[RemyJ]

I'm serious.

After hours on the phone, neither RIM nor Microsoft have been able to help us.

To recap, we get the following error when sending meeting invites from exchange to the HH. The actual calendar entry syncs just fine. It's just the meeting invite that fails. All other functions are normal.

[30001] (04/07 13:46:57):{0x1D50} CDOCalendar::Initialize - Code = 80040705, WCode = 0505, Code meaning = IDispatch error #1285,
[30002] (04/07 13:46:57):{0x1D50} Server = ms1, Mailbox = /o=ccccc, Inc./ou=Denver/cn=Recipients/cn=remyj Description = You do not have permission to log on. [Microsoft Exchange Server Information Store - [MAPI_E_FAILONEPROVIDER(8004011D)]]
[30180] (04/07 13:46:57):{0x1D50} {remyj} CDOCalendar::Initialize - Error in call m_spCalendarFolder = m_spCDOSession->GetDefaultFolder
[40000] (04/07 13:46:57):{0x1D50} CDO initializing failure in CDO helper 00cf8f80 (5)

Current Environment:
WS2003 SP1
EXCH 2003 SP1
BES 4.1.0 w/ MSDE

We've made sure that BESAdmin...
Is View Only Exchange Admin in the ESM Admin Group.
Has Send As, Recieve As, and Administer Info Store on the Exch server and that those rights propogated down to the stores.
Is only a Domain User (NOT a Domain Admin or a member of any other group).
Has Send As and Receive As rights on the AD user objects.
Is a local administrator, has logon as a service rights, and log on locally rights.

We'de made sure that BESAdmin is the service account for all services and that the MAPI profile is BESAdmin.

We've run gpresult and looked a the AD Effective Permissions.

We're tried rebuilding the BES Server from a freshly formatted hard drive and creating a BESAdmin2 account from scratch.

We've gone from BES 4.0.3 to 4.0.4 to 4.1.0. Upgrades and fresh installs.

We've gone through all of the Microsoft and RIM KB articles that have anything to do with CDO or MAPI.

Both the BES and Exchange servers are at the same level including mapi32.dll and cdo.dll.

We're about to scrap the trial if we can't get this figured out.

Any other suggestions?

[merlin]

Hi.

Just a thought, have you looked at this users mailbox to make sure that their Calendar folder is actually called Calendar?

We have a load of errors when we first installed BES and it was due to folder names in their mailbox.

When we migrated range from 5.5 to 2000, for some reason the migration software created their default mailbox folders with a 1 after them...

ie Inbox1, Sent Items1, Calendar1, Tasks1 etc and it created empty folders, set as mail folders, called the proper names, so looking in a mailbox you saw:

Inbox
Inbox1
Tasks
Tasks1
Calendar
Calendar1

When the user used outlook, it used the "Tasks1" folder for tasks, but the BES server was using the "Tasks" folder.

We had to export the users mailbox, delte it, recreate it and reinport the data. Once done it worked fine....

Richard

[Gareth.Hooper]

Wirelessly posted (BlackBerry8700/4.1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/120)

Just to paint the picture clear is the bes and exch on seperate servers, good practice says it should. If it is is the bes svr just had the relevant dll's copied over from exch svr and registered or have you actually run the exch sp1 on the bes svr. Reason I ask is that I had issues at a site where the cdo was the same and registed on both servers but somethings did not work correctly until we ran the sp1 and overlayed the system manager install with that. In our case though it was win2003 and exch 2000 sp4. If you have but I am guessing you have, run the exch sp1 on the bes svr aswell.

[RemyJ]

Folder names are correct.

BES and Exchange servers are separate and the BES server had Exchange 2003 Server Manager installed then Exchange 2003 SP1 applied.

Thanks though.

[BB_God]

MAPI_E_FAILONEPROVIDER is always permissions based. Try the following:

Log onto a workstation,with Outlok installed, as your BESAdmin account
Create a MAPI profile to you BESAdmin account
Open Outlook using the profile created above
Go File->Open->Other Person's Folder
And try to open a users Inbox, Calendar
If that works try to create a meeting request.
When it fails it is a permissions problem.

I have seen it where you need to remove and reapply permissions at various the Server level.

[RemyJ]

Good suggestion but no dice.

At first, BESAdmin couldn't even expand the root folder of my personal account but I restarted Outlook in my profile and gave BESAdmin Publishing Editor priviliges to all my folders. Now from Outlook, BESAdmin can send and receive mail and calendar appointments on my behalf but I still get the same error from BES even after restarting the BES machine.

