Exchange 2010 - Send as persmission

[ColinP]

Hi all.

 

I have a very annoying problem in exchange 2010, why i try and add send as permision to a mailbox i get

 

“Error:

Active Directory operation failed on DC.domain.com. This error is not retriable. Additional information: Access is denied.

Active directory response: 00000005: SecErr: DSID-03151E07, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

 

The user has insufficient access rights.”

 

 

I can fix this in active directory by clicking on the user, then security and reset to defaults, i can then add users with no problem in EMC.... but about 30 minutes later the permisons in AD have changed back and send-as is broken again.

 

ive tryed moving the user for the mailbox to the start of the tree in AD as it must be inheriting dodgy permision from somewhere but that dosent help...

 

 

any ideas?

[dapaulio]

I may be taking a stab in the dark but Have you a 2016 dc?

I found a couple no supported issues with exchange 2010 and 2016 dc

One being adding a database in emc. Workaround is powershell targeting a non 2016 dc

Edited November 13, 2017 by dapaulio

[ColinP]

Im now using 2016 but i have had this problem prior, we were using server 2008 r2 and i was was hoping a good tidy up and upgrade over half term would fix it

[dapaulio]

Can you powershell the sendas permission? (Running as administrator)

I will paste the one liner in for you when I get to my computer. I’m on my phone atm

 

Aside from this issue Be warned that exchange 2010 is not supported on 2016 dc so any problem you do encounter may get knocked back if you raise them to Microsoft.

 

Because of the minor issues I have already encountered and If you haven’t already got one introduce a 2012 r2 dc. You will be able to carry out tasks that error on exchange pointing to this dc until you can either upgrade exchange or cut over migrate into O365

[ColinP]

Strange my post never saved....

 

would be very gratefull if you could send me the powershell line, ill give that ago.

 

I do have a 2012 DC should i tell exchange to use that - what would be the repercussions?

 

Cheers

 

Colin

[dapaulio]

would be something like this. Be warned the send as permission has a delay before propagating. it may show up in EMC as applied but I have known it to take upto 24 hours

Add-ADPermission -identity "User" -User "Domain\User" -Extendedrights "Send As"

or

full control

Add-MailboxPermission -Identity JeroenC -User 'Mark Steele' -AccessRights FullAccess -InheritanceType All -Automapping $false 

 

To read data from another dc use the switch -domaincontroller "dc.domain.com". No repercussions, it only specifies the dc to read the info from. if omitted the exchange just chooses the best available at the time.