Solved

Active Sync Error

Posted on 2014-02-24
8
1,153 Views
Last Modified: 2014-03-03
Hi All.

  I have Exchange 2010 and am trying to get Active Sync working in preparation for a migration from BES to an MDM.   When I run the MS Remote Connectivity Analyzer everything but one thing passes.

Attempting the FolderSync command on the Exchange ActiveSync session.
       The test of the FolderSync command failed.
              
      Additional Details
       
Exchange ActiveSync returned an HTTP 500 response (Internal Server Error).
Diagnostics:

I then looked in the event logs on the exchange server and see this error:

Exchange ActiveSync doesn't have sufficient permissions to create the "CN=XXX,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=XXX,DC=com" container under Active Directory user "Active Directory operation failed on XXXX.com. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
".
Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchActiveSyncDevices" and doesn't have any deny permissions that block such operations.

 So I go onto one of my DCs and verify that the test account indeed has "Include inheritable permissions from this object's parent" checked and that that domain\Exchange Server has the above mentioned permissions on the account but it still doesn't work.  Any suggestions?
0
Comment
Question by:BrianVan
  • 5
  • 3
8 Comments
 
LVL 9

Expert Comment

by:Sean
ID: 39883270
To work around this issue, assign the Exchange Servers group the right to change permissions against msExchActiveSyncDevices objects. To do this, follow these steps:

    Start Active Directory Users and Computers.
    Click View, and then click to enable Advanced Features.
    Right-click the object where you want to change the Exchange Server permissions, and then click Properties.

    Note You can change permissions against a user, an organizational unit, or a domain.
    On the Security tab, click Advanced.
    Click Add, type Exchange Servers, and then click OK.
    In the Apply to box, click Descendant msExchActiveSyncDevices objects.
    Under Permissions, click to enable Modify Permissions.
    Click OK three times.

http://support.microsoft.com/kb/2579075
0
 

Author Comment

by:BrianVan
ID: 39883347
Hello Zindel1.

  I did the steps you suggested and no change.
0
 
LVL 9

Expert Comment

by:Sean
ID: 39883362
http://ayalaaii.wordpress.com/2012/12/20/exchange-2010-insuff_access_rights-this-error-is-not-retriable-additional-information-access-is-denied/

 if the “Include Inheritable permissions from this objects parent” is cheked you uncheck it Apply setting, then go back check it and Apply agaain, ensuring that permission will get re-applied
0
 

Author Comment

by:BrianVan
ID: 39883625
Still not working.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 9

Expert Comment

by:Sean
ID: 39883637
is this for just one user or all users?
0
 

Author Comment

by:BrianVan
ID: 39883641
I have tested it with 4 users and they have all had the same results so I would assume it is affecting all users.
0
 

Accepted Solution

by:
BrianVan earned 0 total points
ID: 39889057
Well I finally figured it out.  After much trial and error it turns out that the first time I ran the 'prepareAD' command something went wrong.  I ran setup /prepareAD on the mail server again and now it suddenly works.  Not sure what was wrong but it's working now.  Thanks for the help all.
0
 

Author Closing Comment

by:BrianVan
ID: 39900021
Figured it out myself
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
how to add IIS SMTP to handle application/Scanner relays into office 365.
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now