Get-Queue : Access Denied ( Exchange 2010 )

Tamooz
Tamooz used Ask the Experts™
on
Hi All,

I have a problem with Get-Queue command in EMS (Exchange Management Shell) in Exchange 2010. I can't access to view exchange queue.
Yesterday it was ok, today i have "Access Denied". My user have all permissions in Exchange and Enterprise Admin.
What can i do? Were is the problem?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Kini pradeepDevelopment Manager

Commented:
is this after you run the shell with Run as administrator ? could be a dumb question

Author

Commented:
Sure, i have this error from today too :
SACL Watcher servicelet found that the SeSecurityPrivilege privilege is removed from account S-1-5-21-1824101739-2438762037-685873216-5121.

What is that means?

Author

Commented:
ok, this sid  S-1-5-21-1824101739-2438762037-685873216-5121 its my Exchange Servers group. How can i add SeSecurityPrivilege privilege to this group again?
Expert Spotlight: Joe Anderson (DatabaseMX)

We’ve posted a new Expert Spotlight!  Joe Anderson (DatabaseMX) has been on Experts Exchange since 2006. Learn more about this database architect, guitar aficionado, and Microsoft MVP.

Kini pradeepDevelopment Manager

Commented:
Does this SID belong to any groups that have privileges on Exchange.
find what is the group/user name for the SID
http://technet.microsoft.com/en-us/library/ff730940.aspx
once the name is identified, need to check whether this was removed by somebody or whether there was any change to group policy manage auditing & security log properties

check this http://clintboessen.blogspot.in/2011/12/sacl-watcher-servicelet-found-that.html

Author

Commented:
ok, this sid  S-1-5-21-1824101739-2438762037-685873216-5121 its my Exchange Servers group. How can i add SeSecurityPrivilege privilege to this group again?
Development Manager
Commented:
Open GPMC.msc
open the default domain controllers policy.
go to computer config, windows settings, security setting user rights assignment
then add Exchange enterprise servers and Exchange servers under
Manage audit and security log

Author

Commented:
Thank you, after this steps and gpupdate /force still Access Denied on get-queue command.
Kini pradeepDevelopment Manager

Commented:
are you still seeing SACL Watcher servicelet found that the SeSecurityPrivilege privilege is removed from account S-1-5-21-1824101739-2438762037-685873216-5121. in the event viewer?

Author

Commented:
Tha last one before 6 hours. I think it's gone, but i still cant access to exchange queue.
May be restart will resolve this?
Kini pradeepDevelopment Manager
Commented:
This policy is applied at the computer configuration for Domain controllers. A gpupdate /force on the DC should have applied the policy.

A restart could fix this :)
Kini pradeepDevelopment Manager

Commented:
through the queue viewer do you see the queues in EMC ? ideally should not but just a thought

Author

Commented:
Great, it's working now!!!
Thank you very much for help!!!
Kini pradeepDevelopment Manager

Commented:
Glad to be of assistance. :)

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial