EAS issues after moving user mailboxes to Exchange 2010
In each environments that I’ve transitioned from either Exchange 2003 or Exchange 2007 to Exchange 2010, I’ve hit an issue related to Exchange ActiveSync. After moving user mailboxes to Exchange 2010, mobile devices could no longer synchronize with a mailbox. When performing a manual synchronization, I saw this error on the device:
Result:
ActiveSync registered a problem on the server.
Support code: 0×85010014
This issue occurs if the AD user object of the Exchange 2010 user doesn’t have “Allow inheritable permissions from the parent to propagate to this object and all child objects. Include these with entries explicitly defined here.”
Once this setting is checked, Exchange ActiveSync works again.
This issue is easy to fix for a few users (when you know the above that is!), but what if you need to change this setting for several thousands of users?
You could go create a script, but then again what you you don’t have any scripting skills? Well don’t worry, I’ve found out that ADModify.NET is capable of changing this setting on users in bulk.
Just fire up ADModify.NET and select the OU(s) containing the users and check the setting under the Account tab as shown below.
Cheers,
Henrik Walther
Technology Architect/Writer
MCM: Exchange 2007 | MVP: Exchange Architecture
MCITP: EMA + EA | MCSE: M + S | TechNet Influent
michael bila Says:
September 24th, 2009 at 5:48 am
which AD object are you referring to?
the user object or mailbox object?
Henrik Walther Says:
September 24th, 2009 at 5:49 am
AD objects.
nicholas hellström Says:
November 27th, 2009 at 12:38 pm
Awesome stuff man! Solved it all with ADModify.NET. Couldn’t work without google and people like you! Thanks a bunch man!
//Nicholas
Henrik Walther Says:
November 27th, 2009 at 2:01 pm
You’re welcome
James Says:
January 12th, 2010 at 11:14 am
You are awesome. This worked for several user-specific errors I was chasing. Thank you very much.
Gary P Says:
January 14th, 2010 at 9:39 pm
THANK YOU!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Steve Pelletier Says:
January 29th, 2010 at 3:23 pm
That worked !!! Excellent post - THANKS.
–
Steve
Hayden Kirk Says:
March 1st, 2010 at 1:36 am
Wow… been searching all night. Tried everything. What an oddball. Thanks for the fix.
ActiveSync Issues after Move-Mailbox » Exchange Blog Says:
April 11th, 2010 at 11:20 pm
[…] Henrik Walther wrote a good article about it here […]
astarbe Says:
April 25th, 2010 at 4:55 pm
THANKS! WORKS PERFETC!!! seemed I was in a nightmare, you rock !
Kyaw Htay Says:
June 7th, 2010 at 5:47 pm
Thanks a million. What a great article! Saved us a lot of time. Thanks again!
Henrik Walther Says:
June 8th, 2010 at 12:28 am
You’re welcome!
Robert Says:
June 15th, 2010 at 4:07 pm
I had been troubleshooting this all day, You are a lifesaver
Alex Says:
June 23rd, 2010 at 3:00 am
It would probably have taken ages for me to think of something as improbable as this. THANKS!!!!
Matty-CT Says:
June 30th, 2010 at 4:01 pm
I ran the testexchangeconnectivity.com tool and experienced the foldersync http 500 error. After a few Google searches, I ended up here. I made the changes as the screen shots showed and bam! it works. Thanks a million. Lord knows how long it would have been until I figured it out otherwise.
Erwin Says:
November 25th, 2010 at 7:57 am
Thansk a lot for sharing this.
Chris Says:
December 15th, 2010 at 5:54 am
Are you doing this on the domain controler, or the ex2010 box? Where are you seeing this window? Thanks!
Henrik Walther Says:
December 15th, 2010 at 5:58 am
so this is a security setting on the AD user object.
You can see it via ADUC > properties of user object > Security tab > Advanced.
Note
You need to enable Advanced Featured under the view menu in the ADUC console before the “Security” tab becomes visible.
Chris Says:
December 15th, 2010 at 6:28 am
(Slaps forehead) Oh, I had to enable the Advanced Features.
Mine says “Include inheritable permissions from this object’s parent”. …And is already checked. Hmm.. Thanks
Henrik Walther Says:
December 15th, 2010 at 6:30 am
You’re welcome…
juan Says:
February 18th, 2011 at 9:30 am
you save my live . ..
Thanks! so much!!
Henrik Walther Says:
February 18th, 2011 at 9:32 am
You welcome
Stone Says:
March 31st, 2011 at 12:11 pm
Thank u very much! Solved the problem with your hint!
Eddie Says:
May 30th, 2011 at 8:01 am
Great Post.
van_rusu Says:
August 9th, 2011 at 7:19 am
unfortunally, this not help for me
Vince Says:
October 13th, 2011 at 8:58 pm
Just wanted to say thank you for this one, real strange one this was.
Henrik Walther Says:
October 14th, 2011 at 1:19 am
Good to hear it helped you.
Henrik
Rob Says:
December 7th, 2011 at 4:03 pm
ok, great (setting inheritable perms) it works for normal users. What if you are the Admin? then how do you get your phone to sync? and keep it syncing?? we are only using iPhones.
we did our migration to 2010 sp1 and most of our iphones picked up right away. i have 4 exceptions though, and 2 of the 4 have admin level clearance! all 4 exhibit the symptoms discussed above, repeated password request or failed to connect to server.
it is something specific to the account or the phone/per user - that is for sure.
Rob B.
Chris King Says:
January 17th, 2012 at 11:30 am
This saved my life!
Thank You!!!!