Code, Code, Revolution!
Exchange 2010 – iPhone ActiveSync issue
9Jan2010 Filed under: iPhone Author: Björn SållarpThis week we finally got around to upgrade our old Exchange 2003 server, fortunately we waited a few extra months and skipped Exchange 2007 for 2010. The upgrade was handled by our friendly neighbor and also our new ISP: DGC. We did encounter one problem after the upgrade that I assume others will face as well. Some accounts, mine included, couldn’t get the iPhone ActiveSync to work, it worked before the migration to 2010.
Cannot get mail. The connection to the server failed.
After the migration it didn’t. I tried the test service from Microsoft: Microsoft Exchange Server Remote Connectivity Analyzer and it clearly indicated that something was wrong with my account but suggested it had something to do with forms authentication being enabled, which it wasn’t. I found this error message in the event log on our new Exchange 2010 server:
Exchange ActiveSync doesn’t have sufficient permissions to create the “CN=Björn Sållarp,OU=Users,OU=Avantime Development,OU=Avantime Production,DC=avantime,DC=local” container under Active Directory user “Active Directory operation failed on KELLY.avantime.local. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-03151E04, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
“.
Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type “msExchangeActiveSyncDevices” and doesn’t have any deny permissions that block such operations.Details:%3
Right.. This basically means the account lack permissions in the Active Directory. I figured out that because my account has been added to what’s called a “protected group” such as Domain Admins the setting for my account to inherit permissions has been removed by Active Directory. This excellent blog post explains how to get the inherited permissions back. http://www.ffoutpost.net/2009/11/10/resolve-issues-with-activesync-not-working-in-exchange-2010 remember to remove the account from the protected group before you enable inheritance, otherwise inheritance will be removed again by Active Directory within an hour or so.
Related posts
- Tags: Exchange 2010, iPhone
Donate!?
14 Responses to “Exchange 2010 – iPhone ActiveSync issue”
Leave a reply
About this blog
With this blog I try to provide useful tips and solutions for programming .NET, Objective-C and more. My name is Björn Sållarp, and I love writing code.
Download Mitt Saldo
It's now available on AppStore. It's free and open source. Read more about the app here: Swedish / English
Download from AppStore!
Donate!?
James
October 19th, 2010 at 3:52 am
HAHA ! YOU LEGENDDDDD
I recently came back to work and while I was gone they had upgraded to exchange 2010. I was previously a domain admin and did not have inheritable permissions set on my account.
I had been trying for about 6 hours.. reloading software… checking settings.. but after this post I went straight to my Active Directory account and saw that in my permissions, ‘inherit permissions from parent object’ was unticked. I ticked it and began synching straight away – you are a legend thank you !!
BABEK
October 27th, 2010 at 6:56 pm
Hi guys, I have exactly the same issue, just the link here is broken. Can you help me getting around this problem?
Thanks
Z23
March 14th, 2011 at 6:47 pm
All what you have to do is: right clic on your user account in Active Directory Users and Computers MMC – on the Security tab you clic ADVANCED then you check the cas near include inheritble permissions….etc. and OK.
That’s all.
Thanks.
Kashif Maqbool
May 12th, 2011 at 10:16 am
Hi,
Thanks for the Tip. It save my day. Now, I’m able to Sync iPhone / Nokia to my Exchange 2010. Five Stars *****
Thanks Again.
AR
June 24th, 2011 at 2:29 pm
I administer 15 or so IPhones, do I need to do this for ALL users, or just the user I log into Exchange with?
Ryan
July 1st, 2011 at 2:26 am
I am a domain admin. I cannot do my job without being a member of the group. So can I not have my exchange account on my iPhone because of this issue? Surely there must be a way!
maddi
September 14th, 2011 at 7:41 am
i am a domain admin and i ticked the box through the security tab and re verified and is now working for me!
David Cannon
October 7th, 2011 at 7:22 pm
Ryan, Best Practice would be to have a Domain admin account, and then a regular user account for yourself. Just log into the Domain Admin account, when you need to do Admin Things. Use the regular account for day to day stuff. When you need to do admin things, many of the apps allow you to open them with the ‘right Click’ LOG ON AS …. option, where you would put in your Admin credentials
Jerry Ruado
November 16th, 2011 at 11:12 am
Thanks guys it’s very helpful to me
John Weber
January 28th, 2012 at 12:33 am
What is being discussed here is the adminsdholder function. This affects a wide range of domain groups – although the one that comes up the most is the domain admins.
If you migrate, or fail to migrate, and you check that box, the required perms flow down into your account, that is why things start working. Simple enough.
As to the “I need that group membership” – I agree with the second account advice. But know this also – after adminsdholder clears your account checkbox, the perms that flowed down are still there and your sync will still work.
http://tsoorad.blogspot.com/2011/08/adminsdholder-with-exchange-and-lync.html may help you understand this in more detail.
-John
Scott
February 8th, 2012 at 8:56 pm
Worked like a charm, thanks! Now to get resources from a 2003 server to work with 2010 users who have been migrated…
Engin Coskuncay
February 24th, 2012 at 4:14 pm
Thx dude. Worked quite well on my system too.
I spend 2 days to solve this issue.
ActiveSync woes–“Cannot get mail” and the case of the endless re-sync | User Error
July 30th, 2012 at 3:18 am
[...] usual suggestions of permissions on the user account in AD and various other settings were not relevant. We even investigated the possibility that the problem [...]
Charles
September 24th, 2012 at 9:56 pm
All –
One thing that was tripping me up until I woke up (*laughs at self*) is that to get the ‘Security’ tab that you need to, in ADUC, go to View and turn on Advanced Features. Just thought I’d share this. Otherwise, this solution that James posted – SPOT ON!!
Charles