Help with troubleshooting/fixing a suspect persmissions issue with GAL

Hi

I'm currently getting a problem with a user account in Exchange 2007 being unable to resolve the exchange server/mailbox in a MAPI profile. And am sure it's a persmissions issue.

For info, we are running BES 4.1.5 and Exhcange 2007 SP1. And it's the besadmin service account I'm having trouble with.

The only way I can get it to resolve is by making the account a member of domain admins group (but this causes it's own issues in BES). When I remove it from domain admins group the following message appears when I click the 'check name' button. "The name could not be resolved. The name could not be matched to a name in the address list".

I can confirm a dcdiag reports no problems, I've tried rebooting both DC's, both GC's look to be functioning fine as well. RIM have confirmed the permissions are correctly set for everything else (except this domain admin group membership).

I'm presuming (maybe wrong) that as a non-domain admin it's unable to perform some sort of lookup? but as to what that is a how to troubleshoot I'm a bit stumped as to where to start...

Thanks

J