[rjd75]

I am experiencing a memory leak problem with my BES 4.0 server. I call RIM tech support and they told me it was a known problem and that I need to upgrade to Exchange SP2. When I do this I am going to encounter the problem that MS describes lately where you have to explicitly allow besadmin send as permissions for each bes user in order for mail forwarding to continue. However, the Microsoft documentation says that if the user is a member of the Domain admins group it will automatically revoke "send as" permissions. So it tells you to create an additional account for that user and give the original account send as permissions to the new account??? Confused yet? I know I am.. and when I called RIM for some more clarification they told me to call MS because it is an AD issue.. I said considering it is so closely related to their product they should probably have some answers for their customers, but I think my complaints were falling on deaf ears.. Has anyone here had to do this yet?? Here are the links to the RIM and MS articles.. If you are running Exchange you will encounter this sooner or later...

Apparently I can't post URLs because of my newbie status.. so just cut and paste these links and replace DOT

http://www.blackberry.com/knowledgec...odeid=1166052&

support.microsoft.com/kb/912918/en-us

Any help would be appreciated!

[jibi]

the Microsoft article is honestly pretty straight-forward, although there are a lot of unrealistic suggestions. i would say that pretty much all of our immediate Domain Administrators have BlackBerry handhelds (perhaps 2 people being an exception to that assumption). i do agree that RIM should support this issue, BUT it is technically a Microsoft issue and by them supporting that portion of the product, and given the nature of this issue, there could be a WHOLE can of worms (and liabilities) opened by RIM. its smart on their part not to support the configuration change (we've held off on implementing the patch), although some customers may view it as downright horrible support business tactics (i can see it from both points of view).

[sazhar]

Hi,

There is also a script that MS has provided on the KB article. The fix is to basically apply receive as and send as access to the service account that you are using for talking to Exchange for every user's mailbox who has got BB. This can also be achieved using the script the article mentions...

Thanks,
Azhar

[jibi]

the script doesn't fix administrative accounts, though.

[HandyD]

KB912918 doesn't work. Blackberry's solution to switch off the router for 20 mins is ridiculous.

Adding the Send As permission to the service account for each user is the way to go but the only snag as you may have found out is that the permission is deleted after an hour. It's also inconvenient especially if you have many Blackberry users.

This is how it should be fixed:

1. Open AD Users and Computers

2. Select View and Advanced Settings

3. Create a Domain Local Security group at the highest OU level that contains the users accounts that have Blackberrys.

4. Add these users as members of the group.

5. Go to the Security Tab for the group.

6. Click Advanced Permissions button.

7. Click Add and select the account that you use as your BES service account.

8. On the Permissions page change the drop down for Apply Onto to read User Objects

9. Then set Send As and Read permissions

10. Make sure the Apply These Permissions to Objects Within This Container box is unchecked.

11. Click Ok out of all the permissions pages.

12. Then restart exchange system attendant to refresh the permissions cache.

13. You'll now find that the permission is inherited by all your BB users and it will now stick.

14. Throw darts at your convenient picture of Bill Gates.

Originally Posted by rjd75

I am experiencing a memory leak problem with my BES 4.0 server. I call RIM tech support and they told me it was a known problem and that I need to upgrade to Exchange SP2. When I do this I am going to encounter the problem that MS describes lately where you have to explicitly allow besadmin send as permissions for each bes user in order for mail forwarding to continue. However, the Microsoft documentation says that if the user is a member of the Domain admins group it will automatically revoke "send as" permissions. So it tells you to create an additional account for that user and give the original account send as permissions to the new account??? Confused yet? I know I am.. and when I called RIM for some more clarification they told me to call MS because it is an AD issue.. I said considering it is so closely related to their product they should probably have some answers for their customers, but I think my complaints were falling on deaf ears.. Has anyone here had to do this yet?? Here are the links to the RIM and MS articles.. If you are running Exchange you will encounter this sooner or later...

Apparently I can't post URLs because of my newbie status.. so just cut and paste these links and replace DOT

Any help would be appreciated!

[nukem]

I am experiencing a memory leak problem with my BES 4.0 server - err article
support.microsoft.com/kb/912918/en-us has absolutly nothing to do with a memory leak. Nope, nada. Thus are you refering to ERR_RESOURCE_ALLOC perhaps? Cause then you can try SP 2 for MS Exchange or support.microsoft.com/default.aspx?scid=kb;en-us;898782 to update 1 tiny file and then reboot the BES and its gone.

Stating that article KB912918 does not work perhaps is due to the lenght of it. What Microsoft walked you through was easily found in the heading "How to grant the Send As permission for multiple accounts"
and following steps 1 to 8. There are no other steps you can do manually per user.

The looong script works... tested it, rolls back on "protected group membership" (see below, this it is by design from Microsoft).

Running DSACLS rock's if you want the Domain admin to work! - I suspect that each patch removed it ( and all other steps) and had to run it again though... too busy to test.

If you set the rights in an OU then you should pay attention to "Inheritance". If it is not set then the changes made will not make it down from your OU to each user thus no fix. Make sure Inheritance is enabled will resolve this BUT for users in Protected Groups which is fully documented in this Microsoft Article:support.microsoft.com/kb/907434/ - easily proved by enabling SEND AS on an Admin and then in an hour watch it get removed.

I hope this helps. Understand, this was from Microsoft and we all worked previous to this. Do the math. This is their version of "Competition" in the wireless handheld market.

