asked on

Outlook 2007 permissions problems

I am running Outlook 2007 (fully patched) on a Windows XP SP2 machine (fully patched) and connecting to Exchage 2003 Server (SP2 build:7638.2) running on Windows 2003 Server (SP2).

I have installed Outlook 2007 on two machines and both experienced the same symptoms.

When I open Outlook 2007 in non-cached mode, I can see my Calendar and Outlook Today, but every mail folder (including Inbox & default items) will not display and shows the error message:-

Cannot display the folder. You do not have sufficient permission to perform this operation on this subject. See the folder contact or your system administrator.

(aside: I think that messages like this should have a button that says 'I am the system administrator!')

If I put Outlook 2007 into Cached mode, then the mail folders can be viewed, however, then I get other problems.

Intermittently when I send Emails, they will be bounced with an NDR message which reads:-

Your message did not reach some or all of the intended recipients.

Subject: XXXXXXXXXXXXXXXXXX
Sent: 06/07/2007 11:53

The following recipient(s) cannot be reached:

XXXXXXXXXX on 06/07/2007 11:53
This message could not be sent. Try sending the message again later, or contact your network administrator. You do not have sufficient permission to perform this operation on this object. See the folder contact or your system administrator. Error is [0x80070005-0x80070005-0x000508].

This is intermittent though and I have not yet identified a particular pattern (though it could possibly when you are replying as opposed to creating a new mail?).

I am also finding that if I add something to calendar that a few seconds later, the item will disappear from calendar. If I make changes to an item in calendar, they will just change back.

I have tried killing and recreating the Office/Outlook profile, including removing and reinstalling several times.

I have also followed this procedure:-

http://www.activedir.org/article.aspx?aid=126

That article describes the exact same symptons, but I have done the fix as suggested and it has made no difference.

I really like the look of Office 2007 but there is no way I can even consider it till I get this sorted out.

HELP!!

Jon

bloodymalth5

Jon,

have you followed the dump in the article. Can you post a new one. there may be another issue going on.

Thanks,

Jon Scriven

ASKER

Hi bloodymalth5,

No I hadn't done a dump, but I have now!

Please see appended.

Jon

ExchDump Version: 6.5.7202.0
ExchDump Mode: Local
->Click for General Information

Local Environment

COMPUTERNAME: SERVERNAME
USERDNSDOMAIN: DOMAINNAME.LOCAL
USERNAME: administrator
LOGONSERVER: \\DOMCONTROLLERNAME
NUMBER_OF_PROCESSORS: 4
Windows version
Product Name: Microsoft Windows Server 2003
Build Number: 3790
Service Pack 2
Windows HotFixes applied
KB925398_WMP64
KB925902
KB929969
KB931836
Q147222
ServicePackUninstall
Exchange version
Major Version: 6944
Service Pack Build Number: 7638
Exchange Service Logon Accounts
Microsoft Exchange Information Store: LocalSystem
Microsoft Exchange System Attendant: LocalSystem
________________________________________
Object: CN=DOMAINNAME,CN=MICROSOFT EXCHANGE,CN=SERVICES,CN=CONFIGURATION,DC=DOMAINNAME,DC=LOCAL
________________________________________

CN=DOMAINNAME (LDAP://CN=DOMAINNAME,CN=MICROSOFT EXCHANGE,CN=SERVICES,CN=CONFIGURATION,DC=DOMAINNAME,DC=LOCAL)
Class: msExchOrganizationContainer
Schema: LDAP://schema/msExchOrganizationContainer
cn : "domainname"
legacyExchangeDN : "/o=domainname"
whenChanged : Friday, 07/06/2007 12:25:48 (GMT)
->Click for more details...

