We did an ADMT migration to a new forest with SIDHistory and moved the mailboxes from Exchange 2010 to the new Exchange 2010 org. Now we're experiencing the issue that we can't remove full-access permissions in EMC or EMS: [PS] D:\Program Files\Exchange\scripts>Get-MailboxPermission salaris -User ads\scj | fl RunspaceId : 37ea5a81-0f57-47e0-b97b-13c2b31f4bbf AccessRights : {FullAccess} Deny : False InheritanceType : All User : ADS\scj Identity : ads.local/bedrijfsvoering/accounts/mailbox-users/salaris IsInherited : False IsValid : True [PS] D:\Program Files\Exchange\scripts>Remove-MailboxPermission salaris -User ads\scj -AccessRights fullaccess WARNING: Can't remove the access control entry on the object "CN=salaris,OU=mailbox-users,OU=accounts,OU=bedrijfsvoering,DC=ads,DC=local" for account "ADS\scj" because the ACE doesn't exist on the object. I have read other similar topics: http://social.technet.microsoft.com/Forums/en/exchangesoftwareupdate/thread/50a94a45-903e-409e-ba5c-116d84bed7ff http://social.technet.microsoft.com/Forums/en/exchange2010/thread/8aee3a31-e13a-4819-9fda-1022f890094e I understand the issue is being caused by Exchange being displaying the wrong account because of SIDhistory. The work-around with Exchange 2003 System Manager does not work for me, the Exchange Advanced options are not showing in ADUC after I installed ESM. This might be because Exchange 2003 was never installed in this forest. Anyway, we still need SIDhistory because other resources are not yet migrated. Any suggestions to fix this issue without breaking stuff?With kind regards / Met vriendelijke groet, Jetze Mellema | http://jetzemellema.blogspot.com/

Hi Jetze, ADS is the new domain name? Some partners solved the problem by replacing the new domain name(ads\scj)with the old one, did you try it? Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.Frank Wang TechNet Community Support