Duke - Frag the weak, hurdle the dead

[HandyD]

Nothing to do with the length of KB912918.

I spent two days following it and running the script and each time the permissions were changed back after an hour.

None of our affected accounts have admin permissions, and the service account doesn't either.

I know of two other sites where the same thing has happened which is why I posted it. If KB912918 works for you then great but it doesn't for everyone which is why MS keep updating it.

As for it being a deliberate attack on Blackberry, it's pretty obvious that it is. Whilst I don't particularly like Blackberry, their kit or their software I think this just stinks. But after being in this business for 18 years, nothing MS does will surprise me.

[elgauchogrub]

Why not just use a regular domain users account for day to day email etc, and then have a seperate account for domain admin tasks?

[jibi]

Originally Posted by elgauchogrub

Why not just use a regular domain users account for day to day email etc, and then have a seperate account for domain admin tasks?

in a unix world, its perfectly understandable. in a windows gui world, its not. its downright ridiculous, actually.

[HDClown]

Originally Posted by jibi

in a unix world, its perfectly understandable. in a windows gui world, its not. its downright ridiculous, actually.

I wouldn't call it ridiculous, but it is nowhere near as unix. In unix world you have su, in the windows world, you only have run as.

You can use run as to launch IE as a domain admin,a nd then navigiate to everything you need through that. It works farily well in fact, but it's nowhere near as convenient as having su in unix.

[easy-v]

Originally Posted by HandyD

None of our affected accounts have admin permissions, and the service account doesn't either.

FWIW:
This can also happen if a user belongs to a group that includes users or groups from other domains.

[jpresto]

I was very happy to find this thread. Had the same problem with the perm disappearing. Interesting point is that it didn't happen when I set up the first user, but wrestled with it on the second.

[itzallgood]

Permint "Send as" for the BES Admin account (the one that starts your bb services) on any user account using BES. Change it in Active Directory not in exchange admin.

Stop the Blackberry Router service on BES for 20 minutes to clear the message cache. <-- important

Should work fine.

[KrazyFool]

ive had big problems with this, it works now i think though runnging the script ms has given me probably has done all the permissions no good at all.

only me, being a sys admin is having problems. the besadmin account which i believe should be in my security settings keeps being removed. Ive read the articles but are having a hard time deciphering exactly what i have to do.

[KrazyFool]

tried creating a new group as suggested by HandyD but still it gets removed.

[rm74]

If you are using Microsoft Exchange, you can get around the issue of Domain administrators being denied the "Send As" permissions. You get the same problem if a Domain administrator tries to Exmerge a mailbox on Exchange 2003.

The resolution is documented by Microsoft in KB823143 and KB292509.

Basically you need to create a security group in AD and add your administrator account to that group.

You then need to delegate Exchange view only permissions to the group.

Finally you need to grant the group permissions to the store which hold the mailboxes you require.

If you follow KB292509 it should do the trick. It resolved our Exmerge issue and allows administrators "Receive As" and "Send As" permissions to users mailboxes.

[jmanford]

"When I do this I am going to encounter the problem that MS describes lately where you have to explicitly allow besadmin send as permissions for each bes user in order for mail forwarding to continue. However, the Microsoft documentation says that if the user is a member of the Domain admins group it will automatically revoke "send as" permissions"

I am running Exchange Server 2003 SP2 and it didn't revoke 'send as' permissions.

I don't think it's an SP2 issue. It's one of the HOTFIXES that breaks/revokes the 'send as' right for BESADMIN. Isn't it?

[ashworth]

Originally Posted by jmanford

I don't think it's an SP2 issue. It's one of the HOTFIXES that breaks/revokes the 'send as' right for BESADMIN. Isn't it?

Your right. If you look at the KB from RIM they say the version of store.exe has to be 6.5.7650.x or higher. The version of the store.exe in SP2 for Exchange 2003 is 6.5.7638.x.

I'm with RIM on this one. If you download a MS "fix" that modified your AD, then why should it be up to another company to fix it? I think this is just a way for MS to try to put a stop to the RIM's great success.

[elgauchogrub]

Hows that ridicolous? Just install all the necessary admin tools (BES, Exchange, SQL, SMS etc ) on a "toolbox" server/desktop even, and login via RDP using an elevated account and take care of business.
It seems a bit risky to put all the keys to castle in one account when it's easily mitigated. Just my 2 cents..

[blackberry1]

Originally Posted by nukem

BUT for users in Protected Groups which is fully documented in this Microsoft Article:support.microsoft.com/kb/907434/ - easily proved by enabling SEND AS on an Admin and then in an hour watch it get removed.

KB 912918 talks about modifying the AdminSDHolder Container in the AD to modify the Protected Groups.(Not recommended) MS has said repeatedly and if you have attended any of its Security Webcasts... "No Administrative/Protected group member should have a mailbox")

Hence if your account is a member of any of the Protected Groups,the BES Admin account will not retiain the Send As permission on your user object,even if the permissions are applied explicitly on your userobject.

I won't blame MS either for the problem,since in reality -Send As should be an attribute of a User Object not a Mailbox Object.So that a rogue Admin cannot send emails As a person XYZ.

Read :Send on Behaf of v/s Send As ( Send As allow real sender spoofing )

So mail is received by a mailbox and sent by a person,that is the functional difference MS has attempted to apply with this HF.

RIM will have to update their install guides and Service Account setup ,in the coming versions with instructions to address this design changes in Windows/Exchange permissions/security model.

This issue also affects Visto and Goodlink wireless messaging servers