• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 656
  • Last Modified:

Can't move mailbox to Exchange 2010 from Exchange 2007

I have full DomainAdmin rights, but I'm unable to move or create a mailbox on my new Exchange 2010 server.  I've tried running the Full Access command with the Shell, but I still don't have the right permissions.
0
gharveyz28
Asked:
gharveyz28
  • 4
  • 2
  • 2
1 Solution
 
PcGod718Commented:
i believe there is a diff between a domain admin and an exchange admin.  a couple of years ago, MS decided to flip a few security settings..   try making a user that is NOT a domain admin but IS an exchange enterprise server admin (either that or enterprise admin)  i forget which specifically is it..
0
 
gharveyz28Author Commented:
Sorry I'm a member of the following groups:

Domain Admins
Domain Users
Enterprise Admins
Exchange Organization Administrators
Organization Management
Recipient Management
Schema Admins
Server Management

Am I missing a group or should I remove a group?
0
 
JoeBelliveauCommented:
Create a test user on the domain, set the password to a complex string and give the user just exchange org and public folder org admin rights, use said user while logged into the server and the on server exchange maagement console to try and create a mailbox.

Im betting you have a fundamental issue and it's not rights.

Run the Best practices analyzer from the toolbox as well if the second user account does not work.

I'd also add exchange reciepient admin to your rights group

0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
PcGod718Commented:
ugh, i hate not being around a faster system....
anyhoo.. if memory serves, theres a conflict now if you are a member of DOMAIN ADMINS and EXCHADMIN

i dont see that u listed EXCHADMIN, so im going to assume thats the group you need to be in to make the changes.

i think the procedure these days is to have a domain admins group and exchadmins and they are inherently separated.  there is some reg hack i think that lets you be a member of both.

so i would create a NEW user, called MAILADMIN, do NOT add them to Domain Admins, but DO add them to EXCHADMIN, see if that new user can do the mail stuff for you.
0
 
gharveyz28Author Commented:
Still an issue....
0
 
JoeBelliveauCommented:
gharveyz28 can you show me the output of when you try and move the mailbox from the wizard ?

I have seen to many times in PS where people typo.

Is it a permissions denied message or a failure to find the box ?

Output please.
0
 
gharveyz28Author Commented:
Here is the error from the Local Move Request Wizard on the Exchange 2010 Server. (trying to move mailbox from 2007 to 2010).

Error:
Active Directory operation failed on Zeus.xxxx.xxxx.net. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150E8A, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0


The user has insufficient access rights.
Click here for help... http://technet.microsoft.com/en-US/library/ms.exch.err.default(EXCHG.140).aspx?v=14.1.218.11&t=exchgf1&e=ms.exch.err.Ex6AE46B

Exchange Management Shell command attempted:
'xxxx.xxxx.net/CORP/ITS/Systems/Gxxx - Domain Admin account' | New-MoveRequest -TargetDatabase 'San Jose'

Elapsed Time: 00:00:11
0
 
gharveyz28Author Commented:
Solved it.

I removed myself from every Exchange Group except:

Exchange Organization Administrators
Organization Administrators
Server Management

I guess I was a member of a group with more restrictive permissions.
0

Featured Post

Free tool for managing users' photos in Office 365

Easily upload multiple users’ photos to Office 365. Manage them with an intuitive GUI and use handy built-in cropping and resizing options. Link photos with users based on Azure AD attributes. Free tool!

  • 4
  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now