I have exchange 2010 and a couple of domain controllers. I retested the permissions in AD and DNS (very brilliant thing to do, indeed.. just mocking), we are no longer able to manage exchange server, neither able to add any new mailboxes, error is as follows: Active directory response: 00002098: SecErr: DSID-03150E49, problem 4003 (INSUFF_ACCESS_RIGHTS)

I no longer see any security groups for excahnge anywhere in the domain controllers. What can I do to restore the correct permissions?

  • Give us some details on exactly what you did that caused this problem.
    – joeqwerty
    Apr 15 '17 at 15:06
  • But the Exchange Schema is still in place... means Exchange is working fine?
    – BastianW
    Apr 15 '17 at 18:04
  • yes, it works fine.. rather the issue is that no one can create a mailbox..
    – elekgeek
    Apr 15 '17 at 19:13
  • Joe, wt details do u need?
    – elekgeek
    Apr 15 '17 at 19:14
  • What permissions did you change and where did you change them from?
    – joeqwerty
    Apr 16 '17 at 14:39

Well, any details about "resetting the permissions in AD and DNS"? It's helpful for troubleshooting, or test it in lab to fix it.

Normally, we can re-run Exchange installation with ".\setup /Preparead" only to prepare AD object, not install Exchange server.


setup /adprep doesn't work. SP version in Exchange server 2010 installation media is different. In my case, setup /adprep will never work because I have already updated my servers to SP3.

To make a long story short, I did the following:

1. setup /PrepareLegacyExchangePermissions from Exchange Server 2010 installation media.

2. Under "Active Directory Users and Computers", expand System container, right click for properties on AdminSDHolder, go to Security tab, click Advanced, click "Enable Inheritance".

and that's it. I am happy to find out that it is possible to clean the rubbish caused by others, finally!!

P.S. Enable Inheritance was required because, under many circumstances after getting Exchange Server 2003/7 upgraded to 2010, permissions had to be applied not just "on this object only", rather on all descendants as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.