[steved@mancap.com]

Hello,

I installed my BES about 1.5 years ago with the domain admin account (I know, wrong). Now, I would like to switch the account to use a proper service account. My server works perfectly in the current configuration but I am unable to apply any Windows or Exchange patches to my server in fear of breaking my configuration with the Send As problem. Plus, I think it is good form to have it configured properly!

Here is the server configuration:

- Windows Server 2003 R2 SP2
- Exchange Server 2003 SP2 (no post SP2 patches applied)
- Server is a DC as well (we are a small company so it's all on one box)
- BES Express 4.1.2.20 with 7 users
- MSDE2000 database
- Outlook is NOT installed on the server

I followed Doc ID KB04293 to create and migrate the service account. I have checked the steps numerous times and have not missed anything. I even verified the permissions for the service account in Doc ID KB02276.

My problem is that when I startup the services with the new service account, it won't initialize the users. I get Event ID 20154 "User <username> not started" and then I get Event ID 50079 "7 user(s) failed to initialize".

Everything works fine if I change the service username back to the domain admin account.

I've searched the forum and Googled the issue and Event ID's but came up with nothing related to my particular problem.

I have even tried re-creating the MAPI profile as per Doc ID KB10285.

Does anybody have any other suggestions to try?

Thanks,

Steve

[gibson_hg]

User not started means that the service account cannot access the mailbox. Most likely a permissions issue, even though you have checked them it's the most likely scenario.

Try running the IEMSTest utility from the command line on the BES. It should be in the Utility folder of the BES install directory.

This app will test permissions. It the test fails then let us know where it failed.

[steved@mancap.com]

Thanks for the advice.

I have run the IEMSTest under my BESAdmin account. It is failing on the last test of creating a folder in the user's mailbox. Here is the output (I've omitted the user's name):

BlackBerry Enterprise Server Utility - IEMSTest.exe (IExchangeManageStore), Version 1.0
Copyright (c) Research In Motion, Ltd. 1999. All rights reserved.
Opening Default Message Store Mailbox - BESAdmin.
Opening message store for <username> using /o=First Organization/ou=First Administrative Group/cn=Recipients/cn=<username> /o=First Organization/ou=First Administrative Group/cn=Configuration/cn=Servers/cn=EXCHANGE/cn=Microsoft Private MDB.
<username>'s Mailbox opened successfully.
Root Folder opened successfully.
Failed to create a folder in <username>'s mailbox.


So, it can open up the root folder but it can't create anything within that. The test (obviously) runs fine under my current service account (Domain Administrator).

I have checked the service account switch document again and everything looks good. Could it be something in the registry information that is not jiving with the new service account's HKCU entries? I did a direct export and import as indicated in the document.

Thanks,

Steve

[gibson_hg]

Nope, you are missing the Administer Information Store permission more than likely. It's the one that allows the rights to create entries/folders in the mailbox. Check ALL permissions down to the mailbox store and public folder store in the Exchange System Manager using this article:

BlackBerry Search Results

One of 2 things is happening:

1. Either permissions are set incorrectly
2. Or they have not written to the mailbox and therefore do not work

Check them again and if you are confident they are correct it's the account itself. The best solution is to create another BESAdmin and try again.

Let us know what fixes it.

[steved@mancap.com]

Okay, I got it working thanks to your lead...

I checked the article again and all of the tasks were performed as outlined. Your suggestion of verifying the security at the private and public store level is what led to the solution. The permissions on the private mailbox store were not inheriting from the previous level (public was). I enabled propagation on the private store, started the services with the new account, and voila!

All is good - thanks for your assistance gibson!

Steve

[gibson_hg]

Thanks for the update, always glad to help!