Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just a quick one. Having an issue trying to logon to the domain administrators mailbox in Outlook 2010. Can set the account up fine in Outlook but when you open Outlook you get the "Cannot Open your default folders - You do not have permissison to log on" message.

Now another ordinary user has 'Full Access' permissions via Exchange and has the account setup in their Outlook as an additional mailbox and is receiveing mail fine into that account, forwarding on etc. I gave myself full permissions and added into my outlook but it will not open the folder in Outlook.

I also tried logging into OWA as the Administrator and got a permissions erorr as well.

I've gone through every property tab in Exchange 2010 Management Console and nothing is out of the ordinary there. I dropped into the EMS and did a Get-MailboxPermissions:

User                 Access Rights   IsInherited   Deny
domain\Exchange D... {FullAccess}      False       True
domain\Exchange S... {FullAccess}      False       True
S-1-5-21-11772389... {FullAccess}      False       True
S-1-5-21-11772389... {FullAccess}      False       True
NT AUTHORITY\SELF    {SendAs, RP}      False       False
domain\Administrator {FullAccess}      False       False
domain\username      {FullAccess}      False       False
domain\myusername    {FullAccess}      False       False
domain\Administrator {FullAccess}      True        True
domain\Domain Admins {FullAccess}      True        True
domain\Enterprise... {FullAccess}      True        True
domain\Exchange O... {FullAccess}      True        True
S-1-5-21-11772389... {FullAccess}      True        True
domain\Organizati... {FullAccess}      True        True
NT AUTHORITY\SYSTEM  {FullAccess}      True        False
NT AUTHORITY\NETW... {RP}              True        False
domain\Exchange D... {FullAccess}      True        False
domain\Exchange S... {FullAccess}      True        False
domain\Exchange P... {RP}              True        False
domain\Organizati... {RP}              True        False
domain\Public Fol... {RP}              True        False
domain\Administrator {FA, DI, RP, ChP} True        False
domain\Exchange D... {RP}              True        False
domain\Exchange S... {FA, DI, RP, ChP} True        False
domain\Exchange S... {RP}              True        False
domain\Exchange O... {FA, DI, RP, ChP} True        False
domain\Exchange V... {RP}              True        False
S-1-5-21-11772389... {FA, DI, RP, ChP} True        False
domain\Exchange T... {FA, DI, RP, ChP} True        False
domain\Organizati... {FA, DI, RP, ChP} True        False
domain\Delegated ... {RP}              True        False
domain\Domain Admins {FA, DI, RP, ChP} True        False
domain\Enterprise... {FA, DI, RP, ChP} True        False

(and I am hoping that formats out ok....I dropped off the identity column and abbreviated common terms ie FA = Full Access, CHP = Change Permisssions, RP = Read Permissions etc)

I am guessing that the issue may be an explicit deny permission thats come from somewhere?

Not really sure the commandlets to fix this and what should really be there for the administrator account.

And yes - I didn't set this up :) For some reason the Administrator email account was setup in years past to be used for receiving faxes and a number of business related mailing lists. As soon as I fix this I will be removing access to it.

Cheers

share|improve this question
    
Please add the name of the columns to the table (what do the True/False columns mean?) –  MichelZ Jun 29 '12 at 4:27
    
Ahh bugger I chopped them off by accident, let me see if I can add them back in.... –  vlannoob Jun 29 '12 at 4:33
    
I wonder if my inability to open the folder in my Outlook is because I am a member of the domain admin group? Whisl the user who can access the entire mailbox is a member of Domain Users only? –  vlannoob Jun 29 '12 at 4:36
    
Yes, as you can see there is an explicit deny to the Domain Admins group, that's most probably the cause –  MichelZ Jun 29 '12 at 4:37
    
any ideas on how to remove this? –  vlannoob Jun 29 '12 at 4:51
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.