Solved

How can I allow a 2010 Exchange server to use DC's that don't have presmissions to read the SACL on the ntSecurityDescriptor attribute?

Posted on 2011-02-24
6
919 Views
Last Modified: 2012-08-14
We have a relatively new 2010 Exchange server and 2 new 2008 DC’s. In all there are 3 DC’s but the Exchange server can only see the oldest DC (2003) as a domain controller server and Global Catalog Server.

The new exchange server can see all DC’s in DNS. The old Exchange server (2003) has been decommissioned, I am unsure if the Recipient Update Service was assigned to the new exchange server whilst it was being decommissioned.

On the new exchange server in the Event Viewer under Event ID 2080 I can see that the 2 new DC’s don’t have SACL rights, which from what I understand is needed in order to be used by Exchange 2010. We are in the process of decommissioning the old DC but after testing the environment (shutdown) without the old DC, Exchange services stop (which makes sense as it can’t access the 2 new DC’s).

Is there a workaround to give the new DC’s permissions to read the SACL on the ntSecurityDescriptor attribute so that the Exchange server can use them when we get rid of the old DC?
0
Comment
Question by:aztechcomms
  • 4
  • 2
6 Comments
 
LVL 3

Expert Comment

by:vicoso
ID: 34970361
We can Powershell to force the Exchange 2010 to use a preferred local domain controller:
"Set-ADServerSettings –PreferredServer "mydomaincontrollername.domainname.local"
0
 

Author Comment

by:aztechcomms
ID: 34970450
We have already tried forcing this but this didn't work - Exchange will only use a DC that has permissions to read the SACL on the attribute as mentioned above.
0
 
LVL 3

Expert Comment

by:vicoso
ID: 34973662
Exchange does not use any domain controller that does not have permissions to read the SACL on the nTSecurityDescriptor attribute in the domain controller.
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 

Author Comment

by:aztechcomms
ID: 34977701
The last paragraph of the initial question;

Is there a workaround to give the new DC’s permissions to read the SACL on the ntSecurityDescriptor attribute so that the Exchange server can use them when we get rid of the old DC?
0
 

Accepted Solution

by:
aztechcomms earned 0 total points
ID: 35009228
The new DC's were built after the Exchange server and the FSMO roles transferred from the PDC to the new DC. Ran domain prep again (for the new DC) and the SACL permissions were granted.
0
 

Author Closing Comment

by:aztechcomms
ID: 35045597
This has fixed the issue
0

Featured Post

Make managing Office 365 email signatures a breeze

Are you using Office 365? Having trouble trying to set up email signatures for your users? Getting stressed out managing multiple signatures? Need an easier way to manage? We have a solution for you, try the most-user friendly and powerful signature management tool on the market.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now