granting calendar access to other users 3

[PhilEvelyn]

I have setup a system where the entire company has access to each others calendars by creating a group called "Staff" and giving permissions to "Staff" of Publishing Editor and giving viewing permission to the mailbox. Everything works fine except for one member of staff. Everyone can see her calendar but she cannot see any other calendar.

I have checked that she is in the Staff group, I even granted her permissions in her own right rather than through the Staff group. Still no joy! Does anyone have any idea what may be the problem. I have looked to see if other permissions somewhere else are blocking her but nothing obvious has shouted at me.

HELP!!!!


Phi

 

[zoeythecat]

Phi,

Can you explain how you are giving viewing permission to the mailbox? Are you saying that each user in the company is a member of a group called "Staff"? So UserA, UserB, UserC (etc) are part of staff? Or is this a single Calendar (like a public folder calendar) that everyone accesses?

Can you give some more info on how everyone's calendar is being accessed.



Zoey

 

[PhilEvelyn]

Hi Zoey,

It is each individual users calendar that I am giving permissions to, not a public folder, and as you say, the group "staff" consists of User1, User2, etc.

The mailbox permission has been given by just giving the staff group Folder Visible permission.


Phil

 

[zoeythecat]

Phi,

Ok....Well I know you need to add permissions in 2 places in each outlook profile. (1) Outlook today properties (2) Calendar properties

How many users are we talking about? How did you set everyone up to view each others calendar? Did you have to go into each outlook profile and go to outlook today properties and calendar properties to add the permissions.



Zoey

 

[PhilEvelyn]

Hi Zoey,

This is what has me foxed. That is exactly what I did for every single member of staff (20), into the mailbox to give folder visible permission and then into the calendar to give editor permissions. It has worked for every single member of staff except one, and I can see no differences in any of the permissions that may be conflicting with her membership of the staff group. I have even checked the E2K permissions in system Manager to see if this one user is different in some way. Nothing!

Phil

 

[zoeythecat]

Phi,

Try opening each users outlook and add the person (the user whom all users cannot see the calendar). So from each user (lets call UserA the one everyone cannot see) do this:

(1) Open up the outlook profile
(2) Open up the properties of "Outlook Today"
and add UserA to the permissions
(3) Open up properties of Calendar and add UserA
to the permissions.


Start by doing that to see if this works.

Zoey

 

[PhilEvelyn]

I have tried that already Zoey, works for every user except the one I am having the problem with.

Phil

 

[zoeythecat]

Can I ask how you are viewing each others calendar? Are you doing a File==>Open==>other users folder<? Or are you adding the mailbox to each users profile via Tools==>Services==>Microsoft Exchange Server Properties==>Add Mailbox

Just to add I would try removing UserA from Staff, Removing UserA from each users Outlook Today + Calendar Properties, Adding UserA back (by itself) to each users Outlook Today + Calendar

 

[PhilEvelyn]

The users calendars should appear in the folder list, so that a shortcut can be added to the Outlook Bar. That is certainly what happened in every other case.

I have tried, I think, just about every variation on the theme from deleting UserA from staff, adding her back in, deleting her from staff and then adding her permissions individually into other users profile, leaving her in staff and adding the permissions individually, etc.... To getting her to restart her pc or logoff and log on after each change. Still no improvement.

The only thing I have noted is that every other user has access to her calendar when she is a member of the staff group, but she cannot see any (except her own of cause). This is one of the reasons that I think the problem lies with her profile either in AD or in E2K itself.... but I cannot see any diferences in settings. This is what is driving me barmy!!!!

 

[zoeythecat]

Phil,

Are all users using the same outlook version? Could be that you need to update UserA or make sure they are on the same service pack level.

Zoey

 

[xmsre]

What are the contents of MSExchMasterAccountSID and MSExchSecurityDescriptor attributes for the the user in question?

 

[PhilEvelyn]

Hi Zoey, nope, all pc's are brand new and all have identical programs and service pack installs. It cannot be anything to do with the machine as I can logon as another user on this pc and the calendaring system works fine.


Phil

 

[zoeythecat]

Phil,

Sorry my suggestions did not work. I have never encountered this type of problem. It appears you have tried everything I know to try. Perhaps there could be some corruption regarding UserA and in that case you may need to purge/recreate user and mailbox but perhaps other people from this forum can help before you do that. Xmsre offered a suggestion, perhaps you can communicate suggestions with him (after following his current suggestion). Sometimes when these type of time consuming tasks take place when everything you try does not work its best to give Microsoft a call (hopefully they won't charge you) if no one here can help you resolve.

Regards,
Zoey

 

[PhilEvelyn]

xmsre

Err, you have gone way past my E2K abilities. How do I find the MSExchMasterAccountSID and SecurityDescriptor?

 

[PhilEvelyn]

Thanks for trying Zoey

 

[flaurijssens]

In general, you can find attributes through ADSI Edit (from the reskit tools that are included on the w2k installation media).

It's not straightforard though, if anyone has a better tool to view these particular attributes, I'd be happy to hear.

BTW: if you just need to reset the attributes, ADModify (a MS tool that can be downloaded from

http://www.microsoft.com)

is a somewhat dangerous, but useful tool.

 

[DG659]

Hmmm

sounds like No is always No and yes is only sometimes Yes

look at the offending user and remove them from every group they are in and only add them to the Staff group.

if a users is a member of a group who has perrmission AND a group who don`t the NO group will always prevent the user.

 

[PhilEvelyn]

Damn, I was hoping that would be the right answer!

I have been through the groups they are a member of and the rights are no different from any other member of staff who can access the calendars.

Just to double check I removed them from ALL groups, re-added them to Staff and still no joy!

 

[flaurijssens]

I don't think this problem is about group membership. Perhaps you need to give ADModify a chance to reset the mentioned attributes for this particular user.

ftp://ftp.microsoft.com/pss/tools/exchange%20support%20tools/ADModify/admodify_1.5.zip

 

[xmsre]

Once upon a time, there was an issue with certain MS utilities used in migrations that would cause the contents of MSExchMasterAccountSID to become out of synch with The corresponding ACE in MSExchSecurityDescriptor. This would cause unexplained failure of public folder access, delegates, and calender access.

To make matters worse, if you couldn't correct the issue through ESM no matter how hard you tried. Searching high and low both internally at M$ and externally, no one could be found that was able to explain what exactly the permissions on a mailbox are supposed to be.

Through trial and error, a solution was found. Someone eventually wrote 309222 and, better yet, Nomas.