[Cloyde Syfox]

I have 55 users on my BES. All but one are working properly. The one user in question is able to receive but not send.

I can make her send by adding the besadmin security group to her profile but that will last about one hour and then it is removed.

Does anyone have any idea what is removing this permission from the user account?

Is this user a Domain Admin, or part of a group with special privileges in Active Directory?
http://www.blackberry.com/btsc/searc...00%20174518448

[Cloyde Syfox]

Yes the user is part of Domain Admins. However all other BB users are also members of this group.

Take all of the users out of the Domain Admins group.
They shouldn't be in there and their BlackBerry devices will eventually fail.

A BlackBerry user shouldn't be a Domain Admin. This is going to muck up the Send As privilieges which BES needs to properly send mail.
Follow the principle of least privilege and make those users "normal" unprivileged users.

Create a separate AD account for your admins and have them use the second account when they need to do work which requires administrative privileges.

[Cloyde Syfox]

I just want to clarify.

The user has Domain Admins listed under the security tab and not the member of tab.

I'm more confused now.
Are you looking in Active Directory?
What groups are listed in the 'Member Of' tab for this user?

[Cloyde Syfox]

Sorry for the confusion.

Under member of Tab the user is not a member of Domain Admins.

I was looking at the security tab under the advanced features view.

So the user is not a member of Domain Admins.

OK, well that's good.
So what actually happens when this user tries to send an email from the BlackBerry?
Are they getting a red X next to the message?

If you open that failed message, does it show you an error message at the top of the email?

Is it possible that this user has reached their mailbox quota in Exchange?

[Cloyde Syfox]

Yes there is a red X and the error message is

"Desktop Email program unable to submit message."

Now I have googled that and all I can find is information about adding the send as feature. Which I have done but it just gets removed again.

Also there is a check box under the Security tab.

"allow inheritable permissions from parent to popagate to this object"

When I check this box all the proper permissions are applied I can send email for about 1 hour. Then some policy seems to remove it again and sending email stops again.