exact Distinguished Name...

1. On your Exchange Server (mine is Exch 2010), launch Active Directory Users & Computers

2. Right-click on the very top node (it says "Active Directory Users and Computers") and select View | Advanced Features

3. Next, drill down in the tree, until you locate your user (BESAdmin)

4. Right-Click on your BESAdmin user and select "Properties"

5. Click on the "Attribute Editor" (You won't be editing anything in this tab ... you're just looking)

6. Scroll down in this list of attributes, until you find "distinguishedName"

7. Copy the entire Value.

In my case, it is:
"CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

8. Now go back to the Exchange Management Shell (aka the "Tool That Intimidates the Hell out of my Boss and Therefore Gives me Job Security") and re-enter the entire "Add-ADPermission" command, this time using the Distinguished Name you found in ADUC.

Worked for me ... I think it should work for you too!

To clarify ... the ENTIRE command I ran in Exch Management Shell was:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

Well done! This worked for us as well on Exchange 2010 Standard running on Windows 2008 R2 Enterprise Server.

Thanks!

-Will

www <DOT> tranquilnet <DOT> com

[rpfeffer]

Originally Posted by ec1060

*** SOLVED! ***

I was getting the same error as you, and I figured it out ... turns out it had nothing to do with permissions. The error is because you are not specifying the EXACT Distinguished Name for your BESAdmin account.

Here's how to determine the exact Distinguished Name...

1. On your Exchange Server (mine is Exch 2010), launch Active Directory Users & Computers

2. Right-click on the very top node (it says "Active Directory Users and Computers") and select View | Advanced Features

3. Next, drill down in the tree, until you locate your user (BESAdmin)

4. Right-Click on your BESAdmin user and select "Properties"

5. Click on the "Attribute Editor" (You won't be editing anything in this tab ... you're just looking)

6. Scroll down in this list of attributes, until you find "distinguishedName"

7. Copy the entire Value.

In my case, it is:
"CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

8. Now go back to the Exchange Management Shell (aka the "Tool That Intimidates the Hell out of my Boss and Therefore Gives me Job Security") and re-enter the entire "Add-ADPermission" command, this time using the Distinguished Name you found in ADUC.

Worked for me ... I think it should work for you too!

To clarify ... the ENTIRE command I ran in Exch Management Shell was:

Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=BES Admin,OU=Special Purpose,OU=My Company,DC=mycompany,DC=com"

I don't see how this assigns send as permissions to all users in a specific OU, since the DN you are using is just for the BESAdmin account...

[KalvinCline]

I don't think this actually assigns the "send as" permssion rather it grants the user (BESAdmin) the right to assign the permission. Perhaps I read through this forum too fast but that's what I got out of it.

Good to know!!