cn : "domainname"
instanceType : 4
nTSecurityDescriptor : ACL dumped seperately
objectCategory : "CN=ms-Exch-Organization-Container,CN=Schema,CN=Configuration,DC=domainname,DC=local"
objectClass : (ARRAY)
"top"
"container"
"msExchOrganizationContainer"
adminDisplayName : "{335A1087-5131-4D45-BE3E-3C6C7F76F5EC}"
distinguishedName : "CN=domainname,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domainname,DC=local"
dSCorePropagationData : (ARRAY)
legacyExchangeDN : "/o=domainname"
msExchAdminGroupsEnabled : TRUE
msExchAdmins : "S-1-5-21-2679989050-526948864-1341049274-500,10"
msExchMimeTypes : (Binary blob)
74 65 78 74 2f 68 74 6d 6c 3b 68 74 6d 00 74 65 text/html;htm.te
78 74 2f 68 74 6d 6c 3b 68 74 6d 6c 00 74 65 78 xt/html;html.tex
74 2f 70 6c 61 69 6e 3b 74 78 74 00 74 65 78 74 t/plain;txt.text
2f 63 73 73 3b 63 73 73 00 74 65 78 74 2f 69 75 /css;css.text/iu
6c 73 3b 75 6c 73 00 74 65 78 74 2f 73 63 72 69 ls;uls.text/scri
70 74 6c 65 74 3b 77 73 63 00 74 65 78 74 2f 77 ptlet;wsc.text/w
65 62 76 69 65 77 68 74 6d 6c 3b 68 74 74 00 74 ebviewhtml;htt.t
65 78 74 2f 78 2d 63 6f 6d 70 6f 6e 65 6e 74 3b ext/x-component;
68 74 63 00 74 65 78 74 2f 78 2d 76 63 61 72 64 htc.text/x-vcard
3b 76 63 66 00 74 65 78 74 2f 78 6d 6c 3b 78 6d ;vcf.text/xml;xm
6c 00 69 6d 61 67 65 2f 67 69 66 3b 67 69 66 00 l.image/gif;gif.
69 6d 61 67 65 2f 6a 70 65 67 3b 6a 70 67 00 69 image/jpeg;jpg.i
6d 61 67 65 2f 78 2d 78 62 69 74 6d 61 70 3b 78 mage/x-xbitmap;x
62 6d 00 69 6d 61 67 65 2f 62 6d 70 3b 62 6d 70 bm.image/bmp;bmp
00 69 6d 61 67 65 2f 70 6a 70 65 67 3b 6a 70 67 .image/pjpeg;jpg
00 69 6d 61 67 65 2f 70 6e 67 3b 70 6e 67 00 .image/png;png.
msExchMixedMode : TRUE
msExchRoutingEnabled : FALSE
name : "domainname"
objectGUID : {1411dba7-e13f-45b0-b4b9-879f5df372ae}
objectVersion : 6903
showInAdvancedViewOnly : TRUE
systemFlags : 1073741824
uSNChanged : 4799570
uSNCreated : 23716
whenChanged : Friday, 07/06/2007 12:25:48 (GMT)
whenCreated : Friday, 03/03/2006 13:02:27 (GMT)

