Hi all, This may seem like an odd question, but I'm attempting to set up the Blackberry Enterprise Express Server, and it requires some rather daunting command line gymnastics. One of the commands is in the form: Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=Users,DC=<domain_1>,DC=<domain_2>,DC=<domain_3>" What perplexes me is what to put in the -identity field. When the Exchange Management Shell window starts, the server it says it's connected to is expressed in the format "FONGSERVER.wubbalaw.local". However if I use either [PS] C:\Windows\system32>Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=Users,DC=FONGSERVER" or [PS] C:\Windows\system32>Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=Users,DC=wubbalaw" it returns the following error message: Received a referral to limestoneserver when requesting DC=FONGSERVER from FONGSERVER.wubbalawlocal. You have specified the wrong server for this operation. + CategoryInfo : NotSpecified: (0:Int32) [Add-ADPermission], ADReferralException + FullyQualifiedErrorId : B391E3C9,Microsoft.Exchange.Management.RecipientTasks.AddADPermission I'm rather baffled by this and would like some clarity on exactly what they're asking for here. Many thanks, Dennis

Try that: Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User "BESAdmin" -Identity "CN=Users,DC=wubbalaw,DC=local"With kind regards Krystian Zieja http://www.projectnenvision.com Follow me on twitter My Blog

Many thanks for you prompt reply - I'll give that a go. Cheers

Yep, that was it - it was the only combination I hadn't tried *grin*. Thanks again.

You are welcomeWith kind regards Krystian Zieja http://www.projectnenvision.com Follow me on twitter My Blog

Hello Dennis, Add-ADPermission -Identity <ADRawEntryIdParameter> ADRawEntryIdParameter is the user’s DN value in AD. You can get it by the following steps: a. Run the Adsiedit.msc from a command prompt. b. Expand “Domain”->”DC=domainName,DC=com”->”CN=Users” c. Right click on ”CN=the problematic user name”, click “Properties”. d. Find the attribute “distinguishedName” attribute. Double click copy the value of it. Thanks, Simon