Exchange 2010 permissions issue

[Potato-Peeler]

Hello All,

Right having a tricky issue with permissions on Exchange 2010. One of the users has access to a few other user's mailboxes. He has them added in Outlook and every few weeks will get errors saying he does not have access to them. The only way to solve it is to take off his access to the mailboxed then re-add them. This then works for a few weeks and then it all goes wrong again.

We have tried fully updating the server, installing Exchange 2010 SP1, and even the step of recreating the user's entire AD account and mailbox. The server is running server 2008 R2, along with two domain controllers also running 2008 R2.

Short of flattening it anyone got an idea?

[Domino]

What's the Outlook version?

 

We had a similar problem with Outlook 2k7 and multiple mailboxes - especially high traffic ones, however since going to 2010 we've not had the same thing reoccur.

[Potato-Peeler]

Most people use Outlook 2003. however the issue does occur when trying to access alternative mailboxes via the OWA as well.

[sukh]

Hi

 

1. Can you reproduce the issue or does this only happen after x weeks

2. If you give User A permissions to say User B and User C mailboxes, are you saying User A cannot access the mailbox again?

3. What type of acces are you granting? Full mailbox access or to individual default folder (inbox, calendar etc..)?

4. How is User A given access? Via Outlook or EMC?

5. Is User A a delegate for User B and C?

6. Is User A a member of a privledge group such as domain admin, account operators etc..

 

Sukh

[Potato-Peeler]

Thankyou for the response.

1. We cannot force it to replicate the error, it happens after a seemingly random amount of time.

2. User A will have access to B and C mailboxes, he will regularly delve in as they are active, and then one day it will just stop working.

3. We are granting full mailbox access.

4. via the Exchange management console

5. No.

6. he is a member of domain admin group.

[Domino]

When it happens, have you tried running TCPView? TCPView for Windows

 

Once a certain number of tcp connections from one place have been initiated exchange will block future connections - so you should see a larger amount from affected clients.

[sukh]

If User A is a member of a Domain admin group, this could be the cause. Privledges groups and account as domain admins, account operators, administrator are protected secuirty groups. They are part of SDHolder. By default these groups are denied permissions to mailboxes unless you have explicitly modified how SDHolder works.

 

However, saying that, SDHolder does not enforce after x weeks, the refresh is a lot quicker than minutes/hours.

 

Are you sure that it happens every x weeks?

 

As a test, I would remove user from domain admin, this isn't best practise, the reason for SDHolder.

 

Admin account used for admin purposes, give User A an normall account and give this new user account full mailbox permissions and test.

 

If this still an issue, then post back.

 

If you can wait, then maybe we can try and reproduce.

 

Sukh

[Potato-Peeler]

Hey Guys, cheers for help so far. I have managed to get it fully working atm with both OWA and Office 2010. Although previously it hasent worked on OWA it is this time. Any ideas on how to make it work on the guys 2003 outlook?

[sukh]

If the User A has full mailbox permission to User B and C, then regardless of what client (Outlook) User A uses, User A should be able to access the mailbox.

 

Are you trying to add as an additional mailbox?

 

Sukh

[Potato-Peeler]

Yes we are trying to add as an additonal mailbox. However on two different machines with 2003 it is not working, and on OWA and 2010 it is.

[sukh]

1. Are you able to add the additional mailbox or does that fail too?

2. If suceeds, what happens when you try to expand the mailbox for User B in Outlook?

3. Do you get any errors?

4. Is Outlook 2003 on the LAN? i.e are you connecting to Exchange 2010 on the LAN or are you usng OA?

5. Apart from the additional mailboxs to be opened (User B and C) can User A logon to Outlook 2003 and send/receive email?

6. Any reason why you want to use Outlook 2003?

 

Sukh

[Potato-Peeler]

Hello Sukh,

1. You can add it.

2. Unable to expand folders.

3. Says this set of folders can't be opened (If it wasnt for OWA and Outlook 2010 working would presume permissions knackered)

4. Both machines with outlook 2003 are on LAN. So is the attempt to access OWA and office 2010.

5. Everything else appears to work.

6. I hate it, our client refuses to move.

[sukh]

1. Is this the same User who is a member of the Domain Admins group? If so, has he been removed?

2. Is Outlook 2003 fully patched

3. The same User who cannot open the additional mailboxes via Outlook 2003 can open the same mailboxes using Outlook 2010? right?

 

Sukh

Edited April 27, 2011 by sukh

[Potato-Peeler]

1. It is the same user, he has not come back from his meeting and is the chairman of the company so I am loathe to make changes to his account without permission.

2. Both Outlook 2003 setups are fully patched with sp3.

3. if it is the same user for both 2003 setups, OWA and 2010.

[sukh]

Can you ensure that method 2 is set (manual method for Outlook 2003).

 

Outlook connection issues with Exchange 2010 mailboxes because of the RPC encryption requirement

 

Sukh

[Potato-Peeler]

Hello Sukh,

This is indeed set.

[sukh]

Issue seems to be more on the client.

 

1. Have you tried another PC with Outlook 2003?

2. Have you tried to rebuild the Outlook profile and try with a fresh one?

3. Is Outlook cache mode enabled, if so, disable this and test.

[Potato-Peeler]

Hello Sukh,

This is happening on two different PC's with Outlook 2003, same user, and we have recreated the profile. I will try the cached mode now.