[Archer]

G'day everyone!

I'm pretty new to all of this Blackberry stuff, I've just inherited a blackberry system at the job I've just taken up. One of the first things they hit me with is the following problem:

System Configuration:

1 Blackberry Enterprise Server 4.0
2 Microsoft Exchange 2003 SP1 Servers (One local and one remote linked by Permanent VPN connection).
All blackberry handhelds are running the latest code.

All of the users on the local Exchange Server are completely happy, everything works.
It seems that all of the users on the Remote Exchange server have the same problem. They can't create an appointment in their Blackberry calendars and have that appointment wirelessly sync to their exchange server. However, If they create an appointment in Outlook 2003 it Sync's to the Blackberry without a problem. All of the other features of the Blackberry system seem to work perfectly.

I've checked the following between the two Exchange Servers.
CDO.dll and Mapi32.dll are identical and in the same locations.
The permissions on the Mail Store for the BES users are now identical. I originally did find some differences in these permissions and rectified them, however that did not solve the problem. (Missing Send As, Receive As & Write Properties permissions).

Does anyone have any suggestions on what I should be looking for now?

Any help would be greatly appreciated.

Archer

[ender]

Hi!

maybe you have reeaded it...
http://www.blackberryforums.com/showthread.php?t=6190

it could keep you, althought i have seen that the "send as" and "receive as" permissions are okay...

good luck,
ender

[jibi]

did you just setup Write permissions or did you setup the BES account as an Exchange Read-Only Administrator role?

[Archer]

Hi Ender,
Yes I have read that thread, It's the reason why I went looking at the permissionsn and found the permission problems on the remote server. However when I changed the permissions in Exchange 2003 System manager so that the remote server's permissions matched the local servers permission, it didn't fix the problem.

So I'm still open to suggestions.

[Archer]

Hi Jibi,
I'm sorry, I don't quite follow what you mean. I didn't setup this Blackberry system, I've just taken over the management.

Could you be a little more specific as to what I should be looking for to be able to answer your question?

What I have done so far is to check the permissions for the three BES accounts that are setup in the Exchange mail store. I added permissions to the remote server (which isn't working correctly) so that they matched the permissions assigned to the local server (which is working). The permissions I added were:

"Write Properties" on the BES Management Account
"Send As" & "Receive As" on the BES account (I think that equates to the BES Service Account)

Thanks

Archer

[jibi]

okay, first things first. go download the installation PDF files that are on www.blackberry.com (under support then product documentation) and walk through the instructions on how to setup the BES service account permissions on the Exchange servers.

[Archer]

Thanks Jibi,
I ran through the procedure and as best as I can tell all of those things have been done. The only exception is that neither of the two servers have the "Administer Information Store" permission set on the Service account.

I have now added this permission, and asked that they guys test it, however I don't beleive that this is the problem as one of the servers was working fine without this permission anyway.

I'll post again with the results of the test.

Archer

[Archer]

Hi Jibi,
The test was unsuccessful, and yet another problem has surfaced.

The users have now reported that if they are sent a meeting invitation, it is received in outlook but not on the blackberry device. Once the meeting has been accepted the appointment appears in both outlook and the blackberry.

Once again this new problem is only affecting users of the remote server.

So I'm hoping that these two problems are related and fixing one will fix the other.

Archer

[Masud]

Hi Archer,

What is the log saying? Eacht time something does not go well, the BES should record it in the log. You can find it in the BES installation directory under file 'SERVERNAME_MAGT_date.txt'. Also check the server's event viewer. The errors listed there might give you a clue to what is happening.

Cheers,

Masud

[Dahood]

All this is a recognised problem with BES 4.0. A call is currently logged with RIM. Please note that this issue is not specific to Exchange 2003. It happens on all flavours of Exchange.

[duras]

Originally Posted by Dahood

All this is a recognised problem with BES 4.0. A call is currently logged with RIM. Please note that this issue is not specific to Exchange 2003. It happens on all flavours of Exchange.

I have a very new BES 4.0/Exchange2003/Win2003 Server and have this issue.

Is it a waste of time installing SP1 on Win2003 or SP1/hotfixes from RIM to try to fix this issue? Are the RIM patches straight forward to install? Do RIM provide any phone support on BES or is it all pay as you go?

Thanks,

[jibi]

Originally Posted by Dahood

All this is a recognised problem with BES 4.0. A call is currently logged with RIM. Please note that this issue is not specific to Exchange 2003. It happens on all flavours of Exchange.

Is this a Known Issue or is this just an issue you are experiencing personally? I would hesistate in stating that it is a recongized problem, aside from maybe in some certain cases.

[Dahood]

It's a known issue dude!

