[Xaneth]

First my configuration:

Exchange 2003 in a FE/BE configuration. BE is clustered between two nodes.
BES 3.6.2.14

I know, 3.6... I have administered 4.1 servers in the past, and know the major differences. My company isn't about to throw down another $1000 to upgrade, since we only have 3 BB users.

So I referenced an old thread out here:

http://www.blackberryforums.com/bes-...l-problem.html

The very last post helped a lot. I'm specifically having problems with my account. When I add zBESAdmin to my account directly, it sticks for a couple minutes, and when I go back in later, the permission disappears. Under Advanced, I went in and made sure to inherit permissions and it seems to be sticking for now.

I also followed the M$ article at:

Users cannot send e-mail messages from a mobile device or from a shared mailbox in Exchange 2000 Server and in Exchange Server 2003

I used the GUI to perform all the security settings at the domain level "User objects", Send As. I have not yet tried the scripts listed in the article.

Here's what's going on, though. I have a clustered back end, and I'm able to send email when active on node2, but when active on node1, I'm having problems. Versions, service pack levels, everything is the same between the nodes. There are some updates to run, but only the most recent (about a month out of date). The send as issues I'm seeing are intermittent, but only when active on node1. I'm getting the following in my log:

[40700] (08/06 09:29:38):{0x944} {myemail@mydomain.com} Receiving packet from device, size=234, TransactionId=684551558, Tag=1145392255, content type=CMIME, cmd=0x3
[30112] (08/06 09:29:38):{0x944} {myemail@mydomain.com} Receiving message from device, RefId=326991824, Tag=1145392255, TransactionId=684551558
[40291] (08/06 09:29:38):{0x944} {myemail@mydomain.com} Refers to original message, RefId=-122844641
[40182] (08/06 09:29:38):{0x944} {myemail@mydomain.com} *** MAPI *** MAPIMailbox::RefIDtoEntryID - Found RefId=-122844641.
[20265] (08/06 09:29:38):{0x944} {myemail@mydomain.com} *** MAPI *** MAPIMailbox::Send(ppMAPIMessage) - SubmitMessage (0x80070005) failed.
[20000] (08/06 09:29:38):{0x944} {myemail@mydomain.com} Send() failed: ERR_SUBMIT_MAIL, Tag=1145392255
[40277] (08/06 09:29:38):{0x944} {myemail@mydomain.com} Sending message error to device for message 326991824
[40583] (08/06 09:29:38):{0x944} {myemail@mydomain.com} Sending message to device, Size=86, Tag=393, TransactionId=-897907703
[40279] (08/06 09:29:38):{0x944} {myemail@mydomain.com} SubmitToRelaySendQ, Tag=393
[40000] (08/06 09:29:38):{0xB94} [SRP] Send data, Tag=393

[Xaneth]

And yes, my account is part of the domain admins group. It does look like that is the crux of the problem, and I think I've dealt with the AdminSDHolder stuff in the past too... Looks like I need to run some of the scripts at the end of that M$ article. The weird thing is, the email works fine when active on node2 for some reason, though it really shouldn't.

[Xaneth]

Wow, my eyesight must be bad, didn't read through the entire M$ article. Duh. I'll work through the scripts to assign the permissions to the AdminSDHolder accounts like mine. Still concerned about node1...

[Xaneth]

Article here explains how to use dsacls to change permissions for the SendAs permissions agains AdminSDHolder bound accounts:

The xxx34;Send Asxxx34; right is removed from a user object after you configure the xxx34;Send Asxxx34; right in the Active Directory Users and Computers snap-in in Exchange Server

[knottyrope]

From the article:

We recommend that you do not use accounts that are members of protected groups for e-mail purposes. If you require the rights that are afforded to a protected group, we recommend that you have two Active Directory user accounts. These Active Directory accounts include one user account that is added to a protected group and one user account that is used for e-mail purposes and at all other times.

[Xaneth]

And that seemed to have resolved it on both cluster nodes as well. I'll give it some more time, but so far so good.

[Xaneth]

Originally Posted by knottyrope

From the article:

We recommend that you do not use accounts that are members of protected groups for e-mail purposes. If you require the rights that are afforded to a protected group, we recommend that you have two Active Directory user accounts. These Active Directory accounts include one user account that is added to a protected group and one user account that is used for e-mail purposes and at all other times.

Yep. I ran into this when I installed 4.1 in the past. I'd prefer to not have a bunch of separate accounts just to use my Blackberry, especially for ALL IT staff. How annoying.

[knottyrope]

All it takes is one email or bad website and you will have a bigger mess on your hands.

Good luck.