Get-ExchangeCertificate comes back with error

When I run Get-ExchangeCertificate from the Exchange Powershell, I get : Warning: An unexpected error has occurred and debug information is being generated: The process does not possess the 'SeSecurityPrivlege' privlege which is required for the operation.

When I run policytest.exe from the command line, it shows that I do.

It shows my DC server name, it shows the site name and it shows Right Found: "SeSecurityPrivlege"


I am at a loss. Other commands work fine. I ran Get-Mailbox, I ran Get-ExchangeServer and it works.

+ Get-ExchangeCertificate
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-ExchangeCertificate], Pri
   vilegeNotHeldException
    + FullyQualifiedErrorId : System.Security.AccessControl.PrivilegeNotHeldEx
   ception,Microsoft.Exchange.Management.SystemConfigurationTasks.GetExchange
  Certificate


Any ideas?
PatrickDomanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Stelian StanIT Services ManagerCommented:
Check to see if you have  KB2506146 and KB2506143 installed on your server. If you have them installed just remove them (http://blogs.technet.com/b/exchange/archive/2012/12/14/windows-management-framework-3-0-on-exchange-2007-and-exchange-2010.aspx)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Stelian StanIT Services ManagerCommented:
Also, are you running PowerShell as Administrator? If not just do that an try again.
PatrickDomanAuthor Commented:
I am running as admin.
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

PatrickDomanAuthor Commented:
I see them now. They are both in there.
PatrickDomanAuthor Commented:
I removed the Framework 3.0 update. Still not working. Rebooting Server, we'll see if that helps.
Stelian StanIT Services ManagerCommented:
sounds good. Done for today. Hope that fixes your problem.
PatrickDomanAuthor Commented:
That didn't do it, but I think you were on the right path.

Watson report about to be sent to dw20.exe for process id: 7816, with parameters: E12, c-RTL-AMD64, 08.03.0083.006, powershell, M.E.Net, M.E.S.C.X.TlsCertificateInfo.GetAccessRules, S.S.AccessControl.PrivilegeNotHeldException, c8c6, 08.03.0297.000.  ErrorReportingEnabled: False
PatrickDomanAuthor Commented:
When I type in New-ExchangeCertificate i am getting another error.

New-ExchangeCertificate: Insufficient rights to grant Network Service access to the certificate with thumbprint ..........................
PatrickDomanAuthor Commented:
I have an account called recovery on the server which I found had the Manage auditing and security log right.

I logged in as that user, and I can run the Get-ExchangeCertificate command.
Tried logging out, adding the administrator account through the Default Domain Policy to the User Rights Assignment \ Manage Auditing and Security Log there

added domain\administrator as well as just administrator

No change, still can't run Get-ExchangeCertificate
PatrickDomanAuthor Commented:
This issue is resolved.

By going into the Default Domain Policy on the DC through Group Policy Management, I was able to add the Exchange Servers group to the Local Policies\User Rights Assignment\Manage Auditing and Secrity Log.

That as well as getting the domain admin account in there allowed me to finally run the Get-ExchangeCertificate command. I then found that the SMTP service was assigned to a expired certificate and was able to run the command Enable-ExchangeCertificate -Thumbprint <thumbprintid> -Services SMTP and it assigned the SMTP service to the correct certificate. All I have left to do is to remove the SMTP service from the Internally generated certificate it has been operating under.

I ran the Enable-ExchangeCertificate -thumbprint <thumbprintidtoremove> -services "none" command.

The server certificate or what appears to be the default system certificate shows it still has the smtp service assigned. Perhaps this is by desing. Now I just need to identify how to renew that since it has expired. Not sure if that certificate being expired is causing any other issues.
Stelian StanIT Services ManagerCommented:
OK, that means you have to renew the certificate. To do that have a look on this  document: http://www.sslshopper.com/article-how-to-use-ssl-certificates-with-exchange-2007.html
PatrickDomanAuthor Commented:
My own troubleshooting allowed for resolution to the issue by putting the Exchange Servers group in the Default Domain Policy so that the Get-ExchangeCertificate command would work. While clonyxlro was able to help me resolve the issue with the knowledgebase article on the updated framework 3.0, my work resolved the issue more evidently as the framework alone was not enough to resolve the issue.
Stelian StanIT Services ManagerCommented:
Glad that is working. Thank you.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.