->Click for Permissions on object...
ACL Inheritance: Inheritance allowed,
-DOMAINNAME\Domain Admins: (ACCESS_DENIED_OBJECT)(Child objects can inherit this access-control entry),
Send As (Extended Right)
-DOMAINNAME\Enterprise Admins: (ACCESS_DENIED_OBJECT)(Child objects can inherit this access-control entry),
Send As
-DOMAINNAME\Administrator: (ACCESS_DENIED_OBJECT)(Child objects can inherit this access-control entry),
Send As
-DOMAINNAME\Domain Admins: (ACCESS_DENIED_OBJECT)(Child objects can inherit this access-control entry),
Receive As (Extended Right)
-DOMAINNAME\Enterprise Admins: (ACCESS_DENIED_OBJECT)(Child objects can inherit this access-control entry),
Receive As
-DOMAINNAME\Administrator: (ACCESS_DENIED_OBJECT)(Child objects can inherit this access-control entry),
Receive As
-DOMAINNAME\Exchange Domain Servers: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry),
WRITE_PROP: Public Information (Extended Right)
-DOMAINNAME\Exchange Domain Servers: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry),
WRITE_PROP: Personal Information (Extended Right)
-DOMAINNAME\Exchange Domain Servers: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (ACE only affects objects of type: ms-Exch-Site-Addressing )
Read Permissions,
Write Permissions,
Take Ownership
CREATE_CHILD: ALL,
DELETE_CHILD: ALL,
List Children,
DS_SELF,
READ_PROP: ALL,
WRITE_PROP: ALL,
DELETE_TREE,
LIST_OBJECT,
CONTROL_ACCESS: ALL,
InheritedObjectType: ms-Exch-Site-Addressing
-NT AUTHORITY\ANONYMOUS LOGON: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry),
Create named properties in the information store (Extended Right)
-NT AUTHORITY\ANONYMOUS LOGON: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry),
Create public folder (Extended Right)
-Everyone: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (inherited ACEs of child objects will NOT propogate),
Create named properties in the information store
-Everyone: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (inherited ACEs of child objects will NOT propogate),
Create public folder
-NT AUTHORITY\ANONYMOUS LOGON: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (ACE only affects objects of type: ms-Exch-Public-MDB )
Read Permissions,
List Children,
READ_PROP: ALL,
LIST_OBJECT,
InheritedObjectType: ms-Exch-Public-MDB
-NT AUTHORITY\ANONYMOUS LOGON: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (ACE only affects objects of type: ms-Exch-Private-MDB )
Read Permissions,
List Children,
READ_PROP: ALL,
LIST_OBJECT,
InheritedObjectType: ms-Exch-Private-MDB
-Everyone: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (inherited ACEs of child objects will NOT propogate), (ACE only affects objects of type: ms-Exch-Public-MDB)
List Children,
READ_PROP: ALL,
LIST_OBJECT,
InheritedObjectType: ms-Exch-Public-MDB
-Everyone: (ACCESS_ALLOWED_OBJECT)(Child objects can inherit this access-control entry), (inherited ACEs of child objects will NOT propogate), (ACE only affects objects of type: ms-Exch-Private-MDB)
List Children,
READ_PROP: ALL,
LIST_OBJECT,
InheritedObjectType: ms-Exch-Private-MDB
-DOMAINNAME\Exchange Domain Servers: (ACCESS_ALLOWED)(Child objects can inherit this access-control entry),
CREATE_CHILD: ALL,
CONTROL_ACCESS: ALL,
-NT AUTHORITY\Authenticated Users: (ACCESS_ALLOWED)
READ_PROP: ALL,
LIST_OBJECT,
-DOMAINNAME\Administrator: (ACCESS_ALLOWED)(Child objects can inherit this access-control entry), (Inherited ACE),
Read Permissions,
Write Permissions,
Take Ownership
CREATE_CHILD: ALL,
DELETE_CHILD: ALL,
List Children,
DS_SELF,
READ_PROP: ALL,
WRITE_PROP: ALL,
DELETE_TREE,
LIST_OBJECT,
CONTROL_ACCESS: ALL,
-DOMAINNAME\Exchange Domain Servers: (ACCESS_ALLOWED)(Child objects can inherit this access-control entry), (Inherited ACE),
Read Permissions,
List Children,
READ_PROP: ALL,
-DOMAINNAME\Enterprise Admins: (ACCESS_ALLOWED)(Child objects can inherit this access-control entry), (Inherited ACE),
Read Permissions,
Write Permissions,
Take Ownership
CREATE_CHILD: ALL,
DELETE_CHILD: ALL,
List Children,
DS_SELF,
READ_PROP: ALL,
WRITE_PROP: ALL,
DELETE_TREE,
LIST_OBJECT,
CONTROL_ACCESS: ALL,
-DOMAINNAME\Domain Admins: (ACCESS_ALLOWED)(Child objects can inherit this access-control entry), (Inherited ACE),
Read Permissions,
Write Permissions,
Take Ownership
CREATE_CHILD: ALL,
List Children,
DS_SELF,
READ_PROP: ALL,
WRITE_PROP: ALL,
LIST_OBJECT,
CONTROL_ACCESS: ALL,
________________________________________
Report Summary
________________________________________
Total number of Objects dumped: 1
Total time spent generating report: 00 hours: 00 minutes: 00 seconds.

bloodymalth5

Just a quick question, did you use ADSI Edit to add the entries like on the site?

Jon Scriven

ASKER

Yes I followed all the instructions on the site but it made no difference.

bloodymalth5

ok try this. Try following the guide again, but give everyone full access to see if this works.

If this works then there is still a permissions issues somewhere.

Let me know.

ScintillateRich

Hello

I'm scriven_j's colleague, taking over on this while he's on holiday.

I've followed your advice and granted the Everyone group full control to CN=Domain,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Domain,DC=local

But the problem remains.

Any other ideas?

Thanks

Richard

bloodymalth5

Hello ScintillateRich. Sorry for the delay in getting back with you. I have been trying to get the problem to show up in my test enviroment, and I have been unsuccessful.

Try looking at this
http://support.microsoft.com/kb/839531

Jon Scriven

ASKER

Hi bloodymath5,

I'm afraid this KB article just gives the same instructions as we have already tried.

Can you not work anything out from the dump?

Jon

ASKER CERTIFIED SOLUTION

bloodymalth5

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ScintillateRich

Hi bloodymalth5

Thanks for all your help with this. iI've just realised that the full access permissions that you recommended we set were set to "this object only". I changed this to "This object and all child objects", and now we can correctly use Outlook. (Hurrah!)

So it looks like the problem was with one of the child objects of MSExchOrganizationContainer, not the container itself.

Shall I go through and give Everyone full control to each child object individually to find out which one was the problem? Or do you have another idea?

Thanks

Richard

SOLUTION

ScintillateRich

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bloodymalth5

Yeah sorry about that. I should have went into detail. I was just wondering if giving everyone full permissions would fix the problem. I should have told you to remove that once we found that it didnt work.

In any case im glad its working for you now.