Send As Permissions Disappearing From User Mailboxes

We have the need for our admin assistants to be able to send email "as" a number of other users.   We have a security group call "Administrative Assistants Group" to which they are all members.  To add SendAs permissions to every user mailbox, we ran this command:  

get-mailbox | Add-ADPermission –ExtendedRights “Send As” -user “calvaryspringfield.org\Administrative Assistants Group” | FL

Command works fine.   Check the user mailboxes thru the EMC > Manage SendAs Permissions and every user shows that group having SendAs permissions.    BUT, the problem is after a while, those persmissions disappear on every user mailbox.   I have researched this and there are numerous reports of this occurring.   One site indicated AD replication was not happening across all DCs.  Checked AD Sites and found 2 decommissioned DCs still listed.   Deleted those.  Re-applied permissions but again they disappeared after a while.   The funny thing is that this used to work and SendAs permissiones never disappeared, so maybe some correction changed the way it works.    Needless to say, this can be frustrating for the admin assistancts, since they never know if it will work or not.......  mostly not, because the permissions disappear shortly after being applied.    Did not find a real resolution to the problem in research.   Anybody got a fix for this?   Exchange 2010 running on Windows 2012 Server.   Please advise.  Thanks.
rstuemkeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MattieGreenCommented:
What other groups are these users part of?  I've seen this happen when the user / group is part of a protected group. Members of protected groups return to default every hour hence the setting drops off.
0
Will SzymkowskiSenior Solution ArchitectCommented:
As stated already this is most likely a Protected Group issue. The ADminSDHolder service is run every hour and will remove all permissions where users are part of these groups.

AdminSDHolder Explained
https://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx

Will.
0
rstuemkeAuthor Commented:
OK.  Here are the all groups that the normal users are members (those users which get Send As permssions assigned to for the Admin Assist. Group ):

Several local security groups used to assign permissions to network shares:  such as - Church Office Group, Church Compliance Group, etc,   There are about 6 of these.

Domain Users is the only other one
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

rstuemkeAuthor Commented:
Should I give Admin Assist Group Send As permissions to Domain Users Group?????
0
MattieGreenCommented:
The thing to check would be if those groups you have listed are a member of any protected groups.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rstuemkeAuthor Commented:
OK..... ran this command:

Get-ADGroup -LDAPFilter "(objectcategory=group)(admincount=1)"

And DOMAIN USERS Group shows up as protected.-
0
MattieGreenCommented:
Ok so check what groups the domain users have been put under. Sounds like someone has dropped that group into the Administrators or Domain Admins Group etc.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.