Blackberry enterprise server problem

Using a blackberry enterprise server to connect vodaphone blackberries to our exchange server. Been working fine for a couple of years. Since some windows updates at half term all our blackberries have developed the issue that they can't email addresses outside the school domain. This is to do with the "send as" permissions that the besadmin acccount has over the individuals mailboxes. Apparently there was an update that isolates "send as" permissions. Applying the permissions is no problem

Anyway the problem I'm having is I apply the besadmin account to a user's security settings in AD, stop blackberry router, restart exchange IS, wait 20mins, After I restart the blackberry router and the BB problem is still there, I discover the besadmin permissions have disappeared from the user account!!!!

I also have the besadmin permissions applied to user objects in the domain root (shown here on the BB site
https://www.blackberry.com/blackberr...eo/sendAs.html), this also doesn't work because when I check inheritance for a users account, a bit later inheritance has turned itself off!!!

any ideas about this gratefully received.

figured this one out. a recent windows update changed the way permissions such as send as are applied to accounts. You have to use a dos tool to get them to stick. details here: KB12300 - View Document