Send-As permision won't remove

[fredmaine]

Using Microsoft Exchange 2010 on a Win2008R2 server. In the Exchange Management Shell:

Per MS website:

http://technet.microsoft.com/en-us/library/bb124403.aspx

- See example 1

I set up "Send As" permissions as described above and it works great.

However, try to revoke it using this:

http://technet.microsoft.com/en-us/library/aa996048.aspx

- See example 1

It appears to work - that is, no errors. In fact if you do the remove a second time you get an error - which would be correct, since the permission is already removed.

However, the user can still "Send As"

Am I revoking this incorrectly?

Fred

 

[fredmaine]

Well now I can't get "Send As" to work at all now, either. Tried setting it up on a second user.

This must be a major clue:

After setting the sending user up per above, I can go into the sending user's AD object, security tab, advanced...look down the list - there is a user object for the other user on the list, and the permission "send as" is checked.

So it seems that the applet set it up ok. BUT...

If I go to the effective permissions tab and put in the sending user, the "Send As" box is not checked.

So, some other permission is more restrictive and it's preventing the "Send As" from working even though the applet did set it up.

I've no idea how to find out what it could be.

Fred

 

[TechyMcSe2k]

What happens when you use the EMC GUI Console to perform these actions?

http://technet.microsoft.com/en-us/library/bb676368.aspx#UseEMC

 

[fredmaine]

Same; doesn't seem to matter. In fact, I tried using EMC first and went to shell when that didn't work.

Fred

 

[TechyMcSe2k]

I would say try a reboot of Exchange server (generic answer i know). If it still happens, please post back. I'll continue research.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[fredmaine]

Yeah, server has been rebooted a couple of times since that event. No change. That effective permissions thing is bugging me. A policy of some sort, not allowing the permissions on the AD user object to be set correctly? Dunno.
Fred

 

[TechyMcSe2k]

Is the affected user a Domain/Enterprise/Schema Admin?

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[fredmaine]

I had the same issue with normal users, as well as a test with a domain admin. I'd like to go back and verify the results though, I'll do that and then post back. May be a week or more.

 

[TechyMcSe2k]

There is a SP1 for Exchange 2010 as well.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=50b32685-4356-49cc-8b37-d9c9d4ea3f5b

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[TechyMcSe2k]

And two Roll Up Packages:
Rollup 1:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=A371FA96-E85B-4A4F-8242-15D56595D0EC

Rollup 2:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0059546F-F43D-4C7E-8367-81C6D5642BF3

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[fredmaine]

Yeah those updates are all in (as well as update rollup 3v3).

 

[TechyMcSe2k]

Well crap I'll keep poking around.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[TechyMcSe2k]

OK, this script works.

http://www.ispgeeks.com/wild/modules.php?name=Forums&file=viewtopic&p=20617

The line is a little different.
pwdLastSet = objMember.PasswordLastChanged

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.