[Archer]

Originally Posted by Masud

Hi Archer,

What is the log saying? Eacht time something does not go well, the BES should record it in the log. You can find it in the BES installation directory under file 'SERVERNAME_MAGT_date.txt'. Also check the server's event viewer. The errors listed there might give you a clue to what is happening.

Cheers,

Masud

Masud,
I found the following in the BES log:

[40000] (04/18 15:00:28):{0x1004} Starting new CDO helper 02974fc8
[40574] (04/18 15:00:28):{0xFA4} CDO helper 02974fc8 started
[30001] (04/18 15:00:31):{0xFA4} CDOCalendar::Initialize - Code = 80040705, WCode = 0505, Code meaning = IDispatch error #1285,
[30002] (04/18 15:00:31):{0xFA4} Server = melb-exch, Mailbox = /o=First Organization/ou=First Administrative Group/cn=Recipients/cn=tom Description = You do not have permission to log on. [Microsoft Exchange Server Information Store - [MAPI_E_FAILONEPROVIDER(8004011D)]].
[30180] (04/18 15:00:31):{0xFA4} {tom} CDOCalendar::Initialize - Error in call m_spCalendarFolder = m_spCDOSession->GetDefaultFolder.
[40000] (04/18 15:00:31):{0xFA4} CDO initializing failure in CDO helper 02974fc8 (1)

And this in the Event Viewer's Application Log:

Source: BlackBerry Messaging Agent ADEL-BLACKBERRY1 Agent 1
Type: Warning 		Event ID: 20216
{<<User's Email Address>>} Synchronize() failed: ERR_FAIL, Tag=14947

Particularly the first log entry there indicates a permissions problem, so I went over the permissions for the administration account on the server yet again, following the documentation found here:

http://www.blackberry.com/knowledgec...25232&vernum=7

(Which is pretty much identical to the install guide anyway).
It's still not working. I don't need to do something stupid like reboot the server to get the permissions to propergate do I? I've already waited the best part of the day and that didn't make any difference.

The only other difference I can see at the moment is that the server that is working correctly is a Win2003 Enterprise Edition and the one that isn't is a Win2003 Standard Edition. I wouldn't have thought that would be a problem though.

Any ideas?

Thanks

Archer

[Masud]

Hi Archer,

What user are you using for the BES Account? Is the user a member of a security group?

Cheers,

Masud

[Archer]

Hi Masud,
The BES accounts (BES, BESadmin & BESmngmt) are each their own user in Active Directory. They are only members of the Domain Users group, With the other permissions required set where needed. As far as I can tell, the Domain users group is not explicitly denied any permissions, so this setup should be ok.

Again the most interesting thing is that this all works on one of the two servers, but not the other. Being in a domain environment, both of the exchange servers are using the same users, with the same permissions assigned in the Exchange system manager. This is why I don't understand what is going on.

I'm almost at the point of granting all permissions to the BES users to see if that will fix the problem, then work backwards to get back to only the permissions that are required. This is a very long process I would rather avoid.

Thanks

Archer

[Stronghold]

Archer.. it is a permissions problem.
I had the same problem. Rim also said I had version problems and alot of other crap. They did not even ask me to check the logs. I got all of my answers here.
I will say when I changed the permissions for my user I had to restart before it would work. I even tried stopping and starting services with no luck, but the restart fixed it.

even tho you have checked the permissions you are over looking something. also you only need the one user not 3 so make sure the main user is set up and it will work fine
Sam

[Masud]

Hi Archer,

I agree with Stronghold but, the 'You do not have permission to log on' in the log also points in this direction.

The situation you describe sounds quite frustrating...especially with the other server functioning just fine.

The only advice I have left: try to make a one BES-user setup and if you change any permissions, make sure you restart to be 100% sure the permissions kicked in. Besides that...I don't see any solution than to work backwards as you have described here, which is going to cost you a lot of time... :(

Cheers,

Masud

[Archer]

Hi Guys,
Do you want the good news or the bad...?

Well, actually, since there is no good news, here's the Bad!

I've now got the BES accounts configured to have "Full Control" in the Exchange System Manager, thinking that would have to solve the permissions problem and I could then work backwards to get the appropriate permissions. Wrong. The Calendar synchronisation still does not work with "Full Control" permissions!!!

Are there any other permissions required outside of the Exchange System Manager that I might have missed?

The only other difference that I can see now, (one that I've just noticed), is that the Exchange server that is working has a mailbox setup for the BES account, where as the Exchange server the isn't working does not have this mailbox setup on it. Does BES require a Mailbox on each server that it needs access to? I couldn't find any direct reference to this in the install guide.

Archer

[gerardhennemann]

Using the bes-admin account, are you able to access the addressbook of the Exchange server on the VPN-network? Everytime when there is for example a change in a calendar item, the BES creates a temp mapi profile in orde to get access to the mailbox of the user. This is done by resolving this mailbox via the GAL. So the users have to be available there.