BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

joe — Sat, 14 Jan 2006 19:34:17 GMT

Thanks for the info Paul.

Hasn't this been something that has switched back and forth a couple of times with E2K as well? I seem to recall running into issues depending on what QFE levels of Exchange was running.

Overall this is an area, permissions, that has been one of much issue for nearly everyone trying to work out minimum permissions properly since Exchange related permissions are stored in at least four places. The config container perms which eventually gets mapped/copied to the msExchMailboxSecurityDescriptor, the domain NC permissions (such as Send As), the publicDelegates attribute, and the actual MAPI folder "attributes" aka permissions in the mailbox folders themselves.

I realize that some of it is for backwards compatability but I would rather see interfaces that thunk the old mechanisms up to new mechanisms and publish some new consistent mechanisms that people can start using. Permissioning shouldn't be this difficult and it is why so many people screw it up or don't have any permissions in place really at all (another form of screwing it up but they don't know until someone does something bad).

While I am at it, the whole trying to segregate and delegate Exchange perms when you have separation of duties is a train wreck as well. I spent weeks in a lab with some good Enterprise level MCS folks trying to work out good minimal perms for Exchange admins that followed good AD best practices for ACLs as well and was unsuccessful at hitting our goals. In the end, we had to give up and allow the Exchange admins more rights than they should have instead of populate AD with a ton of deny ACEs which would have just bloated the 2K DIT and slowed things down due to all the ACEs. Of course that does nothing to help the extra permissions that Exchange admins can also grant themselves by assuming localsystem on an Exchange server and going off doing things (say like adding themselves to the same groups the Exchange servers are in). If I knew then what I know now, there would have been no way Exchange would have been in the main production AD, it would have been in a single domain resource forest.

Anyway, sorry to rant, I didn't intend to. I would like to see this stuff addressed in E12. I don't expect much of a change but I would really hope to see it.

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

NiclasH — Mon, 16 Jan 2006 11:34:06 GMT

Isn't this old stuff? http://support.microsoft.com/kb/327174/

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

Wayne — Mon, 16 Jan 2006 16:23:54 GMT

Nicely timed :o) I am running a blackberry install this week, so I'll keep an eye out for this issue.

Thanks

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

Philip Colmer — Tue, 17 Jan 2006 17:28:19 GMT

The KB article (and therefore the bit copied into this blog) is slightly confusing/misleading with respect to the dsacls command.

The KB article makes reference to a "domain.example.com" placeholder, which doesn't exist.

The article also has "AdminSDHolder" in italics (although this isn't reproduced in this blog) which suggests that it needs changing but my intial examination of the process is that it should be left alone, as should the "cn=system" bit. There are actually only two things that need changing - the "dc=domain,dc=example,dc=com" and "domain\ApplicationAdminAcct".

A valuable blog entry though and good to get some heads up on this.

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

Dan Sheehan — Tue, 17 Jan 2006 17:28:19 GMT

How about this particular issue with third party (Blackberry and Goodlink) wireless calendars?
http://support.microsoft.com/?id=899919

It seems to me that deleting a calendar item and recreating it will only cause confusion for any third party applications.
The cut over from using Entry IDs to Global Object IDs seems to be dependant on switching from Outlook 2003 SP1 to Outlook 2003 SP2. This feat is darn near impossible to coordinate in large organizations, and third party vendors will have a terrible time trying to figure out which field to key on.
In other words Microsoft is pretty much forcing third party vendors to code in for both situations simultaneously, otherwise organizations have to hold off deploying Exchange 2003 SP2 to try an deflect this problem.
This doesn't make sense to me...

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

GeneK — Tue, 17 Jan 2006 20:41:09 GMT

So what you are saying is that having a Send As permission on the Store level does not give an account ability to send as mailboxes in that Store?
If that is the case, then what is the point of having Send As permission at the Store level?

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

joe — Wed, 18 Jan 2006 01:35:20 GMT

GeneK:

The SendAs/ReceiveAs that you apply to the config container (store level) are used to indicate Full Mailbox control (which is what you will see if you look at the Exchange Security Tab of a mailbox, it will be the inherited Full MBX) over the store and all mailboxes in it.

What about Unity

Teo Heras — Wed, 18 Jan 2006 19:19:34 GMT

I guess this could also affect the service account that Cisco's Unity software requires?

Teo

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

Roman Rozinov — Wed, 18 Jan 2006 22:08:14 GMT

I'd like to get an answer to Joe's question. Our service account has an explicit Send As perm at the store level and wanted to know whether that is enough to ensure service account's ability send as once the hotfix will be applied. Anyone seen articles with explanations on store level perms?

re: BlackBerry and GoodLink users may be unable to send messages after applying latest Exchange 2003 store hotfixes

MPW — Thu, 09 Feb 2006 20:30:43 GMT

Hmm...

http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/8149/8064/Support_-_User_cannot_send_messages_because_the_Send_As_permission_has_been_revoked.html?nodeid=1166052&vernum=6">http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/8149/8064/Support_-_User_cannot_send_messages_because_the_Send_As_permission_has_been_revoked.html?nodeid=1166052&vernum=6

Why not http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/8149/8064/Support_-_User_cannot_send_messages_because_the_Send_As_permission_has_been_revoked.html?nodeid=1166052 ? This will take you to the latest version - whatever it is..

Blackberry and Goodlink may be affected by Exchange store patch

My Notes to Myself and Others... — Sat, 18 Feb 2006 17:53:18 GMT

I happened to stumble upon this one by chance-and I do admit I am really happy since I am very familiar...

Blackberry for Exchange

Welcome to Flaphead.com @ Home — Fri, 24 Feb 2006 15:10:33 GMT

Following the change to the way the Information Store working with Exchange 2003 (http://blogs.technet.com/exchange/archive/2006/01/13/417440.aspx)...