Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently run two separate domains where our new implementation of exchange 2010 is currently on a separate domain the users.

My problem is: cant access his mailbox at joe@domainb via OWA even though full access and sendas has been granted on domainb's mailbox to domaina's account.

I keep receiving the error:

Access is denied. The Active Directory resource couldn't be accessed. This may be because the Active Directory object doesn't exist or the object has become corrupted, or because you don't have the correct permissions.

anyone able to help please?

Take care

share|improve this question
Update: the user is able to access OWA if he logs onto domainb, but we don't want this to happen at the moment. – Rob Sep 13 '12 at 10:28
there is also a two way trust between both domains! – Rob Sep 13 '12 at 10:56
So the user is appending their full UPN to the username when logging in to OWA? Are these 2 separate domains within the same forest, or 2 separate forests? Are you using forest-wide authentication or selective authentication with your trust? – SturdyErde Sep 14 '12 at 0:38

I would check to see if sidfiltering (sometimes called quarantining) is switched on your forest trust. If it's enabled (which it is by default) then the trust will not pass SIDs over the trust, ie during the authentication process the security identifier for domaina is never passed to domainb.

Time to break out netdom as the GUI does not offer this option by default.

share|improve this answer
SID history only applies if the objects were migrated between domains, which doesn't appear to be the case here. – MDMarra May 10 '14 at 3:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.