Problems occurred trying to use your mailboxes, Exception message: Active Directory operation failed on Dc1.smtp25.org

Scenario:

Exchange 2007 migration after moving mailboxes from exchange 2003 to exchange 2007 users can not log into OWA and receiving errors "problems occurred trying to use your mailboxes". The fix for this error is going to be easy.

Error:

Exception message: Active Directory operation failed on Dc1.smtp25.org. This error is not retriable. Additional information: Insufficient access rights to perform the operation. Active directory response: 00002098: SecErr: DSID-03150E8A, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Fix:

• Open ADUC,
  
• Locate the user having trouble (turn advance futures on, by clicking view if you are not seeing security tab)
  
• Put a check mark where it says "Include inheritable permissions from this object parent" or simply click restore
  
• Go back to OWA and now you should be able to login
  

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com

Setting BES Permissions on Exchange 2007

We will make the BESAdmin account member of Exchange ViewOnlyAdmin role and assign Send-as Receive- as rights. All you need to do is to replace your Exchange server name with yours and the BESAccount name.

Remember the use EMS (Exchange management Shell) not WPS (Windows power Shell)

Log on to Exchange 2007 Server

Start, Programs,MES 2007, EMS

• Bes account name: BESAdmin
• Exchange 2007 Server name: SMTP25CMS
  

Addexchangeadministrator "BESAdmin" –role ViewOnlyAdmin

get-mailboxserver SMTP25CMS add-adpermission -user BESAdmin -accessrights ExtendedRight -extendedRights Send-As, Receive-As, ms-Exch-Store-admin

RIM KB

Oz Ozugurlu
MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
Blog: http://www.smtp25.blogspot.com

PRODLY representing A love song about ... Exchange Server 2007?

Enjoy first official Microsoft white paper song (- : from MSexchange team

Most people write love songs about other people, but the folks on Microsoft's Exchange Server team were enamored enough with its Auto discover capability to give it an Elton John-style musical treatment.

OK, so it's not exactly destined for the Billboard charts, but at least it's more melodic than the typical Microsoft white paper. And it's not nearly as cheesy as the Microsoft sales team's infamous Springsteen spoof.

David Sterling, the Exchange Web Services engineer behind the Autodiscover song, explains how it came to be in this blog post.

Taken from

http://blog.seattlepi.nwsource.com/microsoft/archives/145822.asp

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com

Replicating Directory Changes in Filtered Set access rights for the naming context

After installing first DC/GC windows 2008, receiving following error on DCdiag

Error:

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context:

DCdiag /q is giving errors after installing fist DC into existing forest. Domain. The event id is also complaining about same problem. After doing a little research found out the problem is being caused not running
adprep /rod prep yet in the domain. So running this will get rid of from errors below. Insert your windows 2008 installation disk into CD-Room or ISO. Go to command line and copy and paste below command (make sure D is the cd-room, or change it to appropriate drive letter in your server

• D:\sources\adprep\adprep /rodcprep
  
• After running this command you will get output similar to this

Adprep completed without errors. All partitions are updated. See the ADPrep.log in directory C:\Windows\debug\adprep\logs\20080809195019 for more information

Starting test: WIN09DC1 Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=ForestDnsZones,DC=smtp25,DC=org Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=DomainDnsZones, DC=smtp25,DC=org ......................... DC2 failed test NCSecDesc Starting test: NetLogons ......................... DC2 passed test NetLogons Starting test: ObjectsReplicated ......................... DC2 passed test ObjectsReplicated Starting test: Replications [WIN09DC1DsBindWithSpnEx() failed with error 1722, The RPC server is unavailable.. ......................... DC2 failed test Replications Starting test: RidManager

This is the process to contact the infrastructure master and update the permission on the application directory partition adprep /rodcprep will take care permissions on the Infrastructure master in order for us to install RODC's. This is the process to contact the infrastructure master and update the permission on the application directory partition

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com