[Karama]

Okay, I got the calender fixed by removing from domain admin group, stopping all the blackberry services, i changed the account that they started under to the besadmin account. Logged off, logged on as besadmin and started all of the services. Then tested and it fixed the two-way syncing of the calender. I thought everything was good but now the user can't send email from the blackberry. Everything else is working and the email was working before I did my fix for the Calender. I am wondering if this BPS Software is worth the trouble Any help would be great

[Karama]

Okay, I am confused. I still had the account in the administrators group, not the domain admin group. I took it out of that group. After rebooting I saw that half the services weren't starting. I tried logging into the besadmin account and start the manager software and I was getting errors and it asking for account information for the database to run. I hit cancel and tried starting the blackberry services and they wouldn't start. I had to put the account back into the administrator group to get the software to run again. What am I doing wrong!!!

[hdawg]

You really need to read through the installation documentation for BPS. It explains the permission requirements ... KB02276 - Assigning permissions for a BlackBerry Enterprise Server service account - Port3101.org : Your BES Connection

[Karama]

no offense but I have gone over these permissions ad nauseam. The email was working fine until i fixed the calender. Do i need to remove and reapply the persmissions because they all look correct. Here is one of the errors.

MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed

[nobody7290]

The besadmin must be be a member of the local administrators group. However, if you install on a Domain Controller (which is the case because this is a Small Business Server), there is no local administrator group.
In this case the besadmin user must be a member of the domain wide administrators group, but not member of the domain administrators group

again add the besdadmin user to the administrators group. Then fix the other problems.

[hdawg]

in other words; fix the permissions.

No offense, but your ad nauseam is apparently not good enough. Maybe you should just create a new account to use as besadmin ... KB04293 - How to switch BlackBerry Enterprise Server service accounts - Port3101.org : Your BES Connection

[Karama]

I did add it to the administrators group, not the domain admin group and the email isn't working (but the services are loading)

[nobody7290]

Then, do a reinstall of the BPS software as the besadmin user, after that, apply any service-packs/updates if neccesary. That should not hurt. I dont think you will loose any vital information.
When I switched from a Windows 2000 Server to 2003 I also had similar problem (on 2000, BES/BPS can be run as administrator). Reinstalling helped, and, all User information was kept.

[Karama]

cool, i do appreciate the help. I want this software to work and it has been a little frustrating. The client is getting annoyed because it was my idea to go with this software.

[Karama]

Well, I setup a new service account, did exactly as the instructions said, and this is what shows up in the event log

first message in event log MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed

second message in event log Send() failed: ERR_SUBMIT_MAIL, Tag=8386

email still not sending but everything else is working

[nobody7290]

have you tried to:
verify the BESAdmin mapi profile, and then
(logged in as the besadmin account )
go to the /programs/Research in motion/Blackberry Enterprise Server/utility
execute: iemstest.exe
choose the user in question from the list.

what is the output ?

[nobody7290]

could this:
Microsoft patch - Blackberry workaround - Discussed in BES Admins & Professionals forum - PinStack.com - Smartphone Professionals Alliance.
be a reason ?

To actually check, if the besadmin user has send as and receive as permissions:
In active Directory and users, under View, check Advanced functions,
now, open the properties of a user, under Security, advanced, you can see all permissions to the user account.
There is also a button like "reset to default settings"

From here you also can check the effective permissions to a users mailbox. Choose the besadmin account to verify and check if the "receive as" and "send as" permissions are checked for a user account.

[Karama]

I ran the test, a dos box opened i saw something running, and then it closed, don't know what happened or where the output is

don't know if i did it right, it had two default profiles to pick from
Blackberry Manager
Blackberry Server

I picked blackberry manager

Then I selected the user that can't send mail

[nobody7290]

you have to open a dos/cmd box before you run the command.
then execute the command from the dos box.

[Karama]

Okay, here is something weird. When I go to the advanced under security policy under the domain, not only do i see besadmin2(the new service account) listed to send as which is correct, I see an account unknown also listed to send as
Account Unknown(S-1-5-21-1854294705-1306172298-2619958573-1156)

Is that causing the problem?

[nobody7290]

I dont think so.
As long as your besadmin2 has send and receive as permissions that should be ok.

what group belongs your user to ?
He should not be a member of any special group, only belong to the users group.
not: administrators, domain admins, printer operators ...

[Karama]

Well, a few posts back it was said that it was okay to be a part of the administrators group

It is in
Domain user
administrators
remote desktop users

[nobody7290]

remove the user from the administrators group.
the besadmin user must be member of the administrator group,
however, not the user which owns the blackberry.

[Karama]

okay, remove the user with the blackberry from certain groups, which groups should i let the user be a part of? this is a sbs 2003 installation

[nobody7290]

domain users and remote desktop this is ok.
the groups which a user is member of when you create him through the wizard + remote desktop should be ok.

and:
try the iemstest.exe utility.