Solved

The user has insufficient access rights when moving mailboxes

Posted on 2013-11-01
11
2,788 Views
Last Modified: 2013-11-13
I still get this error and tried different accounts that have all the right permissions including: Enterprise Admins, Exchange Full Admins, Exchange Organizational Manament.

Please advice.

THank you very much!

Active Directory operation failed on dc01.domain.net. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
The user has insufficient access rights.
Click here for help... http://technet.microsoft.com/en-US/library/ms.exch.err.default(EXCHG.141).aspx?v=14.3.158.1&t=exchgf1&e=ms.exch.err.Ex6AE46B
Exchange Management Shell command attempted:
domain.net/USA/MIS/test user.' | New-MoveRequest -TargetDatabase 'Mailbox Database 1674393878'
0
Comment
Question by:claudiamcse
  • 6
  • 3
  • 2
11 Comments
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39616430
So your saying the account is member of Exchange Org Admins .... as if so can you explicitly add the account to Recipient Admins group and if possible restart Information store service and try the move

- Rancy
0
 

Author Comment

by:claudiamcse
ID: 39616695
I have only Recepient Management Group. Added there
0
 
LVL 34

Accepted Solution

by:
Seth Simmons earned 500 total points
ID: 39616707
another possibility is inherited permissions
if you go to the properties of that user object in AD and on the security tab then advanced and see if include inheritable permissions is checked.  if not, that could be the issue

i had this problem at my last place when migrating users from 2007 to office 365
after checking that box the mailbox moved
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:claudiamcse
ID: 39616771
Didn't work. REceive the same error with a different DC mentioned.

Active Directory operation failed on dc03.domain.net. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
The user has insufficient access rights.

Exchange Management Shell command attempted:
domain.net/USA/MIS/test user.' | New-MoveRequest -TargetDatabase 'Mailbox Database 1674393878'
0
 

Author Comment

by:claudiamcse
ID: 39617323
Regarding  the user object in AD. You are referring for the account that I am using to move the mailbox? Correct? Or the actual mailbox that I am moving. I did that for the account that I am using to move the mailbox already.
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 39617450
the account for the user's mailbox
if you're trying to move joe then it's joe's account to check

your account permissions would only be at the exchange org level as mentioned in the beginning
0
 

Author Comment

by:claudiamcse
ID: 39622125
Yes. we did that and still getting the error
0
 

Author Comment

by:claudiamcse
ID: 39622604
Did all this and still getting an error:
Warning: Unable to update Active Directory information for the source mailbox at the end of the move. Error details: An error occurred while updating a user object after the move operation. --> Active Directory operation failed on dc01.domain.net. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
 --> The user has insufficient access rights.
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39623703
Do you have appropriate Domain Admin rights to perform any changes in AD level ?

- Rancy
0
 

Author Comment

by:claudiamcse
ID: 39631738
So, we found finally what is causing it. Here is the same issue again but with more details:

The “Exchange Domain Servers” group from root domain (domain.net) getting automatically removed from Exchange Enterprise Servers Group.
So there is one parent domain domain.net and 5 child domains. Exchange 2003 servers are installed in each child domain. Exchange 2010 Hybrid was installed in the root domain Domain.com

We were getting Insufficient permissions error when moving mailboxes to the cloud as well as from 2k3 to 2010. We discovered that once we added “Exchange Domain Servers” from root domain to “Exchange Enterprise Servers” for every child domain, the issue with permissions was resolved……Only, this group disappears….Only “Exchange Domain Servers” from root domain goes missing. We checked Group Policy and confirmed that they didn’t have 3rd party tool running. Still the group keeps disappearing from Exchange Enterprise Servers. Happens in less than 10 min.

Discovered now in the security logs that Exchnage 2003 server is removing ithe member from the group every 5-10 min!!!

Please let me know your suggestions.
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 39640904
Did you try running Domainprep ?

- Rancy
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question