Should I have been able to manipulate my personal account from Outlook logged on as BESAdmin? Without my granting specific rights from the Outlook folder properties pages? If so, then maybe at least I've got something I can point my SAs to that doesn't involve the BES.

[BB_God]

You should not need to grant any permissions to your mailbox if the Exchange permissions are set correctly for BESAdmin.

You may want to create a new service account.

[udontknowjack]

you menioned making sure the rights progegated down to the stores. I have always had to set the perms for BESAdmin on each store seperately, giving it send as and recieve as. BB_God is right, it is a pemissions issue. Especially since you couldn't get on your account with the BESadmin ID. We use BESAdmin all the time to manage other mail accounts because it has the rights we need. I use it with mailmerge and everything because I know it will have the rights.

[RemyJ]

I agree with you both. It's a permissions issue. I just wish I knew which one is preventing BESAdmin and its twin brother BESAdmin2 from processing calendar invites while allowing them to do everything else.

We'll try setting explicit permissions on Monday.

[Kablooey]

Make sure that the service account is not in any groups with specific "deny" rights. Without realizing, some have placed their account into an AD folder for housekeeping not realizing that there was a nested security group (like domain admins) that had explicid "deny" rights on the information store.

[dodgydane]

Have you tried to grant the BES admin account full Exchange rights?
I had problems adding users once to a BES ( I know it's not the same thing)and the only way around it was to give the BES admin full rights.

[jibi]

Just curious - open ESM on the BES and see if you can view the Administrative Group(s).

[RemyJ]

BESAdmin is not a member of any group other than "Domain Users". Looking at the advanced permissions shows no "deny"s for the things it needs.

BESAdmin does NOT have full Exchange rights. We can try that but if that's what it takes it's not going to fly in production.

We've always been able to use BESAdmin on the BES to view the Admin Groups and browse right down to the mailboxes.

I'm wondering if I need to set up a play domain and exchange server from scratch and see if we can get it to work. It'll probably work fine though.

[RIM - BBTECH]

For those of you performing the "Outlook Test" I would advise to perform it like this.

Log on to a PC with Outlook.
Create a profile for the user.
Perform your tests.

If you perform it as BB_god stated your actually not simulating what the BES is doing therefore it is not a valid test. But you should not need to make any changes therefore we are left with a permissions issue. Is this only effecting 1 user or multiple? If it is only 1 user I would try a new mailbox for that user.

[RemyJ]

Originally Posted by RIM - BBTECH

For those of you performing the "Outlook Test" I would advise to perform it like this.

Log on to a PC with Outlook.
Create a profile for the user.
Perform your tests.

If you perform it as BB_god stated your actually not simulating what the BES is doing therefore it is not a valid test. But you should not need to make any changes therefore we are left with a permissions issue. Is this only effecting 1 user or multiple? If it is only 1 user I would try a new mailbox for that user.

OK, we're making progress. I logged on to my own machine with BESAdmin. From ControlPanel/Mail I created a new profile for one of the other test users (all users have the problem). When I opened Outlook, I was prompted for a userid and password. I used BESAdmin but it wouldn't work. I'm guessing the Exchange server logged the same event it does when the mail agent fails.

So what permission on what object is it that causes this behavior?

[dodgydane]

I would try to give the BESadmin full Exchange rights, just to see if that works and thereby hopefully be able to determine that it is definitely a permissions issue.

you're right; setting up a test network would probably work.

[alm1]

Just to add something in here. If i go to ESM, then administrative groups i have given BESAdmin view only administration in the delegate control wizard. When i then go an individual server in the servers folder domain\BESAdmin has full control set there. I dont know whether i have set mine up wrong but it works for us.

I can log on to a machine as besadmin and view mail but cannot send on behalf of the user.

Could be worth checking what your level is on an exchange server level rather than on an OU level.

Also if your support cant/wont come and help you on this or cant get help from RIM to get it sorted i would consider using another vendor if possible. If you cant get good support from them before they sell you a product what will it be like after the fact...

[alm1]

actually i would scrap my old comment. for some reason during the migration from 5.5 i think our exchange admin added full control at a server level rather than at doain

[RemyJ]

OK, udontknowjack gets the reward.

The problem was inheritance. Once we explicitly granted BESAdmin the 3 required rights on the mailstores themselves, it worked. Our SAs are adamant that it shouldn't make a difference (which is why they were reluctant to try it) but it certainly does. There's no "view effective permissions" in Exchange so there's no way to tell exactly what was happening.

I was serious about the reward so if you want to PM me a paypal address, I'll send you the money. Alternatively I can donate it to some worthy cause like "Blackberrys for Underpriviliged Children" or something.

Thanks to all who made suggestions.