FullAccess IsInherited: False Deny: True
Last week, I was messing with Anonymous Calendar sharing policy with my account which is a member of the domain admins, administrator groups. The account has been operating fine over the weekend until on Monday morning I noticed I can no longer connect
via Outlook Desktop client. When I connect via Outlook, it remains disconnected. However, I can connect with ActiveSync and OWA without any issue, as long as I add myself as "Manage Full Access Permission” to my own account.
When I run the command: "get-mailboxpermission -user yguelce”
AccessRight: FullAccess IsInherited: False Deny: False
AccessRight: FullAccess IsInherited: True Deny: True
AccessRight: FullAccess, DeleteItem, Read Permission, Change IsInherited: True Deny: True
When I remove my username from Manage Full Access Permission, the IsInherited Deny changed to TRUE. At that point, I can't login via Outlook Desktop, OWA or ActiveSync.
"get-mailboxpermission -user yguelce”
AccessRight: FullAccess IsInherited: False Deny: True
AccessRight: FullAccess IsInherited: True Deny: True
AccessRight: FullAccess, DeleteItem, Read Permission, Change Inherited: True Deny: True
See Attachment
I believe this first line is the reason I can't connect via Outlook. But I can't figure how to remove this IsInherited: False from my account.
If you have any suggestions, please share. Thank you in advanced.
October 26th, 2011 2:23pm
Remove you account from the Domain Admins group, this is probably why you cant login.
It;s not recommened to have a mailbox assocciated with an privledge account.
They are protected by the AdminSDholder and have deny permissions.
Use a normal account for a mailbox
Sukh
Free Windows Admin Tool Kit Click here and download it now
October 26th, 2011 3:20pm
Thanks. I don't want to take the chances of removing my account from the domain admins group. Besides, we have several other admins with the same rights and it has been working that way for years. There has to be a way to fix this issue. ThanksYvel Guelce
October 27th, 2011 2:56pm
They must have reversed what AdminSDHolder does, (changed permissions so it;s not protected).
You can try this, it may help -
http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/bd1b4a62-fe37-47f9-94f9-3c82fe328d69/Sukh
Free Windows Admin Tool Kit Click here and download it now
October 27th, 2011 3:06pm
They must have reversed what AdminSDHolder does, (changed permissions so it;s not protected).
You can try this, it may help -
http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/bd1b4a62-fe37-47f9-94f9-3c82fe328d69/Sukh
October 27th, 2011 9:54pm
Sukh828, tried removing my account from the domain admins and administrators groups, but that didn't seem to resolve the issue. Thanks through.
Free Windows Admin Tool Kit Click here and download it now
November 4th, 2011 2:47pm
I think I may have misread the post.
Can you clarify, what the issue is, what changes were made and what you do to get the error.
ThanksSukh
November 4th, 2011 3:08pm