Can't change mailbox rights 1

[TimEdwards]

Hi,

I'm running Exchange 2003 on Win Server Standard 2003. I'm trying to edit mailbox rights on several accounts via Active Directory Users and Computers but whenever I attempt to apply any changes made I get the following message:

The user granted 'associated external account right' must also be granted 'full mailbox access right.

ID No: c1034ad4

Microsoft Active Directory - Exchange Extension


I'm not trying to change the Associate External Account right is not being selected. In fact this message is shown when attempting to make any rights changes on the account. I suspect the fact that the accounts affected have all been migrated from an Exchange 5.5 server may be a factor but can't find any mention on the MS knowledge base.

Any help appreciated.

Tim

 

[xmsre]

The MSExchMailboxSecurityDescriptor attribute contains an ACL with a list of ACE entries for users that have permissions to the mailbox. When you check "Associated External Account" for one of those ACE entries, the ACE is copied to the MSExchMasterAccountSID attribute. This should never happen for an enabled user. A disabled user should have "SELF" added to MSExchMailboxSecurityDescriptor and "Associated External Account" should be checked for "SELF" meaning that the ACE for "SELF" should be copied to MSExchMasterAccountSID. "SELF" is a well known security identifier that is sort of a programmatic shortcut. Utilites like the Active Directory Connector will add "SELF" to save doing LDAP lookups for each account. The actual account can be used instead of "SELF", and many times is; however, permissions should always be the same if both are on the ACL and permissions should never be split between the two.

Sometimes this process breaks down and you see invalid values in the two attributes. At one time, certain tools would create invalid values. An example would be an exabled user with "Associated External Account" set, or an ACE in MSExchMasterAccountSID that does not exist in the ACL in MSExchMailboxSecurityDescripor. If this happens, delegate access and certain types of public folder access break. In the former case, try:

http://support.microsoft.com/default.aspx?scid=kb;en-us;309222

http://support.microsoft.com/default.aspx?scid=kb;en-us;316047

In the latter case, you'd have to call MS and ask for an internal tool to fix it.

XMSRE
MOSMWNMTK